Das Thema wurde zwar schon mehrmals behandelt, aber da in den Regeln des Forums festgehalten wurde, dass jedes Problem, egal ob es Signifikanz zu einem schon behandelten Problem aufweist, verschiedener Behandlung bedürftig ist.

Ich habe da ich in Eile war aus versehen ein Program unseriöser Quelle installiert, da es immerwährend 2x in meiner Symbolleiste auftauchte. Habe also immer schön auf 'Abbrechen' geklickt und letzten Endes eben einmal aus versehen auf 'zulassen'.
Seitdem werden meine Googleegebnisse andauernd auf Gomeo, Ask.com o.Ä. umgeleitet.

Ich habe bereits Malewarebytes durchlaufen lassen und die Textdokumente von OTL und GMER erstellt. Ich weiß nur nicht wie ich diese hier einfügen kann.

LG

Hallo und Herzlich Willkommen!

Bevor wir unsere Zusammenarbeit beginnen, [Bitte Vollständig lesen]:

• "Fernbehandlungen/Fernhilfe" und die damit verbundenen Haftungsrisken:
  - da die Fehlerprüfung und Handlung werden über große Entfernungen durchgeführt, besteht keine Haftung unsererseits für die daraus entstehenden Folgen.
  - also, jede Haftung für die daraus entstandene Schäden wird ausgeschlossen, ANWEISUNGEN UND DEREN BEFOLGUNG, ERFOLGT AUF DEINE EIGENE VERANTWORTUNG!
• Charakteristische Merkmale/Profilinformationen:
  - aus der verwendeten Loglisten oder Logdateien - wie z.B. deinen Realnamen, Seriennummer in Programm etc)- kannst Du herauslöschen oder durch [X] ersetzen
• Die Systemprüfung und Bereinigung:
  - kann einige Zeit in Anspruch nehmen (je nach Art der Infektion), kann aber sogar so stark kompromittiert sein, so dass eine wirkungsvolle technische Säuberung ist nicht mehr möglich bzw Du es neu installieren musst
• Ich empfehle Dir die Anweisungen erst einmal komplett durchzulesen, bevor du es anwendest, weil wenn du etwas falsch machst, kann es wirklich gefährlich werden. Wenn du meinen Anweisungen Schritt für Schritt folgst, kann eigentlich nichts schief gehen.
• Innerhalb der Betreuungszeit:
  - ohne Abspräche bitte nicht auf eigene Faust handeln!- bei Problemen nachfragen.
• Die Reihenfolge:
  - genau so wie beschrieben bitte einhalten, nicht selbst die Reihenfolge wählen!
• Ansonsten unsere Forumsregeln:
  - Bitte erst lesen, dann posten!-> Für alle Hilfesuchenden! Was muss ich vor der Eröffnung eines Themas beachten?
• Alle Logfile mit einem vBCode Tag eingefügen, das bietet hier eine gute Übersicht, erleichtert mir die Arbeit! Falls das Logfile zu groß, teile es in mehrere Teile auf.

Sobald Du diesen Einführungstext gelesen hast, kannst Du beginnen

Für Vista und Win7:
Wichtig: Alle Befehle bitte als Administrator ausführen! rechte Maustaste auf die Eingabeaufforderung und "als Administrator ausführen" auswählen

Zitat von L9911

Ich habe bereits Malewarebytes durchlaufen lassen ...

Funde markieren und hier einfügen. Eine bebilderte Anleitung findest Du hier: Anleitung

Zitat von L9911

und GMER erstellt.

hast Du bei Dir speichern können? Wenn nicht, musst nochmal laufen lassen, wie unter Punkt 1. beschrieben

1.
läuft unter XP, Vista mit (32Bit) und Windows 7 (32Bit)
Achtung!:
WENN GMER NICHT AUSGEFÜHRT WERDEN KANN ODER PROBMLEME VERURSACHT, fahre mit dem nächsten Punkt fort!
Um einen tieferen Einblick in dein System, um eine mögliche Infektion mit einem Rootkit/Info v.wikipedia.org) aufzuspüren, werden wir ein Tool - Gmer - einsetzen :

• - also lade Dir Gmer herunter und entpacke es auf deinen Desktop
  - starte gmer.exe
  - [b]schließe alle Programme, ausserdem Antiviren und andere Schutzprogramme usw müssen deaktiviert sein, keine Verbindung zum Internet, WLAN auch trennen)
  - bitte nichts am Pc machen während der Scan läuft!
  - "Show all" soll nicht angehakt sein! dann klicke auf "Scan", um das Tool zu starten
  - wenn der Scan fertig ist klicke auf "Copy" (das Log wird automatisch in die Zwischenablage kopiert) und mit STRG + V musst Du gleich da einfügen
  - mit "Ok" wird GMER beendet.
  - das Log aus der Zwischenablage hier in Deinem Thread vollständig hineinkopieren

** keine Verbindung zu einem Netzwerk und Internet - WLAN nicht vergessen
Wenn der Scan beendet ist, bitte alle Programme und Tools wieder aktivieren!
** kannst Du das Log bei File-Upload.net/kostenlos hochladen und den Link mir hier posten.
Anleitung:-> GMER - Rootkit Scanner

2.
lade Dir HijackThis 2.0.4 von *von hier* herunter
HijackThis starten→ "Do a system scan and save a logfile" klicken→ das erhaltene Logfile "markieren" → "kopieren"→ hier in deinem Thread (rechte Maustaste) "einfügen"

3.
Bitte Versteckte - und Systemdateien sichtbar machen den Link hier anklicken:
System-Dateien und -Ordner unter XP und Vista sichtbar machen
Am Ende unserer Arbeit, kannst wieder rückgängig machen!

4.
→ Lade Dir HJTscanlist.zip herunter
→ entpacke die Datei auf deinem Desktop
→ Bei WindowsXP Home musst vor dem Scan zusätzlich tasklist.zip installieren
→ per Doppelklick starten
→ Wähle dein Betriebsystem aus - bei Win7 wähle Vista
→ Wenn Du gefragt wirst, die Option "Einstellung" (1) - scanlist" wählen
→ Nach kurzer Zeit sollte sich Dein Editor öffnen und die Datei hjtscanlist.txt präsentieren
→ Bitte kopiere den Inhalt hier in Deinen Thread.
** Falls es klappt auf einmal nicht, kannst den Text in mehrere Teile teilen und so posten

5.
Ich würde gerne noch all deine installierten Programme sehen:
Lade dir das Tool Ccleaner herunter
→ Download
installieren (Software-Lizenzvereinbarung lesen, falls angeboten wird "Füge CCleaner Yahoo! Toolbar hinzu" abwählen)→ starten→ falls nötig - unter Options settings-> "german" einstellen
dann klick auf "Extra (um die installierten Programme auch anzuzeigen)→ weiter auf "Als Textdatei speichern..."
wird eine Textdatei (*.txt) erstellt, kopiere dazu den Inhalt und füge ihn da ein

Damit dein Thread übersichtlicher und schön lesbar bleibt, am besten nutze den Code-Tags für deinen Post:
→ vor dein Log schreibst Du (also am Anfang des Logfiles):[code]
hier kommt dein Logfile rein - z.B hjtsanlist o. sonstiges
→ dahinter - also am Ende der Logdatei: [/code]

gruß
Coverflow

Soweit erstmal:

