Mich hat der BKA Virus auch erwischt. Ich habe bereits eine OTL Datei erstellt:

OTL logfile created on: 4/26/2011 11:03:49 PM - Run
OTLPE by OldTimer - Version 3.1.46.0 Folder = X:\Programs\OTLPE
Microsoft Windows XP Service Pack 3 (Version = 5.1.2600) - Type = SYSTEM
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

2.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 87.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 97.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 34.23 Gb Total Space | 2.97 Gb Free Space | 8.68% Space Free | Partition Type: NTFS
Drive D: | 465.53 Gb Total Space | 348.36 Gb Free Space | 74.83% Space Free | Partition Type: FAT32
Drive E: | 338.37 Gb Total Space | 160.94 Gb Free Space | 47.56% Space Free | Partition Type: NTFS
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet001

========== Win32 Services (SafeList) ==========

SRV - File not found [Auto] -- -- (OMSI download service)
SRV - File not found [On_Demand] -- -- (FirebirdServerMAGIXInstance)
SRV - File not found [Auto] -- -- (BlueSoleil Hid Service)
SRV - [2011/03/17 14:24:01 | 000,269,480 | ---- | M] (Avira GmbH) [Auto] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2010/11/09 13:40:36 | 000,135,336 | ---- | M] (Avira GmbH) [Auto] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2009/03/06 18:09:41 | 000,655,624 | ---- | M] (Acresso Software Inc.) [On_Demand] -- C:\Programme\Gemeinsame Dateien\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2009/02/10 12:01:49 | 000,116,104 | ---- | M] () [Auto] -- C:\Programme\Canon\IJPLM\ijplmsvc.exe -- (IJPLMSVC)
SRV - [2008/12/04 15:29:22 | 000,603,904 | ---- | M] (TuneUp Software) [Auto] -- C:\WINDOWS\system32\TUProgSt.exe -- (TuneUp.ProgramStatisticsSvc)
SRV - [2008/12/04 15:29:21 | 000,362,240 | ---- | M] (TuneUp Software) [On_Demand] -- C:\WINDOWS\system32\TuneUpDefragService.exe -- (TuneUp.Defrag)
SRV - [2008/11/24 07:19:54 | 000,027,904 | ---- | M] (TuneUp Software) [Auto] -- C:\WINDOWS\system32\uxtuneup.dll -- (UxTuneUp)
SRV - [2008/04/04 06:34:02 | 000,147,456 | ---- | M] (Saitek) [Auto] -- C:\Programme\Saitek\DirectOutput\DirectOutputService.exe -- (SaiDOutput)
SRV - [2006/02/17 10:26:32 | 000,073,728 | ---- | M] (Hewlett-Packard Company) [Auto] -- C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe -- (LightScribeService)
SRV - [2005/11/13 20:06:04 | 000,069,632 | ---- | M] (Macrovision Corporation) [On_Demand] -- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1150\Intel 32\IDriverT.exe -- (IDriverT)
SRV - [2005/01/31 04:45:20 | 000,049,152 | ---- | M] (Ulead Systems, Inc.) [Auto] -- C:\Programme\Gemeinsame Dateien\Ulead Systems\DVD\ULCDRSvr.exe -- (UleadBurningHelper)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand] -- -- (WDICA)
DRV - File not found [Kernel | On_Demand] -- -- (SetupNTGLM7X)
DRV - File not found [Kernel | On_Demand] -- -- (Ser2pl)
DRV - File not found [Kernel | On_Demand] -- -- (RushTopDevice)
DRV - File not found [Kernel | On_Demand] -- -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand] -- -- (PDRELI)
DRV - File not found [Kernel | On_Demand] -- -- (PDFRAME)
DRV - File not found [Kernel | On_Demand] -- -- (PDCOMP)
DRV - File not found [Kernel | System] -- -- (PCIDump)
DRV - File not found [Kernel | On_Demand] -- -- (NTACCESS)
DRV - File not found [Kernel | On_Demand] -- -- (MSICPL)
DRV - File not found [Kernel | System] -- -- (lbrtfdc)
DRV - File not found [Kernel | System] -- -- (i2omgmt)
DRV - File not found [Kernel | On_Demand] -- -- (GMSIPCI)
DRV - File not found [Kernel | System] -- -- (Changer)
DRV - [2011/03/17 14:24:05 | 000,137,656 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)
DRV - [2010/12/03 13:59:23 | 000,061,960 | ---- | M] (Avira GmbH) [File_System | Auto] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2009/12/19 14:22:01 | 000,104,512 | ---- | M] (SlySoft, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\AnyDVD.sys -- (AnyDVD)
DRV - [2009/06/29 09:14:00 | 000,027,008 | ---- | M] (Cambridge Silicon Radio Ltd.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\csrbcxp.sys -- (CSRBC)
DRV - [2009/06/10 06:23:04 | 000,036,992 | ---- | M] (Saitek) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\SaiBus.sys -- (SaiNtBus)
DRV - [2009/06/10 06:23:04 | 000,014,080 | ---- | M] (Saitek) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\SaiMini.sys -- (SaiMini)
DRV - [2009/05/11 05:12:49 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009/02/13 06:35:01 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\Programme\Avira\AntiVir Desktop\avgio.sys -- (avgio)
DRV - [2008/05/16 06:33:14 | 000,115,752 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\s0016unic.sys -- (s0016unic) Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (WDM)
DRV - [2008/05/16 06:33:14 | 000,025,512 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\s0016nd5.sys -- (s0016nd5) Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (NDIS)
DRV - [2008/05/16 06:33:14 | 000,015,016 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\s0016mdfl.sys -- (s0016mdfl)
