Hallo !

Wie ich hier im Forum gelesen habe, gibt es mein Problem schon öfter. Da aber ausdrücklich darauf hingewiesen wird, die Schritte anderer nicht auszuführen, habe ich jetzt mein eigenes Thema eröffnet.

Mein Problem sieht so aus, dass mein Browser Internet Explorer bei Googlesuchen auf falsche Seiten weiterleitet, teilweise sind es S..seiten. Wenn ich dann oben links auf den Zurück-Pfeil gehe, wieder bei Google lande und dann den gleichen Link ein 2. Mal anklicke, dann kommt erst die richtige Seite. Außerdem werden in manchen Wörtern einer Googlesuche Buchstaben durch Zeichen oder falsche Buchstaben ersetzt. Weiterhin kann ich manche Dateien nicht downloaden bzw. keine pdf-Dokumente aus dem Netz speichern. Und die Menüleiste im Internet Explorer ist weg, obwohl sie lt. Einstellungen angezeigt werden soll.

Da der Laptop hier von 2 Personen genutzt wird, kann ich nicht sagen, was genau in der letzten Zeit an Programmen o.ä. runtergeladen/installiert und evtl. wieder entfernt wurde.

Eigentlich komme ich gut klar am PC, aber jetzt weis ich nicht mehr weiter. Alleine kriege ich es nicht hin, ich brauche bitte Hilfe.

Bevor ich auf dieses Forum gekommen bin, habe ich das Programm Malwarebytes installiert und Quick-Scan durchlaufen lassen. Das was gefunden wurde habe ich gelöscht, Computer neu gestartet, Probleme blieben aber. Dann habe ich den vollständigen Scan durchlaufen lassen. Und wieder das was gefunden wurde gelöscht, Computer neu gestartet, Probleme blieben immer noch.

Log-Dateien kann ich über Dateien verwalten/Anhänge verwalten nicht hochladen. Ich klicke auf Browse und es tut sich gar nichts.

Jetzt hab ich gestern über einen anderen Rechner OTL runtergeladen und dann auf dem Laptop installiert und -so wie hier im Forum beschrieben- durchlaufen lassen.

Logfils von OTL genau wie oben, bei anklicken von Browse tut sich gar nichts.

Ach ja, hier auf dem Laptop ist AVG Anti-Virus Free Edition 2011, nur zur Info.

Ich hoffe, ich habe bis hier alles richtig gemacht, möchte keine Regeln verletzten, brauche ja dringend Hilfe.

Soll ich die Log-Dateien/Logfils hier im Nachrichten-Feld posten ? Oder gibt es eine einfache Lösung, damit ich sie über Dateien verwalten/Anhänge verwalten hochladen kann ?

Bin langsam echt am verzweifeln

LG

aloa,
kopiere die logs einfach ins nachichtenfeld, aber musst sicher aufteilen auf 2 oder 3 antworten

Hey, danke für die schnelle Antwort. Dann fange ich mal an ...

Hier kommen die von Malwarebytes:

1. Quick Scan
Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Datenbank Version: 5705

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

07.02.2011 20:56:30
mbam-log-2011-02-07 (20-56-30).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 149020
Laufzeit: 10 Minute(n), 16 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 3
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 3

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Handle (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\ (Hijack.Zones) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SSHNAS (Trojan.Renos) -> Quarantined and deleted successfully.

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
c:\WINDOWS\Tasks\{22116563-108c-42c0-a7ce-60161b75e508}.job (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\WINDOWS\Tasks\{62c40aa6-4406-467a-a5a5-dfdf1b559b7a}.job (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\WINDOWS\Tasks\{bbaeaeaf-1275-40e2-bd6c-bc8f88bd114a}.job (Trojan.Downloader) -> Quarantined and deleted successfully.



2. Vollständiger Scan
Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Datenbank Version: 5705

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

07.02.2011 22:22:39
mbam-log-2011-02-07 (22-22-39).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)
Durchsuchte Objekte: 208221
Laufzeit: 43 Minute(n), 55 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 2

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
c:\documents and settings\HP\my documents\BJ\ets 3.0f pro\Ets30f\ets3prosetup.exe (Heuristics.Shuriken) -> Quarantined and deleted successfully.
c:\system volume information\_restore{7fe9284c-e5f3-4759-b78e-afef7d63de8b}\RP364\A0042313.EXE (Trojan.FraudPack.Gen) -> Quarantined and deleted successfully.

So, gleich gehts weiter mit den OTL Dateien ...

Hier weiter mit OTL.txt:OTL Logfile:

OTL logfile created on: 16.02.2011 18:49:07 - Run 1
OTL by OldTimer - Version 3.2.20.6     Folder = C:\Documents and Settings\HP\Desktop
Windows XP Tablet PC Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 40,00% Memory free
3,00 Gb Paging File | 2,00 Gb Available in Paging File | 64,00% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 55,89 Gb Total Space | 20,67 Gb Free Space | 36,98% Space Free | Partition Type: NTFS
Drive Z: | 50,11 Gb Total Space | 47,97 Gb Free Space | 95,74% Space Free | Partition Type: NTFS
 