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Datenbank Version: 6233

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.19019

01.04.2011 11:09:26
mbam-log-2011-04-01 (11-09-26).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 151973
Laufzeit: 6 Minute(n), 46 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 10

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
c:\Users\XXX\AppData\Local\Temp\setup1431040.exe (Rootkit.TDSS) -> Quarantined and deleted successfully.
c:\Users\XXX\AppData\Local\Temp\setup1381849792.exe (Rootkit.TDSS) -> Quarantined and deleted successfully.
c:\Users\XXX\AppData\Local\Temp\DE37.tmp (Rootkit.TDSS) -> Quarantined and deleted successfully.
c:\Users\XXX\AppData\Local\Temp\nrsmcowxae.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\Users\XXX\AppData\Local\Temp\setup1476921600.exe (Rootkit.TDSS) -> Quarantined and deleted successfully.
c:\Users\XXX\AppData\Local\Temp\setup2497090432.exe (Rootkit.TDSS) -> Quarantined and deleted successfully.
c:\Users\XXX\AppData\Local\Temp\setup2633228608.exe (Rootkit.TDSS) -> Quarantined and deleted successfully.
c:\Users\XXX\AppData\Local\Temp\setup265072768.exe (Rootkit.TDSS) -> Quarantined and deleted successfully.
c:\Users\XXX\AppData\Local\Temp\setup3971165568.exe (Rootkit.TDSS) -> Quarantined and deleted successfully.
c:\Users\XXX\AppData\Local\Temp\setup4202406592.exe (Rootkit.TDSS) -> Quarantined and deleted successfully.
         

OTL logfile created on: 04.04.2011 01:40:45 - Run 1
OTL by OldTimer - Version 3.2.22.3     Folder = C:\Users\XXX\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19019)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 56,00% Memory free
4,00 Gb Paging File | 3,00 Gb Available in Paging File | 76,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 146,48 Gb Total Space | 83,75 Gb Free Space | 57,18% Space Free | Partition Type: NTFS
Drive D: | 151,60 Gb Total Space | 151,51 Gb Free Space | 99,94% Space Free | Partition Type: NTFS
 
Computer Name: XXX-PC | User Name: XXX | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2011.04.04 01:30:45 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Users\XXX\Desktop\OTL.exe
PRC - [2011.03.24 01:26:17 | 000,912,344 | ---- | M] (Mozilla Corporation) -- C:\Programme\Mozilla Firefox\firefox.exe
PRC - [2011.02.15 03:32:52 | 001,230,704 | ---- | M] () -- C:\Programme\DivX\DivX Update\DivXUpdate.exe
PRC - [2010.11.30 14:20:36 | 000,997,408 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft Security Client\msseces.exe
PRC - [2010.11.11 13:26:42 | 000,206,360 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft Security Client\Antimalware\NisSrv.exe
PRC - [2010.11.11 13:26:40 | 000,011,736 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft Security Client\Antimalware\MsMpEng.exe
PRC - [2010.10.14 23:33:52 | 000,134,808 | ---- | M] (Google Inc.) -- C:\Users\XXX\AppData\Local\Google\Update\1.2.183.39\GoogleCrashHandler.exe
PRC - [2009.04.11 08:28:03 | 001,233,920 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Sidebar\sidebar.exe
PRC - [2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2009.04.11 08:27:28 | 000,069,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conime.exe
PRC - [2008.03.11 01:00:00 | 005,296,128 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe
PRC - [2007.05.17 23:22:06 | 000,049,152 | ---- | M] (Bison Inc.) -- C:\Windows\BisonCam\BisonAPP.exe
 
 
========== Modules (SafeList) ==========
 
MOD - [2011.04.04 01:30:45 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Users\XXX\Desktop\OTL.exe
MOD - [2010.08.31 17:43:52 | 001,686,016 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll
MOD - [2010.05.04 21:13:07 | 000,231,424 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msshsq.dll
MOD - [2009.04.11 08:28:24 | 000,380,416 | ---- | M] (Microsoft Corporation) -- C:\Programme\Common Files\microsoft shared\ink\tiptsf.dll
MOD - [2008.01.19 09:34:07 | 000,183,808 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\duser.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - [2011.03.30 22:48:05 | 003,229,784 | ---- | M] () [Auto | Running] -- c:\Programme\Common Files\Akamai\netsession_win_a35e6b9.dll -- (Akamai)
SRV - [2010.11.11 13:26:42 | 000,206,360 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe -- (NisSrv)
SRV - [2010.11.11 13:26:40 | 000,011,736 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe -- (MsMpSvc)
SRV - [2008.01.19 09:38:24 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
 
 
========== Driver Services (SafeList) ==========
 
DRV - [2011.04.04 01:33:41 | 000,028,752 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{046E1B82-B8CF-443C-9503-E9CD6B50597C}\MpKsl4b81517a.sys -- (MpKsl4b81517a)
DRV - [2011.04.04 01:22:04 | 000,028,752 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{046E1B82-B8CF-443C-9503-E9CD6B50597C}\MpKsl45c48279.sys -- (MpKsl45c48279)
DRV - [2010.10.24 22:25:38 | 000,054,144 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\NisDrvWFP.sys -- (NisDrv)
DRV - [2010.10.24 22:25:38 | 000,043,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\MpNWMon.sys -- (MpNWMon)
DRV - [2009.09.05 15:25:36 | 001,183,744 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr)
DRV - [2007.09.04 19:51:12 | 000,114,208 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\nvstor32.sys -- (nvstor32)
DRV - [2007.08.24 03:16:46 | 000,783,272 | ---- | M] (Bison Electronics. Inc. ) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\BisonCam.sys -- (Cam5603D)
DRV - [2007.07.19 02:31:00 | 007,599,776 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2007.05.15 22:50:36 | 000,157,696 | ---- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Apfiltr.sys -- (ApfiltrService)
DRV - [2007.03.15 18:46:24 | 000,008,704 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\XAudio.sys -- (XAudio)
DRV - [2007.02.16 01:00:00 | 000,012,032 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvsmu.sys -- (nvsmu)
DRV - [2007.01.01 01:20:10 | 001,059,112 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvmfdx32.sys -- (NVENETFD)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = E0 6B D0 29 D9 E5 CB 01  [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie
IE - HKCU\..\URLSearchHook:  - Reg Error: Key error. File not found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.selectedEngine: "Search"
FF - prefs.js..browser.startup.homepage: "google.de"
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.2.1
FF - prefs.js..extensions.enabledItems: wikilook@testpilot:2.5.5
FF - prefs.js..extensions.enabledItems: {23fcfd51-4958-4f00-80a3-ae97e717ed8b}:2.1.1.94
FF - prefs.js..extensions.enabledItems: {6904342A-8307-11DF-A508-4AE2DFD72085}:2.1.1.94
FF - prefs.js..extensions.enabledItems: {de5809e0-2b07-11dd-bd0b-0800200c9a66}:1.2.0
FF - prefs.js..extensions.enabledItems: djziggy@gmail.com:1.1.0
FF - prefs.js..extensions.enabledItems: silvermel@pardal.de:1.3.2
FF - prefs.js..keyword.URL: "hxxp://www.slaago.com/search/?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&rls=ARcv4EGY&q="
 
FF - user.js..browser.search.selectedEngine: "Search"
FF - user.js..keyword.URL: "hxxp://www.slaago.com/search/?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&rls=ARcv4EGY&q="
 
FF - HKLM\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\html5video [2011.03.20 15:32:28 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{6904342A-8307-11DF-A508-4AE2DFD72085}: C:\Program Files\DivX\DivX Plus Web Player\firefox\wpa [2011.03.20 15:32:28 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.16\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.03.24 01:26:20 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.16\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.03.28 09:49:17 | 000,000,000 | ---D | M]
 
[2010.02.25 18:34:48 | 000,000,000 | ---D | M] (No name found) -- C:\Users\XXX\AppData\Roaming\mozilla\Extensions
[2011.04.03 22:48:59 | 000,000,000 | ---D | M] (No name found) -- C:\Users\XXX\AppData\Roaming\mozilla\Firefox\Profiles\raofpejg.default\extensions
[2010.02.26 15:02:32 | 000,000,000 | ---D | M] (No name found) -- C:\Users\XXX\AppData\Roaming\mozilla\Firefox\Profiles\raofpejg.default\extensions\{5c8bfb7c-9a54-11dc-8314-0800200c9a66}
[2011.03.30 15:40:20 | 000,000,000 | ---D | M] (NoScript) -- C:\Users\XXX\AppData\Roaming\mozilla\Firefox\Profiles\raofpejg.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}
[2010.02.26 14:47:34 | 000,000,000 | ---D | M] (No name found) -- C:\Users\XXX\AppData\Roaming\mozilla\Firefox\Profiles\raofpejg.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2010.07.22 11:04:38 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Users\XXX\AppData\Roaming\mozilla\Firefox\Profiles\raofpejg.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2010.07.22 11:04:36 | 000,000,000 | ---D | M] (Gradient iCool) -- C:\Users\XXX\AppData\Roaming\mozilla\Firefox\Profiles\raofpejg.default\extensions\{de5809e0-2b07-11dd-bd0b-0800200c9a66}
[2010.02.26 15:07:18 | 000,000,000 | ---D | M] (LavaFox V1-Blue) -- C:\Users\XXX\AppData\Roaming\mozilla\Firefox\Profiles\raofpejg.default\extensions\djziggy@gmail.com
[2010.02.26 14:53:31 | 000,000,000 | ---D | M] (No name found) -- C:\Users\XXX\AppData\Roaming\mozilla\Firefox\Profiles\raofpejg.default\extensions\fastYoutubeDownloader@yevgenyandrov.net
[2010.02.26 14:52:26 | 000,000,000 | ---D | M] (No name found) -- C:\Users\XXX\AppData\Roaming\mozilla\Firefox\Profiles\raofpejg.default\extensions\nasanightlaunch@example.com
[2010.02.26 15:06:55 | 000,000,000 | ---D | M] (Silvermel) -- C:\Users\XXX\AppData\Roaming\mozilla\Firefox\Profiles\raofpejg.default\extensions\silvermel@pardal.de
[2011.03.30 15:40:20 | 000,000,000 | ---D | M] (No name found) -- C:\Users\XXX\AppData\Roaming\mozilla\Firefox\Profiles\raofpejg.default\extensions\staged-xpis
[2010.02.26 14:57:36 | 000,000,000 | ---D | M] (WikiLook) -- C:\Users\XXX\AppData\Roaming\mozilla\Firefox\Profiles\raofpejg.default\extensions\wikilook@testpilot
[2011.03.16 20:18:56 | 000,002,198 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\Mozilla\Firefox\Profiles\raofpejg.default\searchplugins\google-search.xml
[2011.03.29 15:53:53 | 000,000,950 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\Mozilla\Firefox\Profiles\raofpejg.default\searchplugins\icqplugin-1.xml
[2010.03.01 22:04:47 | 000,000,950 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\Mozilla\Firefox\Profiles\raofpejg.default\searchplugins\icqplugin-2.xml
[2008.07.10 14:07:28 | 000,000,944 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\Mozilla\Firefox\Profiles\raofpejg.default\searchplugins\icqplugin.xml
[2010.11.17 00:47:14 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2010.02.26 14:40:45 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Programme\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2010.06.07 08:30:42 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010.11.17 00:47:15 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2011.03.20 15:32:28 | 000,000,000 | ---D | M] (DivX Plus Web Player HTML5 <video>) -- C:\PROGRAM FILES\DIVX\DIVX PLUS WEB PLAYER\FIREFOX\HTML5VIDEO
[2011.03.20 15:32:28 | 000,000,000 | ---D | M] (DivX HiQ) -- C:\PROGRAM FILES\DIVX\DIVX PLUS WEB PLAYER\FIREFOX\WPA
[2010.02.27 13:15:19 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION
[2010.09.15 05:50:38 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Mozilla Firefox\plugins\npdeployJava1.dll
[2010.10.24 19:51:45 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2010.10.24 19:51:45 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml
[2010.10.24 19:51:45 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2010.10.24 19:51:45 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2010.10.24 19:51:45 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2011.04.03 23:14:49 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Programme\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
O2 - BHO: (DivX HiQ) - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Programme\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O4 - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [BisonAPP] C:\Windows\BisonCam\BisonAPP.exe (Bison Inc.)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [MSC] C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [NeroFilterCheck] C:\Programme\Common Files\Nero\Lib\NeroCheck.exe (Nero AG)
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvSvc] C:\Windows\System32\nvsvc.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Low Rights present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.)
O9 - Extra Button: ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - C:\Programme\ICQ7.0\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - C:\Programme\ICQ7.0\ICQ.exe (ICQ, LLC.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab (MessengerStatsClient Class)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Public\Pictures\Sample Pictures\Dock.jpg
O24 - Desktop BackupWallPaper: C:\Users\Public\Pictures\Sample Pictures\Dock.jpg
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias -  File not found
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.04.04 01:37:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ERUNT
[2011.04.04 01:37:56 | 000,000,000 | ---D | C] -- C:\Programme\ERUNT
[2011.04.04 01:30:36 | 000,791,393 | ---- | C] (Lars Hederer                                                ) -- C:\Users\XXX\Desktop\Erunt-setup.exe
[2011.04.04 01:30:36 | 000,580,608 | ---- | C] (OldTimer Tools) -- C:\Users\XXX\Desktop\OTL.exe
[2011.04.04 01:30:36 | 000,446,464 | ---- | C] (OldTimer Tools) -- C:\Users\XXX\Desktop\TFC.exe
[2011.04.04 00:48:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
[2011.04.04 00:48:19 | 000,000,000 | ---D | C] -- C:\Programme\CCleaner
[2011.04.04 00:33:12 | 000,000,000 | ---D | C] -- C:\Users\XXX\Desktop\Programme
[2011.04.04 00:14:51 | 000,000,000 | ---D | C] -- C:\32788R22FWJFW
[2011.04.03 23:26:14 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2011.04.03 23:12:06 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\temp
[2011.04.03 23:12:04 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2011.04.03 22:58:34 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
[2011.04.03 22:52:03 | 000,000,000 | ---D | C] -- C:\Users\XXX\Desktop\Documents\Simply Super Software
[2011.04.01 14:03:03 | 000,000,000 | ---D | C] -- C:\Windows\Sun
[2011.04.01 11:00:02 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Roaming\Malwarebytes
[2011.04.01 10:59:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011.04.01 10:59:57 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2011.04.01 10:59:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2011.04.01 10:59:52 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2011.04.01 10:59:51 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware
[2011.03.22 22:14:21 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Roaming\Media Player Classic
[2011.03.21 23:45:38 | 000,000,000 | ---D | C] -- C:\Programme\Yuna Software
[2011.03.20 15:37:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DivX
[2011.03.20 15:33:15 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\DDMSettings
[2011.03.10 14:20:44 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2011.03.10 14:19:37 | 000,000,000 | ---D | C] -- C:\Programme\iPod
[2011.03.10 14:19:35 | 000,000,000 | ---D | C] -- C:\Programme\iTunes
[2011.03.10 14:13:55 | 000,000,000 | ---D | C] -- C:\Programme\Bonjour
[2011.03.05 14:33:30 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\MCE Logs
 