Computer Name: ****** | User Name: ***** | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Documents and Settings\HP\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\AVG\AVG10\avgtray.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\avgnsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\avgemcx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSMonitor.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe (TeamViewer GmbH)
PRC - C:\Program Files\TeamViewer\Version6\TeamViewer.exe (TeamViewer GmbH)
PRC - C:\Program Files\TeamViewer\Version6\tv_w32.exe (TeamViewer GmbH)
PRC - C:\Program Files\AVG\AVG10\avgrsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\avgchsvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\avgcsrvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Program Files\OpenOffice.org 3\program\soffice.bin (OpenOffice.org)
PRC - C:\Program Files\OpenOffice.org 3\program\soffice.exe (OpenOffice.org)
PRC - C:\Program Files\IPP\ipp.bin ()
PRC - C:\Program Files\IPP\jre\bin\javaw.exe (Sun Microsystems, Inc.)
PRC - C:\WINDOWS\system32\wisptis.exe (Microsoft Corporation)
PRC - C:\Program Files\Outlook Express\msimn.exe (Microsoft Corporation)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Ets\EtsNg.exe (KNX Association)
PRC - C:\Program Files\HP\ToolboxFX\bin\HPTLBXFX.exe (HP)
PRC - C:\Program Files\HP\HP UT\bin\hppusg.exe ()
PRC - C:\WINDOWS\vsnpstd3.exe ()
PRC - C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\pthosttr.exe (Hewlett-Packard Development Company, L.P.)
PRC - C:\Program Files\ProtectTools\Embedded Security Software\PSDrt.exe (Infineon Technologies AG)
PRC - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
PRC - C:\Program Files\WIDCOMM\Bluetooth Software\BTStackServer.exe (Broadcom Corporation.)
PRC - C:\Program Files\Common Files\EIBA sc\Eagle\SybaseRT8\Win32\rteng8.exe (iAnywhere Solutions, Inc.)
PRC - C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe (Analog Devices, Inc.)
PRC - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe (Analog Devices, Inc.)
PRC - C:\WINDOWS\system32\tabbtnu.exe (Microsoft Corporation)
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Documents and Settings\HP\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Program Files\TeamViewer\Version6\tv_w32.dll (TeamViewer GmbH)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\msvcp60.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\crtdll.dll (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (HidServ) --  File not found
SRV - (helpsvc) --  File not found
SRV - (FastUserSwitchingCompatibility) --  File not found
SRV - (AVGIDSAgent) -- C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe (AVG Technologies CZ, s.r.o.)
SRV - (TeamViewer6) -- C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe (TeamViewer GmbH)
SRV - (avgwd) -- C:\Program Files\AVG\AVG10\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (Apple Mobile Device) -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (SoundMAX Agent Service (default)) -- C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe (Analog Devices, Inc.)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (Avgldx86) -- C:\WINDOWS\system32\drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgtdix) -- C:\WINDOWS\system32\drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.)
DRV - (AVGIDSEH) -- C:\WINDOWS\system32\DRIVERS\AVGIDSEH.Sys (AVG Technologies CZ, s.r.o. )
DRV - (Avgmfx86) -- C:\WINDOWS\system32\drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgrkx86) -- C:\WINDOWS\system32\DRIVERS\avgrkx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (AVGIDSFilter) -- C:\WINDOWS\system32\drivers\AVGIDSFilter.sys (AVG Technologies CZ, s.r.o. )
DRV - (AVGIDSDriver) -- C:\WINDOWS\system32\drivers\AVGIDSDriver.sys (AVG Technologies CZ, s.r.o. )
DRV - (AVGIDSShim) -- C:\WINDOWS\system32\drivers\AVGIDSShim.sys (AVG Technologies CZ, s.r.o. )
DRV - (Haspnt) -- C:\WINDOWS\system32\drivers\Haspnt.sys (Aladdin Knowledge Systems)
DRV - (HPFXBULK) -- C:\WINDOWS\system32\drivers\hpfxbulk.sys (Hewlett Packard)
DRV - (HpqKbFiltr) -- C:\WINDOWS\system32\drivers\HpqKbFiltr.sys (Hewlett-Packard Development Company, L.P.)
DRV - (SNPSTD3) USB PC Camera (SNPSTD3) -- C:\WINDOWS\system32\drivers\snpstd3.sys (Sonix Co. Ltd.)
DRV - (w29n51) Intel(R) -- C:\WINDOWS\system32\drivers\w29n51.sys (Intel® Corporation)
DRV - (slabser) -- C:\WINDOWS\system32\drivers\slabser.sys (MCCI Corporation)
DRV - (slabbus) CP210x USB Composite Device driver (WDM) -- C:\WINDOWS\system32\drivers\slabbus.sys (MCCI Corporation)
DRV - (wisdpen) -- C:\WINDOWS\system32\drivers\wisdpen.sys (Wacom Technology)
DRV - (Hardlock) -- C:\WINDOWS\system32\drivers\hardlock.sys (Aladdin Knowledge Systems Ltd.)
DRV - (HBtnKey) -- C:\WINDOWS\system32\drivers\CPQBttn.sys (Hewlett-Packard Development Company, L.P.)
DRV - (eabfiltr) -- C:\WINDOWS\system32\drivers\eabfiltr.sys (Hewlett-Packard Development Company, L.P.)
DRV - (eabusb) -- C:\WINDOWS\system32\drivers\EabUsb.sys (Hewlett-Packard Development Company, L.P.)
DRV - (tifm21) -- C:\WINDOWS\system32\drivers\tifm21.sys (Texas Instruments)
DRV - (GTIPCI21) -- C:\WINDOWS\system32\drivers\gtipci21.sys (Texas Instruments)
DRV - (PersonalSecureDrive) -- C:\WINDOWS\System32\drivers\psd.sys (Infineon Technologies AG)
DRV - (AgereSoftModem) -- C:\WINDOWS\system32\drivers\AGRSM.sys (Agere Systems)
DRV - (IFXTPM) -- C:\WINDOWS\system32\drivers\ifxtpm.sys (Infineon Technologies AG)
DRV - (MarvinBus) -- C:\WINDOWS\system32\drivers\MarvinBus.sys (Pinnacle Systems GmbH)
DRV - (btaudio) -- C:\WINDOWS\system32\drivers\btaudio.sys (Broadcom Corporation.)
DRV - (BTKRNL) -- C:\WINDOWS\system32\drivers\btkrnl.sys (Broadcom Corporation.)
DRV - (BTDriver) -- C:\WINDOWS\system32\drivers\btport.sys (Broadcom Corporation.)
DRV - (BTWUSB) -- C:\WINDOWS\system32\drivers\btwusb.sys (Broadcom Corporation.)
DRV - (BTWDNDIS) -- C:\WINDOWS\system32\drivers\btwdndis.sys (Broadcom Corporation.)
DRV - (b57w2k) -- C:\WINDOWS\system32\drivers\b57xp32.sys (Broadcom Corporation)
DRV - (Vcs) -- C:\WINDOWS\system32\drivers\Vcs.sys ()
DRV - (Pei16Wdm) -- C:\WINDOWS\system32\drivers\Pei16Wdm.sys (EIBA s.c.)
DRV - (Pei10Wdm) -- C:\WINDOWS\system32\drivers\Pei10Wdm.sys (EIBA s.c.)
DRV - (SMCIRDA) -- C:\WINDOWS\system32\drivers\smcirda.sys (SMC)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.payback.de/pb/gsf/true/sst/GUTSCHEINE%252C_COUPONS_UND_AKTIONEN_IM_PAYBACK_BONUSPROGRAMM/s_ixcid/20_001_101/area/PORTAL/st/ebay/id/105532/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "Bing"
FF - prefs.js..browser.search.defaulturl: "hxxp://www.bing.com/search?FORM=VE3D01&q="
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://www.msn.com/"
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..keyword.URL: "hxxp://www.bing.com/search?FORM=VE3D01&q="
 
FF - HKLM\software\mozilla\Firefox\extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files\AVG\AVG10\Firefox\ [2011.01.02 18:34:50 | 000,000,000 | ---D | M]
 
[2010.04.04 18:00:59 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\HP\Application Data\mozilla\Extensions
[2010.10.27 14:10:42 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\HP\Application Data\mozilla\Firefox\Profiles\gct615lo.default\extensions
[2010.05.27 16:04:57 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\HP\Application Data\mozilla\Firefox\Profiles\gct615lo.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010.10.27 21:13:22 | 000,000,000 | ---D | M] (Microsoft Choice Guard) -- C:\Documents and Settings\HP\Application Data\mozilla\Firefox\Profiles\gct615lo.default\extensions\ChoiceGuard@Microsoft
[2010.10.17 16:12:38 | 000,001,820 | ---- | M] () -- C:\Documents and Settings\HP\Application Data\Mozilla\Firefox\Profiles\gct615lo.default\searchplugins\bing.xml
[2010.11.13 12:15:45 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2010.10.20 19:49:18 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2010.03.31 19:01:52 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2010.09.15 03:50:38 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
 