========== Files - Modified Within 30 Days ==========
 
[2011.04.04 01:38:00 | 000,001,134 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-328560254-4191133697-2808687225-1000UA.job
[2011.04.04 01:37:58 | 000,000,739 | ---- | M] () -- C:\Users\XXX\Desktop\NTREGOPT.lnk
[2011.04.04 01:37:58 | 000,000,720 | ---- | M] () -- C:\Users\XXX\Desktop\ERUNT.lnk
[2011.04.04 01:35:41 | 000,000,000 | ---- | M] () -- C:\Users\XXX\defogger_reenable
[2011.04.04 01:33:29 | 000,003,664 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011.04.04 01:33:27 | 000,003,664 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011.04.04 01:33:14 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011.04.04 01:33:10 | 2146,328,576 | -HS- | M] () -- C:\hiberfil.sys
[2011.04.04 01:30:47 | 000,301,568 | ---- | M] () -- C:\Users\XXX\Desktop\g2m3e4r.exe
[2011.04.04 01:30:45 | 000,791,393 | ---- | M] (Lars Hederer                                                ) -- C:\Users\XXX\Desktop\Erunt-setup.exe
[2011.04.04 01:30:45 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Users\XXX\Desktop\OTL.exe
[2011.04.04 01:30:43 | 000,446,464 | ---- | M] (OldTimer Tools) -- C:\Users\XXX\Desktop\TFC.exe
[2011.04.04 01:15:41 | 000,050,477 | ---- | M] () -- C:\Users\XXX\Desktop\Defogger.exe
[2011.04.04 01:09:41 | 003,603,600 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2011.04.04 00:48:21 | 000,000,810 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2011.04.04 00:32:28 | 000,000,680 | ---- | M] () -- C:\Users\XXX\AppData\Local\d3d9caps.dat
[2011.04.03 23:38:00 | 000,001,082 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-328560254-4191133697-2808687225-1000Core.job
[2011.04.03 23:14:49 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts
[2011.04.01 10:59:58 | 000,000,912 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.04.01 08:31:03 | 000,027,715 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\nvModes.dat
[2011.04.01 08:31:02 | 000,027,715 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\nvModes.001
[2011.03.31 17:14:19 | 000,630,842 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2011.03.31 17:14:19 | 000,598,096 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011.03.31 17:14:19 | 000,127,260 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2011.03.31 17:14:19 | 000,105,070 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011.03.31 17:05:30 | 000,002,560 | ---- | M] () -- C:\Windows\_MSRSTRT.EXE
[2011.03.31 16:40:42 | 051,435,480 | ---- | M] () -- C:\Users\XXX\Desktop\Documents\avira_antivir_635personal_de.exe
[2011.03.30 15:21:45 | 000,010,383 | ---- | M] () -- C:\Users\XXX\Desktop\Documents\Unbenannt 1.odt
[2011.03.27 05:38:33 | 000,002,068 | ---- | M] () -- C:\Users\XXX\Desktop\Google Chrome.lnk
[2011.03.22 03:22:12 | 000,043,520 | ---- | M] () -- C:\Users\XXX\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.03.20 18:46:33 | 000,049,595 | ---- | M] () -- C:\Windows\KernelMessage
[2011.03.14 21:08:06 | 000,009,065 | ---- | M] () -- C:\Users\XXX\Desktop\Documents\Pädagogik.odt
[2011.03.13 13:36:01 | 000,009,241 | ---- | M] () -- C:\Users\XXX\Desktop\Anleitung.html
[2011.03.10 23:04:58 | 000,018,627 | ---- | M] () -- C:\Users\XXX\Desktop\Documents\Praktikumsbericht.odt
[2011.03.10 14:20:44 | 000,001,670 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk
[2011.03.10 14:14:21 | 000,001,854 | ---- | M] () -- C:\Users\Public\Desktop\Safari.lnk
[2011.03.08 14:56:43 | 000,008,206 | ---- | M] () -- C:\Users\XXX\Desktop\Documents\remy.odt
[2011.03.07 23:48:04 | 000,024,398 | ---- | M] () -- C:\Users\XXX\Desktop\Documents\Handout Sturm und Drang.odt
 
========== Files Created - No Company Name ==========
 
[2011.04.04 01:37:58 | 000,000,739 | ---- | C] () -- C:\Users\XXX\Desktop\NTREGOPT.lnk
[2011.04.04 01:37:58 | 000,000,720 | ---- | C] () -- C:\Users\XXX\Desktop\ERUNT.lnk
[2011.04.04 01:35:41 | 000,000,000 | ---- | C] () -- C:\Users\XXX\Hof\defogger_reenable
[2011.04.04 01:30:36 | 000,301,568 | ---- | C] () -- C:\Users\XXX\Desktop\g2m3e4r.exe
[2011.04.04 01:15:40 | 000,050,477 | ---- | C] () -- C:\Users\XXX\Desktop\Defogger.exe
[2011.04.04 00:48:21 | 000,000,810 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2011.04.03 22:51:46 | 000,162,304 | ---- | C] () -- C:\Windows\System32\ztvunrar36.dll
[2011.04.03 22:51:46 | 000,153,088 | ---- | C] () -- C:\Windows\System32\UNRAR3.dll
[2011.04.03 22:51:46 | 000,077,312 | ---- | C] () -- C:\Windows\System32\ztvunace26.dll
[2011.04.03 22:51:46 | 000,075,264 | ---- | C] () -- C:\Windows\System32\unacev2.dll
[2011.04.01 10:59:58 | 000,000,912 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.03.31 17:05:27 | 000,002,560 | ---- | C] () -- C:\Windows\_MSRSTRT.EXE
[2011.03.31 16:40:02 | 051,435,480 | ---- | C] () -- C:\Users\XXX\Desktop\Documents\avira_antivir_635personal_de.exe
[2011.03.30 15:21:43 | 000,010,383 | ---- | C] () -- C:\Users\XXX\Desktop\Documents\Unbenannt 1.odt
[2011.03.20 15:52:20 | 000,165,376 | ---- | C] () -- C:\Windows\System32\unrar.dll
[2011.03.14 21:08:04 | 000,009,065 | ---- | C] () -- C:\Users\XXX\Desktop\Documents\Pädagogik.odt
[2011.03.13 13:41:20 | 000,009,241 | ---- | C] () -- C:\Users\XXX\Desktop\Anleitung.html
[2011.03.10 16:08:28 | 000,140,168 | ---- | C] () -- C:\Users\XXX\Desktop\Documents\Lebenslauf.odt
[2011.03.10 16:08:28 | 000,096,360 | ---- | C] () -- C:\Users\XXX\Desktop\Documents\Stundenprotokoll.odt
[2011.03.10 16:08:28 | 000,012,885 | ---- | C] () -- C:\Users\XXX\Desktop\Documents\Kurze Zusammenfassung.odt
[2011.03.10 16:08:23 | 110,068,396 | ---- | C] () -- C:\Users\XXX\Desktop\Documents\He's alltime around whereever you are.wmv
[2011.03.10 16:08:22 | 001,598,454 | ---- | C] () -- C:\Users\XXX\Desktop\Documents\bild2.bmp
[2011.03.10 16:08:22 | 001,012,022 | ---- | C] () -- C:\Users\XXX\Desktop\Documents\bild1.bmp
[2011.03.10 16:08:22 | 000,019,495 | ---- | C] () -- C:\Users\XXX\Desktop\Documents\Bewerbung Schule.odt
[2011.03.10 14:20:44 | 000,001,670 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk
[2011.03.08 14:56:41 | 000,008,206 | ---- | C] () -- C:\Users\XXX\Desktop\Documents\remy.odt
[2011.03.07 23:48:02 | 000,024,398 | ---- | C] () -- C:\Users\XXX\Desktop\Documents\Handout Sturm und Drang.odt
[2010.05.29 13:59:33 | 000,173,911 | ---- | C] () -- C:\Windows\hpwins12.dat
[2010.05.29 13:57:49 | 000,009,842 | ---- | C] () -- C:\Windows\hpwscr12.dat
[2010.05.29 13:57:49 | 000,000,981 | ---- | C] () -- C:\Windows\hpwmdl12.dat
[2010.03.08 23:09:00 | 000,043,520 | ---- | C] () -- C:\Users\XXX\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.03.08 16:39:11 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2010.03.07 17:52:31 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2010.03.07 17:52:31 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2010.02.26 13:39:06 | 000,027,715 | ---- | C] () -- C:\Users\XXX\AppData\Roaming\nvModes.001
[2010.02.26 12:54:53 | 000,027,715 | ---- | C] () -- C:\Users\XXX\AppData\Roaming\nvModes.dat
[2007.01.04 02:18:59 | 000,000,680 | ---- | C] () -- C:\Users\XXX\AppData\Local\d3d9caps.dat
[2007.01.01 01:50:19 | 000,000,588 | ---- | C] () -- C:\Windows\System32\drivers\RtMicAr.dat
[2007.01.01 01:43:52 | 000,015,190 | ---- | C] () -- C:\Windows\M2000Twn.ini
[2007.01.01 01:21:43 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2007.01.01 01:21:31 | 000,001,732 | ---- | C] () -- C:\Windows\System32\drivers\nvphy.bin
[2006.11.02 17:33:31 | 000,630,842 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2006.11.02 17:33:31 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2006.11.02 17:33:31 | 000,127,260 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2006.11.02 17:33:31 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2006.11.02 14:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006.11.02 14:47:37 | 003,603,600 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006.11.02 12:33:01 | 000,598,096 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2006.11.02 12:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2006.11.02 12:33:01 | 000,105,070 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2006.11.02 12:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2006.11.02 12:25:26 | 000,557,568 | ---- | C] () -- C:\Windows\System32\hpotscl1.dll
[2006.11.02 12:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2006.11.02 10:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006.11.02 10:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006.11.02 09:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2006.07.27 19:28:42 | 003,596,288 | ---- | C] () -- C:\Windows\System32\qt-dx331.dll
[2006.07.12 01:40:17 | 000,520,192 | ---- | C] () -- C:\Windows\System32\DivXsm.exe
[2006.07.12 00:33:49 | 000,012,288 | ---- | C] () -- C:\Windows\System32\DivXWMPExtType.dll
 
========== LOP Check ==========
 
[2011.04.03 23:12:54 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\ICQ
[2010.04.17 02:32:06 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\OpenOffice.org
[2011.04.04 01:32:37 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2010.12.16 04:22:33 | 000,000,426 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{DC8EB48D-A24C-4C61-9BBD-0479931BD5C4}.job
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %SYSTEMDRIVE%\*. >
[2011.04.03 23:26:14 | 000,000,000 | -HSD | M] -- C:\$RECYCLE.BIN
[2011.04.04 00:14:55 | 000,000,000 | ---D | M] -- C:\32788R22FWJFW
[2010.03.17 10:03:36 | 000,000,000 | ---D | M] -- C:\Boot
[2011.03.31 16:41:57 | 000,000,000 | ---D | M] -- C:\Config.Msi
[2006.11.02 15:02:03 | 000,000,000 | -HSD | M] -- C:\Documents and Settings
[2007.01.04 02:16:51 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen
[2007.01.01 01:38:25 | 000,000,000 | ---D | M] -- C:\NVIDIA
[2010.03.07 13:27:24 | 000,000,000 | ---D | M] -- C:\PerfLogs
[2011.04.04 01:37:56 | 000,000,000 | R--D | M] -- C:\Programme
[2011.04.03 23:20:45 | 000,000,000 | ---D | M] -- C:\ProgramData
[2007.01.04 02:16:51 | 000,000,000 | -HSD | M] -- C:\Programme
[2011.04.04 01:41:39 | 000,000,000 | -HSD | M] -- C:\System Volume Information
[2007.01.04 02:18:57 | 000,000,000 | R--D | M] -- C:\Users
[2011.04.04 01:08:50 | 000,000,000 | ---D | M] -- C:\Windows
 
< %PROGRAMFILES%\*.exe >
 
< %LOCALAPPDATA%\*.exe >
 
< %systemroot%\*. /mp /s >
 
 
< MD5 for: EXPLORER.EXE  >
[2010.02.26 13:07:05 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=37440D09DEAE0B672A04DCCF7ABF06BE -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_4f83bb287ccdb7e3\explorer.exe
[2010.02.26 13:07:04 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_5177ca9879e978e8\explorer.exe
[2010.02.26 13:07:04 | 002,927,616 | ---- | M] (Microsoft Corporation) MD5=50BA5850147410CDE89C523AD3BC606E -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_51e4f8c7931bd1e1\explorer.exe
[2010.02.26 15:34:04 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=6D06CD98D954FE87FB2DB8108793B399 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16549_none_4fac29707cae347a\explorer.exe
[2010.02.26 15:34:04 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=BD06F0BF753BC704B653C3A50F89D362 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20668_none_501f261995dcf2cf\explorer.exe
[2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\ERDNT\cache\explorer.exe
[2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\explorer.exe
[2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_53a0201e76de3a0b\explorer.exe
[2010.02.26 13:07:04 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=E7156B0B74762D9DE0E66BDCDE06E5FB -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_5033cb5995cd990b\explorer.exe
[2006.11.02 11:45:07 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=FD8C53FB002217F6F888BCF6F5D7084D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16386_none_4f7de5167cd15deb\explorer.exe
[2008.01.19 09:33:10 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=FFA764631CB70A30065C12EF8E174F9F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_51b4a71279bc6ebf\explorer.exe
 