O1 HOSTS File: ([2006.02.28 13:00:00 | 000,000,734 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG10\avgssie.dll (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [AVG_TRAY] C:\Program Files\AVG\AVG10\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [HPPQVideo]  File not found
O4 - HKLM..\Run: [HPUsageTracking] C:\Program Files\HP\HP UT\bin\hppusg.exe ()
O4 - HKLM..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [PTHOSTTR] C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.EXE (Hewlett-Packard Development Company, L.P.)
O4 - HKLM..\Run: [snpstd3] C:\WINDOWS\vsnpstd3.exe ()
O4 - HKLM..\Run: [SoundMAX] C:\Program Files\Analog Devices\SoundMAX\Smax4.exe (Analog Devices, Inc.)
O4 - HKLM..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe (Analog Devices, Inc.)
O4 - HKLM..\Run: [TabletWizard] C:\WINDOWS\Help\splshwrp.exe (Microsoft Corporation)
O4 - HKLM..\Run: [ToolBoxFX] C:\Program Files\HP\ToolBoxFX\bin\HPTLBXFX.exe (HP)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\BTTray.lnk = C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
O4 - Startup: C:\Documents and Settings\HP\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: Senden an &Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O16 - DPF: {14E35D5F-DEBA-4DB3-B2ED-17542BA12D1F} hxxp://192.168.2.13/AVC_AX_DVR.cab (CV781Object Object)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1297762087531 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG10\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\IfxWlxEN: DllName - IfxWlxEN.dll - C:\WINDOWS\System32\IfxWlxEN.dll (Infineon Technologies AG)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\System32\igfxdev.dll (Intel Corporation)
O20 - Winlogon\Notify\TabBtnWL: DllName - TabBtnWL.dll - C:\WINDOWS\System32\tabbtnwl.dll (Microsoft Corporation)
O20 - Winlogon\Notify\tpgwlnotify: DllName - tpgwlnot.dll - C:\WINDOWS\System32\tpgwlnot.dll (Microsoft Corporation)
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.10.15 17:13:26 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{0fbca1ff-b3a1-11df-a45f-00164125c165}\Shell - "" = AutoRun
O33 - MountPoints2\{0fbca1ff-b3a1-11df-a45f-00164125c165}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{0fbca1ff-b3a1-11df-a45f-00164125c165}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Start.hta
O33 - MountPoints2\{ac034703-726a-11df-a431-00164125c165}\Shell\AutoRun\command - "" = D:\Menu.exe
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgchsvx.exe /sync) - C:\Program Files\AVG\AVG10\avgchsvx.exe (AVG Technologies CZ, s.r.o.)
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgrsx.exe /sync /restart) - C:\Program Files\AVG\AVG10\avgrsx.exe (AVG Technologies CZ, s.r.o.)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.02.16 18:47:11 | 000,602,624 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\HP\Desktop\OTL.exe
[2011.02.16 18:31:19 | 000,000,000 | ---D | C] -- C:\IPP Data
[2011.02.16 18:26:35 | 000,000,000 | ---D | C] -- C:\Program Files\IT Tools for ETS3
[2011.02.16 07:29:27 | 000,274,288 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\mucltui.dll
[2011.02.16 07:29:27 | 000,016,736 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\mucltui.dll.mui
[2011.02.15 11:58:40 | 000,000,000 | ---D | C] -- C:\Documents and Settings\HP\My Documents\GlovePIEWithEmotiv043
[2011.02.15 11:58:08 | 000,000,000 | ---D | C] -- C:\Documents and Settings\HP\My Documents\GlovePIE030
[2011.02.15 10:30:06 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft CAPICOM 2.1.0.2
[2011.02.09 18:29:58 | 000,005,504 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mstee.sys
[2011.02.09 18:29:53 | 000,010,880 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ndisip.sys
[2011.02.09 18:29:49 | 000,016,384 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\ipsink.ax
[2011.02.09 18:29:49 | 000,016,384 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ipsink.ax
[2011.02.09 18:29:49 | 000,015,232 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\streamip.sys
[2011.02.09 18:29:46 | 000,011,136 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\slip.sys
[2011.02.09 18:29:42 | 000,019,200 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wstcodec.sys
[2011.02.09 18:29:37 | 000,085,248 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\nabtsfec.sys
[2011.02.09 18:29:34 | 000,017,024 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ccdecode.sys
[2011.02.09 18:29:10 | 000,053,760 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\vfwwdm32.dll
[2011.02.09 18:29:10 | 000,053,760 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\vfwwdm32.dll
[2011.02.09 18:29:09 | 000,091,136 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\kswdmcap.ax
[2011.02.09 18:29:09 | 000,091,136 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kswdmcap.ax
[2011.02.09 18:29:09 | 000,043,008 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\ksxbar.ax
[2011.02.09 18:29:09 | 000,043,008 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ksxbar.ax
[2011.02.09 18:29:08 | 000,061,952 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\kstvtune.ax
[2011.02.09 18:29:08 | 000,061,952 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kstvtune.ax
[2011.02.07 20:42:57 | 000,000,000 | ---D | C] -- C:\Documents and Settings\HP\Application Data\Malwarebytes
[2011.02.07 20:42:44 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2011.02.07 20:42:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011.02.07 20:42:43 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2011.02.07 20:42:40 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2011.02.07 20:42:40 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2011.02.06 16:14:30 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Adobe
[2011.02.06 16:04:44 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\WindowsPowerShell
[2011.02.06 16:04:36 | 000,000,000 | ---D | C] -- C:\WINDOWS\$968930Uinstall_KB968930$
[2011.02.06 16:03:39 | 000,000,000 | ---D | C] -- C:\Program Files\Windows Desktop Search
[2011.02.06 16:03:38 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\GroupPolicy
[2011.02.02 20:33:27 | 000,000,000 | ---D | C] -- C:\Documents and Settings\HP\My Documents\Bluetooth-Exchange-Ordner
[2011.02.02 20:33:27 | 000,000,000 | ---D | C] -- C:\Documents and Settings\HP\Bluetooth Software
[2011.02.02 20:31:01 | 000,000,000 | ---D | C] -- C:\Program Files\WIDCOMM
[2011.01.31 20:37:12 | 000,000,000 | ---D | C] -- C:\Documents and Settings\HP\Application Data\JFritz
[2011.01.22 22:47:27 | 001,626,614 | ---- | C] (Siemens) -- C:\Documents and Settings\HP\My Documents\Sylcom 1.80c rel 8 Patch.exe
[2011.01.22 22:47:25 | 000,935,151 | ---- | C] (Siemens Switzerland Ltd, Siemens Building Technologies) -- C:\Documents and Settings\HP\My Documents\Sylcom 1.80c rel 8c Patch.exe
[2011.01.22 18:58:49 | 000,000,000 | ---D | C] -- C:\Documents and Settings\HP\My Documents\document_2514
[2011.01.21 15:44:37 | 000,439,296 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\shimgvw.dll
[2011.01.19 19:51:04 | 000,000,000 | ---D | C] -- C:\Documents and Settings\HP\My Documents\BJE_V20
[2011.01.18 18:36:21 | 000,000,000 | ---D | C] -- C:\Documents and Settings\HP\AppData
[2011.01.18 18:34:36 | 000,000,000 | ---D | C] -- C:\Documents and Settings\HP\My Documents\iPhone Ringtones
[2011.01.18 18:33:20 | 000,000,000 | ---D | C] -- C:\Documents and Settings\HP\Local Settings\Application Data\iRinger
[2011.01.18 18:32:18 | 003,439,104 | ---- | C] (Mouse Industries) -- C:\Documents and Settings\HP\My Documents\iRinger.exe
[2007.03.12 11:41:52 | 000,061,440 | ---- | C] ( ) -- C:\WINDOWS\System32\vsnpstd3.dll
[2005.11.23 12:55:32 | 000,053,248 | ---- | C] ( ) -- C:\WINDOWS\System32\csnpstd3.dll
[5 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2011.02.16 18:47:13 | 000,602,624 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\HP\Desktop\OTL.exe
[2011.02.16 18:29:44 | 000,007,543 | ---- | M] () -- C:\WINDOWS\ODBC.INI
[2011.02.16 18:05:32 | 106,241,920 | ---- | M] () -- C:\WINDOWS\System32\drivers\AVG\incavi.avm
[2011.02.16 15:27:23 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011.02.15 11:12:34 | 000,229,235 | ---- | M] () -- C:\Documents and Settings\HP\My Documents\IMG_4296.JPG
[2011.02.15 11:08:16 | 000,204,314 | ---- | M] () -- C:\Documents and Settings\HP\My Documents\IMG_4295.JPG
[2011.02.15 10:29:21 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011.02.15 08:59:00 | 000,000,256 | ---- | M] () -- C:\WINDOWS\tasks\WebReg .job
[2011.02.12 23:39:40 | 000,000,279 | ---- | M] () -- C:\WINDOWS\{D9C15833-DBC0-418C-B27E-921E2534F834}_WiseFW.ini
[2011.02.12 21:14:14 | 000,000,662 | ---- | M] () -- C:\Documents and Settings\HP\My Documents\2.xml
[2011.02.12 20:22:03 | 000,000,662 | ---- | M] () -- C:\Documents and Settings\HP\My Documents\33.xml
[2011.02.12 18:21:41 | 000,000,662 | ---- | M] () -- C:\Documents and Settings\HP\My Documents\13.xml
[2011.02.12 17:16:40 | 000,000,662 | ---- | M] () -- C:\Documents and Settings\HP\My Documents\1.xml
[2011.02.12 16:41:18 | 000,226,616 | ---- | M] () -- C:\Documents and Settings\HP\My Documents\Neues Projekt.pr5
[2011.02.12 16:37:43 | 000,006,678 | ---- | M] () -- C:\Documents and Settings\HP\My Documents\li unten.xml
[2011.02.12 16:37:17 | 000,000,600 | ---- | M] () -- C:\Documents and Settings\HP\My Documents\re.xml
[2011.02.12 13:56:46 | 000,003,814 | ---- | M] () -- C:\Documents and Settings\HP\My Documents\5-fach taster.xml
[2011.02.12 13:08:54 | 000,013,062 | ---- | M] () -- C:\Documents and Settings\HP\My Documents\test2.xml
[2011.02.11 08:20:51 | 000,243,920 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2011.02.11 08:03:49 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2011.02.10 08:27:01 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2011.02.06 20:47:24 | 000,078,336 | ---- | M] () -- C:\Documents and Settings\HP\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.02.06 16:21:07 | 000,441,458 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2011.02.06 16:21:07 | 000,071,394 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2011.02.05 23:33:22 | 000,000,159 | ---- | M] () -- C:\Documents and Settings\HP\My Documents\adrsen zum panel.csv
[2011.02.02 22:13:50 | 002,399,902 | ---- | M] () -- C:\Documents and Settings\HP\My Documents\GlovePIE030.zip
[2011.02.02 20:31:14 | 000,000,701 | ---- | M] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\BTTray.lnk
[2011.02.02 20:17:56 | 000,000,027 | ---- | M] () -- C:\WINDOWS\BRPP2KA.INI
[2011.02.02 20:17:55 | 000,000,479 | ---- | M] () -- C:\WINDOWS\BRWMARK.INI
[2011.02.02 19:57:30 | 004,698,995 | ---- | M] () -- C:\Documents and Settings\HP\My Documents\GlovePIEWithEmotiv043.zip
[2011.01.31 20:37:12 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\HP\Application Data\JFritz.lock
[2011.01.31 13:01:27 | 000,013,030 | ---- | M] () -- C:\PDOXUSRS.NET
[2011.01.22 18:58:05 | 000,926,723 | ---- | M] () -- C:\Documents and Settings\HP\My Documents\document_2514.zip
[2011.01.21 15:44:37 | 008,462,336 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\shell32.dll
[2011.01.21 15:44:37 | 000,439,296 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\shimgvw.dll
[2011.01.19 19:50:43 | 000,523,376 | ---- | M] () -- C:\Documents and Settings\HP\My Documents\BJE_V20.zip
[2011.01.18 18:32:18 | 003,439,104 | ---- | M] (Mouse Industries) -- C:\Documents and Settings\HP\My Documents\iRinger.exe
[5 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2011.02.15 11:58:44 | 004,698,995 | ---- | C] () -- C:\Documents and Settings\HP\My Documents\GlovePIEWithEmotiv043.zip
[2011.02.15 11:58:44 | 000,226,616 | ---- | C] () -- C:\Documents and Settings\HP\My Documents\Neues Projekt.pr5
[2011.02.15 11:58:44 | 000,013,062 | ---- | C] () -- C:\Documents and Settings\HP\My Documents\test2.xml
[2011.02.15 11:58:44 | 000,003,814 | ---- | C] () -- C:\Documents and Settings\HP\My Documents\5-fach taster.xml
[2011.02.15 11:58:44 | 000,000,662 | ---- | C] () -- C:\Documents and Settings\HP\My Documents\13.xml
[2011.02.15 11:58:44 | 000,000,662 | ---- | C] () -- C:\Documents and Settings\HP\My Documents\1.xml
[2011.02.15 11:58:43 | 002,399,902 | ---- | C] () -- C:\Documents and Settings\HP\My Documents\GlovePIE030.zip
[2011.02.15 11:58:43 | 000,000,159 | ---- | C] () -- C:\Documents and Settings\HP\My Documents\adrsen zum panel.csv
[2011.02.15 11:58:07 | 000,229,235 | ---- | C] () -- C:\Documents and Settings\HP\My Documents\IMG_4296.JPG
[2011.02.15 11:58:07 | 000,204,314 | ---- | C] () -- C:\Documents and Settings\HP\My Documents\IMG_4295.JPG
[2011.02.15 11:58:06 | 000,006,678 | ---- | C] () -- C:\Documents and Settings\HP\My Documents\li unten.xml
[2011.02.15 11:58:06 | 000,000,662 | ---- | C] () -- C:\Documents and Settings\HP\My Documents\33.xml
[2011.02.15 11:58:06 | 000,000,662 | ---- | C] () -- C:\Documents and Settings\HP\My Documents\2.xml
[2011.02.15 11:58:06 | 000,000,600 | ---- | C] () -- C:\Documents and Settings\HP\My Documents\re.xml
[2011.02.12 23:39:21 | 000,000,279 | ---- | C] () -- C:\WINDOWS\{D9C15833-DBC0-418C-B27E-921E2534F834}_WiseFW.ini
[2011.02.08 08:59:08 | 000,000,256 | ---- | C] () -- C:\WINDOWS\tasks\WebReg .job
[2011.02.02 20:31:14 | 000,000,701 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\BTTray.lnk
[2011.01.31 20:37:12 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\HP\Application Data\JFritz.lock
[2011.01.22 18:57:59 | 000,926,723 | ---- | C] () -- C:\Documents and Settings\HP\My Documents\document_2514.zip
[2011.01.19 19:50:43 | 000,523,376 | ---- | C] () -- C:\Documents and Settings\HP\My Documents\BJE_V20.zip
[2011.01.13 09:56:16 | 000,006,852 | ---- | C] () -- C:\WINDOWS\System32\drivers\Vcs.sys
[2010.12.20 12:38:13 | 019,985,265 | ---- | C] () -- C:\Program Files\vlc-1.1.5-win32.exe
[2010.12.10 20:18:50 | 000,000,354 | ---- | C] () -- C:\WINDOWS\hpbvspst.ini
[2010.12.10 19:08:17 | 000,000,132 | ---- | C] () -- C:\WINDOWS\System32\AddPort.ini
[2010.12.10 19:04:55 | 000,000,817 | ---- | C] () -- C:\WINDOWS\hpntwksetup.ini
[2010.12.10 18:59:35 | 000,002,075 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\hpzinstall.log
[2010.11.24 10:53:19 | 000,026,624 | ---- | C] () -- C:\WINDOWS\System32\wifemand.dll
[2010.11.12 20:04:33 | 000,000,347 | ---- | C] () -- C:\WINDOWS\_1bluHomepageBuilder.INI
[2010.06.11 20:57:33 | 000,007,543 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2010.06.11 20:54:29 | 000,000,383 | ---- | C] () -- C:\WINDOWS\System32\haspdos.sys
[2010.04.24 09:28:57 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\HP\Local Settings\Application Data\FnF4.txt
[2010.04.15 20:37:22 | 000,003,654 | ---- | C] () -- C:\WINDOWS\System32\drivers\Sonyhcp.dll
[2010.02.15 15:12:26 | 000,078,336 | ---- | C] () -- C:\Documents and Settings\HP\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.01.23 22:02:27 | 000,102,912 | ---- | C] () -- C:\WINDOWS\System32\swscale-0.7.2.dll
[2010.01.23 22:02:27 | 000,049,152 | ---- | C] () -- C:\WINDOWS\System32\avutil-50.7.0.dll
[2010.01.23 22:02:26 | 000,877,056 | ---- | C] () -- C:\WINDOWS\System32\avcodec-52.45.0.dll
[2010.01.23 22:02:26 | 000,176,128 | ---- | C] () -- C:\WINDOWS\System32\AVC_AP_H264.dll
[2010.01.23 22:02:26 | 000,077,312 | ---- | C] () -- C:\WINDOWS\System32\avformat-52.46.0.dll
[2010.01.23 22:02:26 | 000,015,360 | ---- | C] () -- C:\WINDOWS\System32\AVC_AP_JPEG.dll
[2010.01.23 22:02:26 | 000,005,632 | ---- | C] () -- C:\WINDOWS\System32\AVC_AP_SCALE.dll
[2010.01.23 22:02:26 | 000,004,608 | ---- | C] () -- C:\WINDOWS\System32\avdevice-52.2.0.dll
[2010.01.23 22:02:23 | 000,877,568 | ---- | C] () -- C:\WINDOWS\System32\avcodec-52.dll
[2010.01.23 22:02:23 | 000,323,584 | ---- | C] () -- C:\WINDOWS\System32\Deinterlace.dll
[2010.01.23 22:02:23 | 000,120,320 | ---- | C] () -- C:\WINDOWS\System32\swscale-0.dll
[2010.01.23 22:02:23 | 000,075,776 | ---- | C] () -- C:\WINDOWS\System32\avformat-52.dll
[2010.01.23 22:02:23 | 000,046,592 | ---- | C] () -- C:\WINDOWS\System32\avutil-50.dll
[2010.01.23 22:02:23 | 000,004,608 | ---- | C] () -- C:\WINDOWS\System32\avdevice-52.dll
[2010.01.23 22:02:17 | 000,176,128 | ---- | C] () -- C:\WINDOWS\System32\AVC_H264.dll
[2010.01.23 22:02:17 | 000,015,360 | ---- | C] () -- C:\WINDOWS\System32\AVC_JPEG.dll
[2010.01.01 02:49:01 | 000,000,479 | ---- | C] () -- C:\WINDOWS\BRWMARK.INI
[2010.01.01 02:49:01 | 000,000,027 | ---- | C] () -- C:\WINDOWS\BRPP2KA.INI
[2009.10.15 17:44:37 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\HP\Local Settings\Application Data\QSwitch.txt
[2009.10.15 17:44:37 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\HP\Local Settings\Application Data\DSwitch.txt
[2009.10.15 17:44:37 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\HP\Local Settings\Application Data\AtStart.txt
[2009.10.15 17:35:21 | 000,172,032 | ---- | C] () -- C:\WINDOWS\System32\tifmicon.dll
[2009.10.15 17:21:16 | 000,000,125 | ---- | C] () -- C:\Documents and Settings\HP\Local Settings\Application Data\fusioncache.dat
[2009.10.15 10:01:17 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2008.04.02 17:05:04 | 000,163,840 | ---- | C] () -- C:\WINDOWS\System32\AVC718Viewer.dll
[2005.12.21 16:57:36 | 000,139,264 | ---- | C] () -- C:\WINDOWS\System32\nsldap32v50.dll
[2005.12.21 16:57:04 | 000,024,576 | ---- | C] () -- C:\WINDOWS\System32\nsldappr32v50.dll
[2005.12.21 16:54:34 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\nsldapssl32v50.dll
[2005.08.16 11:45:36 | 000,090,112 | ---- | C] () -- C:\WINDOWS\System32\btprn2k.dll
[2004.02.27 16:36:18 | 000,015,498 | ---- | C] () -- C:\WINDOWS\snpstd3.ini
[2001.11.14 13:56:00 | 001,802,240 | ---- | C] () -- C:\WINDOWS\System32\lcppn21.dll
[2001.07.07 04:00:00 | 000,003,254 | ---- | C] () -- C:\WINDOWS\System32\HPTCPMON.INI
 