< MD5 for: USERINIT.EXE  >
[2008.01.19 09:33:33 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\ERDNT\cache\userinit.exe
[2008.01.19 09:33:33 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe
[2008.01.19 09:33:33 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe
[2006.11.02 11:45:50 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=22027835939F86C3E47AD8E3FBDE3D11 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6000.16386_none_d9f1f819d4c4e737\userinit.exe
 
< MD5 for: WININIT.EXE  >
[2008.01.19 09:33:37 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\ERDNT\cache\wininit.exe
[2008.01.19 09:33:37 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\System32\wininit.exe
[2008.01.19 09:33:37 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6001.18000_none_30f2b8cf0450a6a2\wininit.exe
[2006.11.02 11:45:57 | 000,095,744 | ---- | M] (Microsoft Corporation) MD5=D4385B03E8CCCEE6F0EE249F827C1F3E -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6000.16386_none_2ebbf6d3076595ce\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2009.04.11 08:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\ERDNT\cache\winlogon.exe
[2009.04.11 08:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\System32\winlogon.exe
[2009.04.11 08:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe
[2006.11.02 11:45:57 | 000,308,224 | ---- | M] (Microsoft Corporation) MD5=9F75392B9128A91ABAFB044EA350BAAD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6000.16386_none_6d8c3f1ad8066b21\winlogon.exe
[2008.01.19 09:33:37 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe
 
< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >
 
< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-03-24 18:42:11
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 130 bytes -> C:\ProgramData\TEMP:C895616B

< End of report >
         

OTL Extras logfile created on: 04.04.2011 01:40:45 - Run 1
OTL by OldTimer - Version 3.2.22.3     Folder = C:\Users\XXX\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19019)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 56,00% Memory free
4,00 Gb Paging File | 3,00 Gb Available in Paging File | 76,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 146,48 Gb Total Space | 83,75 Gb Free Space | 57,18% Space Free | Partition Type: NTFS
Drive D: | 151,60 Gb Total Space | 151,51 Gb Free Space | 99,94% Space Free | Partition Type: NTFS
 