========== LOP Check ==========
 
[2011.01.24 13:04:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AVG10
[2011.01.02 18:36:27 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\Common Files
[2009.12.05 19:11:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\DriverCure
[2010.06.11 20:54:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Elka Shared
[2009.10.15 17:36:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Infineon
[2009.10.15 08:55:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Macrium
[2011.01.02 18:34:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MFAData
[2009.12.05 19:07:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ParetoLogic
[2010.04.16 13:31:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Pinnacle
[2011.02.06 15:44:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP
[2010.12.15 20:58:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TuneUp Software
[2010.12.15 20:48:25 | 000,000,000 | -HSD | M] -- C:\Documents and Settings\All Users\Application Data\{24036256-BFDB-4CD3-BE8A-A3D6160F2E16}
[2010.12.17 22:21:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
 
========== Purity Check ==========
 
 
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 88 bytes -> C:\Show Desktop.scf:SummaryInformation
@Alternate Data Stream - 124 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:0B4227B4

< End of report >
         

--- --- ---

Und der Letzte, Extras.txt:OTL EXTRAS Logfile:

OTL Extras logfile created on: 16.02.2011 18:49:07 - Run 1
OTL by OldTimer - Version 3.2.20.6     Folder = C:\Documents and Settings\HP\Desktop
Windows XP Tablet PC Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 40,00% Memory free
3,00 Gb Paging File | 2,00 Gb Available in Paging File | 64,00% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 55,89 Gb Total Space | 20,67 Gb Free Space | 36,98% Space Free | Partition Type: NTFS
Drive Z: | 50,11 Gb Total Space | 47,97 Gb Free Space | 95,74% Space Free | Partition Type: NTFS
 
Computer Name: ***** | User Name: ***** | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = htmlfile] -- Reg Error: Key error. File not found
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"10243:TCP" = 10243:TCP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10280:UDP" = 10280:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10281:UDP" = 10281:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10282:UDP" = 10282:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10283:UDP" = 10283:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10284:UDP" = 10284:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"10243:TCP" = 10243:TCP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10280:UDP" = 10280:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10281:UDP" = 10281:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10282:UDP" = 10282:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10283:UDP" = 10283:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10284:UDP" = 10284:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\contronics\homeputer CL Studio\VisuWin.exe" = C:\Program Files\contronics\homeputer CL Studio\VisuWin.exe:*:Enabled:VisuWin -- ()
"C:\Program Files\VideoViewer\VideoViewer.exe" = C:\Program Files\VideoViewer\VideoViewer.exe:*:Enabled:VideoViewer -- ()
"C:\Program Files\IPP\ipp.bin" = C:\Program Files\IPP\ipp.bin:*:Enabled:ipp -- ()
"C:\Program Files\IPP\jre\bin\javaw.exe" = C:\Program Files\IPP\jre\bin\javaw.exe:*:Enabled:Java(TM) Platform SE binary -- (Sun Microsystems, Inc.)
"C:\Program Files\GPS Tracker\GPSTracker.exe" = C:\Program Files\GPS Tracker\GPSTracker.exe:*:Enabled:GPSTracker -- (LFTrinity)
"C:\Program Files\Java\jre6\bin\javaw.exe" = C:\Program Files\Java\jre6\bin\javaw.exe:*:Enabled:Java(TM) Platform SE binary -- (Sun Microsystems, Inc.)
"C:\Program Files\iTunes\iTunes.exe" = C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes -- (Apple Inc.)
"C:\Program Files\VideoLAN\VLC\vlc.exe" = C:\Program Files\VideoLAN\VLC\vlc.exe:*:Enabled:VLC media player -- ()
"C:\Program Files\TeamViewer\Version6\TeamViewer.exe" = C:\Program Files\TeamViewer\Version6\TeamViewer.exe:*:Enabled:Teamviewer Remote Control Application -- (TeamViewer GmbH)
"C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe" = C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe:*:Enabled:Teamviewer Remote Control Service -- (TeamViewer GmbH)
"C:\Program Files\AVG\AVG10\avgmfapx.exe" = C:\Program Files\AVG\AVG10\avgmfapx.exe:*:Enabled:AVG-Installationsprogramm -- (AVG Technologies CZ, s.r.o.)
"C:\Program Files\1blu\1blu HomepageBuilder 2\_1bluHomepageBuilder.exe" = C:\Program Files\1blu\1blu HomepageBuilder 2\_1bluHomepageBuilder.exe:*:Enabled:GS HomepageBuilder 2 {1blu Edition} -- (GS Software AG)
"C:\Program Files\Wi-Fi Sync\wifisync.exe" = C:\Program Files\Wi-Fi Sync\wifisync.exe:*:Enabled:Wi-Fi Sync
"C:\Program Files\AVG\AVG10\avgdiagex.exe" = C:\Program Files\AVG\AVG10\avgdiagex.exe:*:Enabled:AVG Diagnose 2011 -- (AVG Technologies CZ, s.r.o.)
"C:\Program Files\AVG\AVG10\avgnsx.exe" = C:\Program Files\AVG\AVG10\avgnsx.exe:*:Enabled:Online Shield -- (AVG Technologies CZ, s.r.o.)
"C:\Program Files\AVG\AVG10\avgemcx.exe" = C:\Program Files\AVG\AVG10\avgemcx.exe:*:Enabled:Personal eMail-Scanner -- (AVG Technologies CZ, s.r.o.)
"C:\Program Files\JFritz\jfritz.exe" = C:\Program Files\JFritz\jfritz.exe:*:Enabled:jfritz
"C:\Program Files\EIB-Programme\Power-Tool\ToolBApp.exe" = C:\Program Files\EIB-Programme\Power-Tool\ToolBApp.exe:*:Enabled:ToolBApp.exe
"C:\Program Files\Ets\Power-Tool\ToolBApp.exe" = C:\Program Files\Ets\Power-Tool\ToolBApp.exe:*:Enabled:ToolBApp.exe -- (Busch-Jaeger Elektro GmbH)
"C:\Program Files\Ets\Power-Tool\Power-Tool\ToolBApp.exe" = C:\Program Files\Ets\Power-Tool\Power-Tool\ToolBApp.exe:*:Enabled:ToolBApp.exe
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{10E1E87C-656C-4D08-86D6-5443D28583BE}" = TrayApp
"{13F00518-807A-4B3A-83B0-A7CD90F3A398}" = MarketResearch
"{1545207E-C6F3-31D7-9918-BDBB65075FBF}" = Microsoft .NET Framework 3.5 Language Pack - deu
"{192A107E-C6B9-41B9-BDBF-38E3AA226054}" = OpenOffice.org 3.2
"{1BFA7D9F-947D-474B-92F7-F6E474DBD1AE}" = 1blu HomepageBuilder 2
"{1C5D5D15-CABD-4C5A-A80E-B5C4CA6FE90A}" = hppTLBXFXCP1510
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F73D672-6175-4A1D-B3C1-420439D03D0F}" = Product_SF_Full_QFolder
"{223C0721-A6B0-4853-88C0-331029841734}" = HP Color LaserJet CP1510 Series 2.0
"{26A24AE4-039D-4CA4-87B4-2F83216018FF}" = Java(TM) 6 Update 22
"{28B38A2B-05F0-45C9-BB93-3A419492D43C}" = Raum- / Controlpanel Software V1.3
"{29FA38B4-0AE4-4D0D-8A51-6165BB990BB0}" = WebReg
"{308B6AEA-DE50-4666-996D-0FA461719D6B}" = Apple Mobile Device Support
"{34D2AB40-150D-475D-AE32-BD23FB5EE355}" = HP Quick Launch Buttons 6.30 J1
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{35695AD9-F477-478E-948F-1BAD4C986F21}" = IP-Project Macros für ETS
"{3F4EC965-28EF-45C3-B063-04B25D4E9679}" = HP Integrated Module with Bluetooth wireless technology
"{414C803A-6115-4DB6-BD4E-FD81EA6BC71C}" = Product_SF_Min_QFolder
"{487B0B9B-DCD4-440D-89A0-A6EDE1A545A3}" = HPSSupply
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4BA3DDD4-BC91-48B2-8896-7A02C34829D7}" = HP Embedded Security for ProtectTools
"{4F12C31A-0B6E-4D60-ACB9-6ACE9214951B}" = Microsoft .NET Framework 2.0 Language Pack - CHS
"{572880F8-A845-48E1-97B8-3800E9155B18}" = ETS3 Professional
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{5C29CB8B-AC1E-4114-8D68-9CD080140D4A}" = Sony USB Driver
"{5E894531-91FB-4B76-AA0F-49E0E1F357D6}" = hppPQVideoCP1510
"{64FD4D83-085A-49D0-905A-F06057B73DA3}" = hppCLJCP1510
"{66E6CE0C-5A1E-430C-B40A-0C90FF1804A8}" = eSupportQFolder
"{6F5E2F4A-377D-4700-B0E3-8F7F7507EA15}" = CustomerResearchQFolder
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7ADCEEA0-AC82-4360-AD6B-CCF01B66F9DB}" = hppusgCP1510
"{881F5DE8-9367-4B81-A325-E91BBC6472F9}" = iTunes
"{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel(R) Graphics Media Accelerator Driver for Mobile
"{8C6027FD-53DC-446D-BB75-CACD7028A134}" = HP Update
"{914E1AB1-DCA0-4A7D-935F-B58C4B887A2B}" = HP ProtectTools Security Manager 2.00 D3
"{9309DD7E-EBFE-3C95-8B47-30D3A012F606}" = Microsoft .NET Framework 2.0 Service Pack 1 Language Pack - DEU
"{93F54611-2701-454e-94AB-623F458D9E6B}" = DeviceDiscovery
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9DE3F260-B88E-42CE-90E7-73C78C37D95E}" = 32 Bit HP BiDi Channel Components Installer
"{A1071AEB-B0EF-3F5F-BC84-83A270EBE496}" = Microsoft .NET Framework 3.0 Service Pack 1 Language Pack - DEU
"{A276502A-8979-44FB-8090-90CF72F22ABC}" = AVG 2011
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder
"{AC76BA86-7AD7-1031-7B44-A94000000001}" = Adobe Reader 9.4.2 - Deutsch
"{AD7914E1-6453-4440-AEC7-02C72AD6FE5F}" = TIPCI
"{AEA07F97-9088-497c-8821-0F36BD5DC251}" = HPProductAssistant
"{B932A416-28A7-4D08-89A6-7A0464DAD37D}" = hpzTLBXFX
"{BCD6CD1A-0DBE-412E-9F25-3B500D1E6BA1}" = SolutionCenter
"{BE6890C7-31EF-478C-812E-1E2899ABFCA9}" = Broadcom NetXtreme Ethernet Controller
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update
"{CAE7D1D9-3794-4169-B4DD-964ADBC534EE}" = HP Product Detection
"{CD455813-B6DF-4E81-807B-B671C3A1B417}" = Silicon Laboratories CP210x VCP Drivers for Windows 2000/XP/2003 Server/Vista
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{D8AC1EB5-E8B0-44A0-B113-899407188A2F}" = hppFonts
"{D9C15833-DBC0-418C-B27E-921E2534F834}" = Power-Tool
"{E2662C24-B31E-4349-A084-32EB76E8B760}" = BufferChm
"{E887A789-E407-4387-8EFF-55D38E5AB8A8}" = GPS Tracker
"{ED5BDA06-0D68-4B4C-93FE-50BE94ADA6E9}" = hppManualsCP1510
"{EE6097DD-05F4-4178-9719-D3170BF098E8}" = Apple Application Support
"{F0A37341-D692-11D4-A984-009027EC0A9C}" = SoundMAX
"{F4C68898-EBA5-46A9-82B3-2D30426086BF}" = AVG 2011
"{F8855743-AA68-4A92-84EE-4F8B668CF61A}" = Silicon Laboratories CP210x VCP Drivers for Windows 2000/XP/2003 Server/Vista_2 (c:\SiLabs\MCU_2)
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Agere Systems Soft Modem" = Agere Systems AC'97 Modem
"AVG" = AVG 2011
"ETS3 Professional" = ETS3 Professional
"homeputer CL Studio_is1" = homeputer CL Studio Version 3.0
"HP Imaging Device Functions" = HP Imaging Device Functions 9.0
"HP Solution Center & Imaging Support Tools" = HP Solution Center 9.0
"HPExtendedCapabilities" = HP Customer Participation Program 9.0
"InstallShield_{AD7914E1-6453-4440-AEC7-02C72AD6FE5F}" = Texas Instruments PCIxx21/x515/xx12 drivers.
"InstallShield_{BE6890C7-31EF-478C-812E-1E2899ABFCA9}" = Broadcom NetXtreme Ethernet Controller
"IP-Project" = IP-Project
"LOGO!Soft Comfort V6.1" = LOGO!Soft Comfort V6.1
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 2.0 Language Pack - CHS" = Microsoft .NET Framework 2.0 语言包 - 简体中文
"Microsoft .NET Framework 3.5 Language Pack - deu" = Microsoft .NET Framework 3.5 Language Pack - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"SLABCOMM&10C4&EA60" = Silicon Laboratories CP210x USB to UART Bridge (Driver Removal)
"TeamViewer 6" = TeamViewer 6
"Video Viewer" = Video Viewer
"VLC media player" = VLC media player 1.1.5
"WacomPenabled" = Wacom Pen Driver 2.7
"Wdf01005" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinGimp-2.0_is1" = GIMP 2.6.11
"WinRAR archiver" = WinRAR
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"XpsEPSC" = XML Paper Specification Shared Components Pack 1.0
"XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 12.02.2011 14:41:22 | Computer Name = ***** | Source = MsiInstaller | ID = 11706
Description = Produkt: ETS3 Professional -- Fehler 1706. Keine gültige Quelle für
 folgendes Produkt gefunden: ETS3 Professional. Fortsetzung von Windows Installer
 nicht möglich.
 