Computer Name: XXX | User Name: XXX | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{10742AF8-2AA7-49A0-9997-F9D85ADE06D5}" = rport=139 | protocol=6 | dir=out | app=system | 
"{1135FA2B-2D2A-4AA7-A6B4-67E5E59ABE9B}" = lport=138 | protocol=17 | dir=in | app=system | 
"{137E5F09-3F24-4453-AA91-AF1680B9EC37}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{16822AEC-3D80-4AA5-B704-30A7DCC948EF}" = lport=49163 | protocol=6 | dir=in | name=akamai netsession interface | 
"{1A44E664-B94B-4D48-8461-B3A19D6F4F81}" = lport=445 | protocol=6 | dir=in | app=system | 
"{2034DD3C-7779-472A-8B59-F18B0A3A0223}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{27A79B87-4FF0-4902-BDB4-84135D57385C}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 
"{31D02CE6-C1BB-49C6-982A-FD1304709ED1}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{388340A3-3AFB-4E58-B4A0-A6810C30B4A5}" = lport=49328 | protocol=6 | dir=in | name=akamai netsession interface | 
"{40DE82B2-22D4-4250-BB7A-5BC934C7CA2B}" = lport=5000 | protocol=17 | dir=in | name=akamai netsession interface | 
"{5CC7D6CF-759A-4B96-8DDE-6A6AB6572E7A}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{5D44DB62-1DEC-4233-BB9B-CBE47B409A2F}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{69073A04-B7FD-426D-9AAA-8CB0C6F17D81}" = rport=445 | protocol=6 | dir=out | app=system | 
"{6FCFCC70-AF7F-4C6E-AF06-E530B44CB858}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{81CCF927-5012-4C8E-A7FA-17488196D11B}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
"{8BA8CDF8-0080-4167-B430-974FCEAD9645}" = lport=139 | protocol=6 | dir=in | app=system | 
"{8F8B2121-9AB7-4FBA-B7E8-220F85ACB3B0}" = rport=137 | protocol=17 | dir=out | app=system | 
"{99D28499-D3CF-4511-A7BC-34388F58C784}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{A6DB1FB2-FB7C-4D76-B590-F88C72535386}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{A6F1D90C-835D-4347-932B-9711AABD9CB9}" = lport=5000 | protocol=17 | dir=in | name=akamai netsession interface | 
"{B95B1953-FBF1-4A05-B5D3-4FC0D85720A8}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
"{BB746623-3CBF-4BA0-8480-4DCA5790A8A4}" = rport=138 | protocol=17 | dir=out | app=system | 
"{BD2DE017-24A4-43EA-8F0B-3EA85CB7067A}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{CF064EB9-2C51-44DA-BE41-F0D6DA0E06F3}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe | 
"{D339A7AF-319C-48F1-A8AC-85A206FA7E8E}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{D71EAE41-7190-4C0A-9E99-6DF0B0D8CA93}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 
"{E1DA6662-DD6C-40E3-A205-2EC08D2FC01A}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 
"{E5C52DCC-72C3-408F-A476-0919ABA1DFF8}" = lport=137 | protocol=17 | dir=in | app=system | 
"{E7D1CB0D-10EC-4534-AD74-A1CA3A668A90}" = lport=10243 | protocol=6 | dir=in | app=system | 
"{E80E4C5A-3158-476B-87DF-3AB15A4905A7}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe | 
"{EE3D44A4-7934-4EF9-8023-31050641E91F}" = rport=10243 | protocol=6 | dir=out | app=system | 
"{FB37903A-9B52-432C-8ED4-88B8181E2A9B}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{FFD2DB90-2C5E-4070-BED7-7B1EA884F6D6}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{03154D4E-D952-49A5-8A31-2861C48F186F}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{05EA0306-6D90-43BA-9613-EDEA80A669BF}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{091E4D46-543F-4556-B50F-E196892EC60B}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{0BBD284A-09F0-453C-BE47-122312E6F594}" = protocol=6 | dir=in | app=c:\program files\icq7.0\icq.exe | 
"{140DB9C5-FD5A-44E7-A044-A83EF457169B}" = protocol=6 | dir=in | app=c:\program files\icq7.0\aolload.exe | 
"{2A5DBE9E-3A0F-4B97-A53E-E2A507DC0ACF}" = protocol=6 | dir=in | app=c:\program files\icq7.0\icq.exe | 
"{2B4B34C5-D09D-400E-8531-4D7087813952}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{2D62BB05-C0F0-43B3-A13D-45889B2CF797}" = protocol=17 | dir=in | app=c:\program files\icq7.0\aolload.exe | 
"{43120D8D-2DDB-48CA-91A2-3C8035C48FF0}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | 
"{43B6933F-89C1-4DD2-BDFB-28020D4BF32F}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{4C05BD6E-B64C-4772-9760-EA7542F341F9}" = protocol=6 | dir=in | app=c:\program files\icq7.0\aolload.exe | 
"{50DB3FC8-C552-455C-B824-295D47D770EB}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{6077E9A7-1B0A-4EEC-AF10-2C7B3EDD1786}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{7052A128-9A4C-4769-B1EA-F835AE0BF05C}" = protocol=6 | dir=out | app=system | 
"{78707D3B-D1CD-4002-B6E9-1134E6BEFF54}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{7D675BFC-8128-428D-B22A-9350766DA3AE}" = protocol=17 | dir=in | app=c:\program files\icq7.0\aolload.exe | 
"{7E09F44E-B3C2-473D-965A-99D7A20598D1}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{8055C730-3BD6-4E52-B262-05758938150C}" = dir=in | app=c:\program files\windows live\sync\windowslivesync.exe | 
"{90F847E0-32E8-471D-98B8-39588140768B}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{930F5CFF-212A-4585-B7BF-38DB54507E98}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{96AC415E-0722-491C-8D4D-4B58BBEA8E7E}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{AA97F84F-3043-40B9-BD2A-EE6FFAE0794E}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{B3E1BC52-6D5D-41AD-A3FE-273944B6A53C}" = protocol=17 | dir=in | app=c:\program files\icq7.0\icq.exe | 
"{BC6C779C-D8F3-4A27-A5A8-BE2AB454D17F}" = protocol=17 | dir=in | app=c:\program files\icq7.0\icq.exe | 
"{BD444F93-C4B7-4569-9C6B-97289EBB0A00}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{BFB7C3AF-4ED9-40AB-8740-3B782EEBC4E5}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{BFD157E4-F1F2-4A76-9BB7-D8AD74D0E50D}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{C31E1EA5-53D2-411F-9093-CFC97D3F1ACB}" = dir=in | app=c:\program files\itunes\itunes.exe | 
"{CB5EB40E-2A2F-4D23-850E-A36FF5F7C497}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{E48B904A-1A8B-40CC-B3F7-AFB665EB304F}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{FA7CB6FA-DAFB-4C3E-AC80-00564AF3C7FA}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"TCP Query User{7B0B0216-A56C-434B-8F09-014CBDCB48B1}C:\program files\icq7.0\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq7.0\icq.exe | 
"TCP Query User{98B722AA-2A50-4D14-B106-F2B3646F45D1}C:\users\public\games\world of warcraft\launcher.exe" = protocol=6 | dir=in | app=c:\users\public\games\world of warcraft\launcher.exe | 
"UDP Query User{8DF30FF0-D68D-4B16-9ABD-2AC7EF0E1FDD}C:\program files\icq7.0\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq7.0\icq.exe | 
"UDP Query User{E8064C10-8379-4520-874D-3AABE5424239}C:\users\public\games\world of warcraft\launcher.exe" = protocol=17 | dir=in | app=c:\users\public\games\world of warcraft\launcher.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{00772F8B-37FF-4704-A47D-72B30BFAF126}" = MPM
"{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{0BC4864E-72C5-472D-8692-0E5971E0BD36}" = BPDSoftware_Ini
"{0D2DBE8A-43D0-7830-7AE7-CA6C99A832E7}" = Adobe Community Help
"{0F3647F8-E51D-4FCC-8862-9A8D0C5ACF25}" = Microsoft_VC80_ATL_x86
"{10829556-7C82-4a83-8C81-F2D98472C76B}" = H470
"{10E1E87C-656C-4D08-86D6-5443D28583BE}" = TrayApp
"{13F00518-807A-4B3A-83B0-A7CD90F3A398}" = MarketResearch
"{192A107E-C6B9-41B9-BDBF-38E3AA226054}" = OpenOffice.org 3.2
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{22466889-7642-488d-AA0E-F619704CF7AB}" = DeviceDiscovery
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java(TM) 6 Update 22
"{29FA38B4-0AE4-4D0D-8A51-6165BB990BB0}" = WebReg
"{2A697B53-0DE3-42DA-B41D-C3F804B1C538}" = iTunes
"{2A981294-F14C-4F0F-9627-D793270922F8}" = Bonjour
"{2CC667CD-2234-4774-A536-2757606A1031}" = Nero 8 Essentials
"{2DC94AFD-A6E2-4AB4-9132-4A3F8E07B386}" = Apple Application Support
"{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform
"{3921A67A-5AB1-4E48-9444-C71814CF3027}" = VCRedistSetup
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{487B0B9B-DCD4-440D-89A0-A6EDE1A545A3}" = HPSSupply
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4A57592C-FF92-4083-97A9-92783BD5AFB4}" = Bison WebCam
"{52B97218-98CB-4B8B-9283-D213C85E1AA4}" = Windows Live Anmelde-Assistent
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{586509F0-350D-48B5-B763-9CC2F8D96C4C}" = Windows Live Sync
"{59046D29-2E6B-4224-BF0D-64F3E7A93F7B}" = LightScribe System Software  1.10.19.1
"{5A15F754-086E-4185-96F4-0BC31F1A2382}" = HP Officejet H470 Series
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86
"{6673E0F4-D376-431b-A6F4-18D1B86B4A89}" = BPDSoftware
"{66E6CE0C-5A1E-430C-B40A-0C90FF1804A8}" = eSupportQFolder
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6B349DE1-590D-4506-B272-9115EC31F7D2}" = 470_Help
"{6F5E2F4A-377D-4700-B0E3-8F7F7507EA15}" = CustomerResearchQFolder
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{774088D4-0777-4D78-904D-E435B318F5D2}" = Microsoft Antimalware
"{7782916E-3D46-4F1F-AC4B-3FB9D17049F4}" = Microsoft Antimalware Service DE-DE Language Pack
"{77A776C4-D10F-416D-88F0-53F2D9DCD9B3}" = Microsoft Security Client
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{84ED5482-CFB0-4DD9-BF18-489FFDACD18A}" = Microsoft Antimalware Service DE-DE Language Pack
"{850C7BD3-9F3F-46AD-9396-E7985B38C55E}" = Windows Live Fotogalerie
"{859B9BCA-5376-4566-9F88-C6C9DAA7A925}" = Microsoft Security Client DE-DE Language Pack
"{88EB38EF-4D2C-436D-ABD3-56B232674062}" = ICQ7
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = ALPS Touch Pad Driver
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A71D5E81-B967-43DB-93D7-FD31BFB95748}" = MobileMe Control Panel
"{A7496F46-78AE-4DB2-BCF5-95F210FA6F96}" = Windows Live Movie Maker
"{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder
"{AC76BA86-7AD7-1031-7B44-A94000000001}" = Adobe Reader 9.4.3 - Deutsch
"{AEA07F97-9088-497c-8821-0F36BD5DC251}" = HPProductAssistant
"{AED2DD42-9853-407E-A6BC-8A1D6B715909}" = Windows Live Messenger
"{B0069CFA-5BB9-4C03-B1C6-89CE290E5AFE}" = HP Update
"{BA72A4E3-D2D0-4203-A17E-E53012B8807C}" = BPD_HPSU
"{BCD6CD1A-0DBE-412E-9F25-3B500D1E6BA1}" = SolutionCenter
"{C73F2967-062E-48F2-A462-D335B8950183}" = Safari
"{CACAEB5F-174D-4C7C-AC56-A33289A807CA}" = Apple Mobile Device Support
"{CAFA57E8-8927-4912-AFCF-B0AA3837E989}" = Windows Live Essentials
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86
"{D2041A37-5FEC-49F0-AE5C-3F2FFDFAA4F4}" = Windows Live Call
"{D642E38E-0D24-486C-9A2D-E316DD696F4B}" = Microsoft XML Parser
"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86
"{DC24971E-1946-445D-8A82-CE685433FA7D}" = Realtek USB 2.0 Card Reader
"{DE3A9DC5-9A5D-6485-9662-347162C7E4CA}" = Adobe Media Player
"{E022C318-BAC9-468D-8731-3C5EE63C7743}" = 470_Readme
"{E2662C24-B31E-4349-A084-32EB76E8B760}" = BufferChm
"{E503B4BF-F7BB-3D5F-8BC8-F694B1CFF942}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022.218
"{E9C18EBD-85BE-47D0-AA73-3FEDCC976B04}" = Toolbox
"{EE5F0136-2C7C-42a7-B1B0-5F12D107A0EE}" = ProductContext
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F1E63043-54FC-429B-AB2C-31AF9FBA4BC7}" = 32 Bit HP CIO Components Installer
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{FD8D8B04-BEAD-4A55-AA1D-62D2373E7DEA}" = Status
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Akamai" = Akamai NetSession Interface
"APU" = CANON iMAGE GATEWAY Album Plugin Utility
"CCleaner" = CCleaner
"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Community Help
"CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_2BFA&SUBSYS_14F10001" = HDAUDIO Soft Data Fax Modem with SmartCP
"com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Media Player
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"DivX Setup.divx.com" = DivX-Setup
"ERUNT_is1" = ERUNT 1.1j
"HP Imaging Device Functions" = HP Imaging Device Functions 9.0
"HP Solution Center & Imaging Support Tools" = HP Solution Center 9.0
"HPExtendedCapabilities" = HP Customer Participation Program 9.0
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Messenger Plus!" = Messenger Plus! 5
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft Security Client" = Microsoft Security Essentials
"Mozilla Firefox (3.6.16)" = Mozilla Firefox (3.6.16)
"NVIDIA Drivers" = NVIDIA Drivers
"Picasa 3" = Picasa 3
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 03.04.2011 15:23:12 | Computer Name = XXX-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
 