Error - 12.02.2011 14:47:00 | Computer Name = ***** | Source = MsiInstaller | ID = 11706
Description = Produkt: ETS3 Professional -- Fehler 1706. Keine gültige Quelle für
 folgendes Produkt gefunden: ETS3 Professional. Fortsetzung von Windows Installer
 nicht möglich.
 
Error - 12.02.2011 14:58:25 | Computer Name = ***** | Source = MsiInstaller | ID = 11706
Description = Produkt: ETS3 Professional -- Fehler 1706. Keine gültige Quelle für
 folgendes Produkt gefunden: ETS3 Professional. Fortsetzung von Windows Installer
 nicht möglich.

Error - 12.02.2011 15:02:04 | Computer Name = ***** | Source = MsiInstaller | ID = 11500
Description = Produkt: ETS3 Professional -- Fehler 1500. Eine andere Installation
 wird durchgeführt. Schließen Sie erst die andere Installation ab, bevor Sie mit
 dieser Installation fortfahren.
 
Error - 12.02.2011 15:02:55 | Computer Name = ***** | Source = MsiInstaller | ID = 11706
Description = Produkt: ETS3 Professional -- Fehler 1706. Keine gültige Quelle für
 folgendes Produkt gefunden: ETS3 Professional. Fortsetzung von Windows Installer
 nicht möglich.
 
Error - 12.02.2011 15:07:25 | Computer Name = ***** | Source = MsiInstaller | ID = 11706
Description = Produkt: ETS3 Professional -- Fehler 1706. Keine gültige Quelle für
 folgendes Produkt gefunden: ETS3 Professional. Fortsetzung von Windows Installer
 nicht möglich.
 
Error - 12.02.2011 16:07:12 | Computer Name = ***** | Source = MsiInstaller | ID = 10005
Description = Product: ABB Logic Time 254 EA -- Microsoft (R) .NET Framework V1.1
 or higher is required!   Please do the following  steps:   1. Install the .NET Framework.
 It  can be downloaded for free from www.abb.de/eib -> Download ->  Software   2. 
Execute the following file,  e.g. by a double click in the Explorer:   <C:\Program
 Files\Common Files>\EIBA  sc\Baggage\2\LogicTimePlugIn\ABBLogicTimePlugin.msi
 
Error - 12.02.2011 18:51:33 | Computer Name = ***** | Source = MsiInstaller | ID = 1013
Description = Produkt: Microsoft .NET Framework 2.0 -- Setup cannot continue because
 this version of the .NET Framework is incompatible with a previously installed 
one.  For more information, see hxxp://support.microsoft.com/support/kb/articles/q312/5/00.asp
 
Error - 14.02.2011 08:02:00 | Computer Name = ***** | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung msimn.exe, Version 6.0.2900.5512, Stillstandmodul
 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
 
Error - 14.02.2011 08:02:00 | Computer Name = ***** | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung msimn.exe, Version 6.0.2900.5512, Stillstandmodul
 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
 
[ System Events ]
Error - 16.02.2011 10:24:25 | Computer Name = ***** | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Remote Access Connection Manager" wurde mit folgendem 
Fehler beendet:   %%5
 
Error - 16.02.2011 10:24:33 | Computer Name = ***** | Source = Rasman | ID = 20035
Description = Die RAS-Verbindungsverwaltung konnte nicht gestartet werden, da keine
 Puffer erstellt werden konnten.  Starten Sie den Computer neu. Zugriff verweigert

 
Error - 16.02.2011 10:24:34 | Computer Name = ***** | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Remote Access Connection Manager" wurde mit folgendem 
Fehler beendet:   %%5
 
Error - 16.02.2011 10:24:55 | Computer Name = ***** | Source = Rasman | ID = 20035
Description = Die RAS-Verbindungsverwaltung konnte nicht gestartet werden, da keine
 Puffer erstellt werden konnten.  Starten Sie den Computer neu. Zugriff verweigert

 
Error - 16.02.2011 10:24:56 | Computer Name = ***** | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Remote Access Connection Manager" wurde mit folgendem 
Fehler beendet:   %%5
 
Error - 16.02.2011 10:25:04 | Computer Name = ***** | Source = Rasman | ID = 20035
Description = Die RAS-Verbindungsverwaltung konnte nicht gestartet werden, da keine
 Puffer erstellt werden konnten.  Starten Sie den Computer neu. Zugriff verweigert

 
Error - 16.02.2011 10:25:05 | Computer Name = ***** | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Remote Access Connection Manager" wurde mit folgendem 
Fehler beendet:   %%5
 
Error - 16.02.2011 10:25:21 | Computer Name = ***** | Source = Rasman | ID = 20035
Description = Die RAS-Verbindungsverwaltung konnte nicht gestartet werden, da keine
 Puffer erstellt werden konnten.  Starten Sie den Computer neu. Zugriff verweigert

 
Error - 16.02.2011 10:25:22 | Computer Name = ***** | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Remote Access Connection Manager" wurde mit folgendem 
Fehler beendet:   %%5
 
Error - 16.02.2011 10:27:53 | Computer Name = ***** | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Help and Support" wurde mit folgendem Fehler beendet: 
  %%126
 
 
< End of report >
         

--- --- ---




Also, bei diesen Berichten verstehe ich nur Bahnhof.
Hoffe aber, dass meinem Laptop zu helfen ist.
Diese ganzen Fehlfunktionen nerven nämlich.
Warte nun auf weitere Anweisungen, danke schonmal.

• Starte bitte die OTL.exe
• Kopiere nun das Folgende in die Textbox.

:OTL
SRV - (HidServ) -- File not found
SRV - (helpsvc) -- File not found
SRV - (FastUserSwitchingCompatibility) -- File not found
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [HPPQVideo] File not found

:Files
:Commands
[purity]
[EMPTYFLASH]
[emptytemp]
[Reboot]

• Schliesse bitte nun alle Programme.
• Klicke nun bitte auf den Fix Button.
• OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
• Nach dem Neustart findest Du ein Textdokument, dessen inhalt in deiner nächsten antwort hier reinkopieren.

Hab ich gemacht, hier das Textdokument:

All processes killed
========== OTL ==========
Service HidServ stopped successfully!
Service HidServ deleted successfully!
File File not found not found.
Service helpsvc stopped successfully!
Service helpsvc deleted successfully!
File File not found not found.
Service FastUserSwitchingCompatibility stopped successfully!
Service FastUserSwitchingCompatibility deleted successfully!
File File not found not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run not found.
========== FILES ==========
========== COMMANDS ==========

[EMPTYFLASH]

User: All Users

User: Default User

User: HP
->Flash cache emptied: 9887 bytes

User: LocalService

User: NetworkService

Total Flash Files Cleaned = 0,00 mb


[EMPTYTEMP]

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: HP
->Temp folder emptied: 69079153 bytes
->Temporary Internet Files folder emptied: 338589158 bytes
->Java cache emptied: 124047 bytes
->FireFox cache emptied: 39881726 bytes
->Flash cache emptied: 0 bytes

User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 1117304 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 2176856 bytes
%systemroot%\System32 .tmp files removed: 4101649 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 1517911 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 100538422 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 2725138038 bytes

Total Files Cleaned = 3.130,00 mb


OTL by OldTimer - Version 3.2.20.6 log created on 02172011_125556

Files\Folders moved on Reboot...
C:\Documents and Settings\HP\Local Settings\Temporary Internet Files\Content.IE5\SBHZ6VK4\evaluateCss[1].htc moved successfully.
C:\Documents and Settings\HP\Local Settings\Temporary Internet Files\Content.IE5\MUSZTXX8\evaluate[1].htc moved successfully.
C:\Documents and Settings\HP\Local Settings\Temporary Internet Files\Content.IE5\A7OJYM05\downloads[1].htm moved successfully.
C:\Documents and Settings\HP\Local Settings\Temporary Internet Files\AntiPhishing\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat moved successfully.
File move failed. C:\WINDOWS\temp\hlktmp scheduled to be moved on reboot.

Registry entries deleted on Reboot...

bitte erstelle und poste ein combofix log.
Ein Leitfaden und Tutorium zur Nutzung von ComboFix

So, musste mir ComboFix über einen anderen Rechner runterladen und auf den Laptop rüberschicken. Wollte jetzt gerade die Anleitung dazu abarbeiten. Leider habe ich folgendes Problem: Ich kann seit dem letzten OTL-Schritt nicht mehr auf mein Anti Virus Programm (AVG Anti Virus Free Edition 2011) zugreifen um es abzuschalten. Und über die Systemsteuerung im Sicherheitscenter kann ich den Virenschutz auch nicht auf INAKTIV ändern.

Soll ich AVG jetzt komplett aus der Software deinstallieren ?

Oder einfach auf AKTIV lassen ? Wie soll ich jetzt fortfahren ?

ja deinstaliere es mal, avg und combofix vertragen sich teilweise nicht.
bitte nach deinstalation neustarten

Hey, danke.

AVG Deinstallation und Neustart ist erledigt. Mache mich jetzt wieder an ComboFix.

Melde mich dann wieder.

Hallo !
Hatte gestern Abend endlich Zeit um mich an ComboFix dran zu setzen. Es startet auch so wie in der Anleitung beschrieben, aber wenn das Fenster kommt wo steht, dass der Scan nicht länger als 10 Minuten dauert, sich diese Zeit bei stark infizierten Rechnern leicht verdoppeln kann, gehts nicht weiter. Auch nach einer Stunde warten kommt kein weiterer Text so wie in der Anleitung steht (das mit der Uhrzeit und den fertigen Stufen). Was soll ich nun machen ?
Gruß

versuchs mal im abgesicherten modus ohne netzwerk, den solltest du bei pc start nach betätigen von f8 auswählen können

Genau das gleiche wie gestern Abend, hört auch im abgesicherten Modus an der gleichen Stelle auf. Was kann ich jetzt noch tun ?

kannst du mal deine version löschen.
dann gehe noch mal auf die homepage.
rechtsklick auf einen der download links, ziehl speichern unter.
lösche
combofix.exe
aus dem feld namen
schreibe
3456.com
speichern und im abgesicherten modus ausführen.