Error - 03.04.2011 15:23:12 | Computer Name = XXX-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 193530738
 
Error - 03.04.2011 15:23:12 | Computer Name = XXX-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 193530738
 
Error - 03.04.2011 15:23:13 | Computer Name = XXX-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
 
Error - 03.04.2011 15:23:13 | Computer Name = XXX-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 193531799
 
Error - 03.04.2011 15:23:13 | Computer Name = XXX-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 193531799
 
Error - 03.04.2011 15:23:34 | Computer Name = XXX-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung jaucheck.exe, Version 2.0.2.4, Zeitstempel 0x4bed9a14,
 fehlerhaftes Modul jaucheck.exe, Version 2.0.2.4, Zeitstempel 0x4bed9a14, Ausnahmecode
 0xc0000005, Fehleroffset 0x0000c940,  Prozess-ID 0x1738, Anwendungsstartzeit 01cbf2349466b010.
 
Error - 03.04.2011 17:26:11 | Computer Name = XXX-PC | Source = Application Hang | ID = 1002
Description = Programm Explorer.EXE, Version 6.0.6002.18005 arbeitet nicht mehr 
mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet
 "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen 
über das Problem zu suchen.  Prozess-ID: 1e4  Anfangszeit: 01cbf2441aa8abfe  Zeitpunkt
 der Beendigung: 31
 
Error - 03.04.2011 18:29:48 | Computer Name = XXX-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung svchost.exe, Version 6.0.6001.18000, Zeitstempel
 0x47918b89, fehlerhaftes Modul ntdll.dll, Version 6.0.6002.18327, Zeitstempel 0x4cb73436,
 Ausnahmecode 0xc000071b, Fehleroffset 0x00088d15,  Prozess-ID 0x4c8, Anwendungsstartzeit
 01cbf24cbac3ff04.
 
Error - 03.04.2011 19:20:56 | Computer Name = XXX-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung zwdzzfwr.exe, Version 1.0.15.15570, Zeitstempel
 0x4d86265c, fehlerhaftes Modul zwdzzfwr.exe, Version 1.0.15.15570, Zeitstempel 
0x4d86265c, Ausnahmecode 0xc0000005, Fehleroffset 0x0000c676,  Prozess-ID 0x1494, 
Anwendungsstartzeit 01cbf2559762680b.
 
[ System Events ]
Error - 03.04.2011 17:32:52 | Computer Name = XXX-PC | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am 03.04.2011 um 23:30:57 unerwartet heruntergefahren.
 
Error - 03.04.2011 17:34:19 | Computer Name = XXX-PC | Source = Service Control Manager | ID = 7000
Description = 
 
Error - 03.04.2011 18:11:01 | Computer Name = XXX-PC | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am 04.04.2011 um 00:09:28 unerwartet heruntergefahren.
 
Error - 03.04.2011 18:12:26 | Computer Name = XXX-PC | Source = Service Control Manager | ID = 7000
Description = 
 
Error - 03.04.2011 18:16:02 | Computer Name = XXX-PC | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am 04.04.2011 um 00:14:55 unerwartet heruntergefahren.
 
Error - 03.04.2011 18:17:31 | Computer Name = XXX-PC | Source = Service Control Manager | ID = 7000
Description = 
 
Error - 03.04.2011 18:32:18 | Computer Name = XXX-PC | Source = Service Control Manager | ID = 7000
Description = 
 
Error - 03.04.2011 19:10:38 | Computer Name = XXX-PC | Source = Service Control Manager | ID = 7000
Description = 
 
Error - 03.04.2011 19:31:00 | Computer Name = XXX-PC | Source = Service Control Manager | ID = 7031
Description = 
 
Error - 03.04.2011 19:34:58 | Computer Name = XXX-PC | Source = Service Control Manager | ID = 7000
Description = 
 
 
< End of report >
         

GMER Logfile:

	
	
GMER 1.0.15.15570 - hxxp://www.gmer.net
Rootkit scan 2011-04-04 02:22:16
Windows 6.0.6002 Service Pack 2 Harddisk0\DR0 -> \Device\0000005d WDC_WD32 rev.11.0
Running: g2m3e4r.exe; Driver: C:\Users\XXX~1\AppData\Local\Temp\uflcrkob.sys


---- Kernel code sections - GMER 1.0.15 ----

.text  C:\Windows\system32\DRIVERS\nvlddmkm.sys                                                                                          section is writeable [0x8BC00380, 0x3559E2, 0xE8000020]

---- Registry - GMER 1.0.15 ----

Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{EDD37E20-BC7B-7D98-7A45-C2D5793867DF}                   
Reg    HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{EDD37E20-BC7B-7D98-7A45-C2D5793867DF}@haelllpplkkgcknj  0x6B 0x61 0x6F 0x70 ...

---- EOF - GMER 1.0.15 ----
         
 
 

--- --- ---

Log von HijackThis kann leider nicht erstellt werden, da ein Fehler auftritt. Als Administrator ausführen steht hierbei nicht zur Option.

Bei Windows-Taste + E öffnet sich der Arbeitsplatz, eine Rubrik Extras kann ich nicht finden

Zitat von L9911

Bei Windows-Taste + E öffnet sich der Arbeitsplatz, eine Rubrik Extras kann ich nicht finden

was ..wo meinst?