DRV - [2008/05/16 06:33:12 | 000,120,744 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\s0016mdm.sys -- (s0016mdm)
DRV - [2008/05/16 06:33:12 | 000,114,216 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\s0016mgmt.sys -- (s0016mgmt) Sony Ericsson Device 0016 USB WMC Device Management Drivers (WDM)
DRV - [2008/05/16 06:33:12 | 000,110,632 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\s0016obex.sys -- (s0016obex)
DRV - [2008/05/16 06:33:12 | 000,089,256 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\s0016bus.sys -- (s0016bus) Sony Ericsson Device 0016 driver (WDM)
DRV - [2008/04/25 09:54:58 | 000,036,384 | ---- | M] (Thesycon GmbH, Germany) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\npusbio.sys -- (npusbio)
DRV - [2008/04/13 14:45:29 | 000,010,624 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\gameenum.sys -- (gameenum)
DRV - [2008/04/04 12:12:04 | 000,136,832 | ---- | M] (Saitek) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\SaiH0762.sys -- (SaiH0762)
DRV - [2008/02/15 10:31:46 | 000,039,472 | ---- | M] (Paragon Software Group) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\hotcore3.sys -- (hotcore3)
DRV - [2008/01/09 05:28:34 | 000,027,632 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\seehcri.sys -- (seehcri)
DRV - [2007/08/23 05:27:02 | 000,053,760 | ---- | M] () [Kernel | System] -- C:\WINDOWS\system32\drivers\SSHDRV76.sys -- (SSHDRV76)
DRV - [2007/03/23 13:51:20 | 000,022,816 | ---- | M] (NaturalPoint) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\npusb.sys -- (NPUSB)
DRV - [2006/11/30 09:14:22 | 000,090,800 | R--- | M] (MCCI) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\se45unic.sys -- (se45unic) Sony Ericsson Device 069 USB Ethernet Emulation SEMC45 (WDM)
DRV - [2006/11/30 09:14:14 | 000,086,432 | R--- | M] (MCCI) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\se45obex.sys -- (se45obex)
DRV - [2006/11/30 09:14:10 | 000,088,624 | R--- | M] (MCCI) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\se45mgmt.sys -- (se45mgmt) Sony Ericsson Device 069 USB WMC Device Management Drivers (WDM)
DRV - [2006/11/30 09:14:10 | 000,018,704 | R--- | M] (MCCI) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\se45nd5.sys -- (se45nd5) Sony Ericsson Device 069 USB Ethernet Emulation SEMC45 (NDIS)
DRV - [2006/11/30 09:14:04 | 000,097,088 | R--- | M] (MCCI) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\se45mdm.sys -- (se45mdm)
DRV - [2006/11/30 09:14:04 | 000,009,360 | R--- | M] (MCCI) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\se45mdfl.sys -- (se45mdfl)
DRV - [2006/11/30 09:13:56 | 000,061,536 | R--- | M] (MCCI) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\se45bus.sys -- (se45bus) Sony Ericsson Device 069 driver (WDM)
DRV - [2006/11/15 09:34:40 | 004,225,920 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\RtkHDAud.Sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2006/11/01 08:42:14 | 000,033,280 | ---- | M] (AMD, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\AmdLLD.sys -- (AmdLLD)
DRV - [2006/08/09 10:40:58 | 000,009,600 | R--- | M] (VMware, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\vmnetadapter.sys -- (VMnetAdapter)
DRV - [2006/04/24 05:52:28 | 000,100,736 | R--- | M] (NVIDIA Corporation) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\nvata.sys -- (nvata)
DRV - [2006/03/22 02:24:02 | 000,018,944 | R--- | M] (NVIDIA Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\nvnetbus.sys -- (nvnetbus)
DRV - [2006/03/22 02:24:00 | 000,052,736 | R--- | M] (NVIDIA Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\NVENETFD.sys -- (NVENETFD)
DRV - [2005/08/31 05:34:52 | 000,020,480 | ---- | M] (IVT Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\BlueletSCOAudio.sys -- (BlueletSCOAudio)
DRV - [2005/08/31 05:34:10 | 000,020,480 | ---- | M] (IVT Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\blueletaudio.sys -- (BlueletAudio)
DRV - [2005/07/29 11:26:54 | 000,023,000 | ---- | M] (IVT Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\btcusb.sys -- (Btcsrusb)
DRV - [2005/07/29 11:21:32 | 000,011,988 | ---- | M] () [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\vbtenum.sys -- (BTHidEnum)
DRV - [2005/04/30 09:50:10 | 000,028,271 | ---- | M] (IVT Corporation) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\BTHidMgr.sys -- (BTHidMgr)
DRV - [2005/04/30 09:48:58 | 000,010,804 | ---- | M] (IVT Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\BtNetDrv.sys -- (BT)
DRV - [2005/04/12 13:21:32 | 000,022,240 | ---- | M] (Logitech Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\WmFilter.sys -- (WmFilter)
DRV - [2005/04/12 13:21:32 | 000,017,632 | ---- | M] (Logitech Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\WmHidLo.sys -- (WmHidLo)
DRV - [2005/04/12 13:21:28 | 000,010,144 | ---- | M] (Logitech Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\WmBEnum.sys -- (WmBEnum)
DRV - [2005/04/12 13:21:28 | 000,005,600 | ---- | M] (Logitech Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\WmVirHid.sys -- (WmVirHid)
DRV - [2005/04/12 13:21:26 | 000,045,504 | ---- | M] (Logitech Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\WmXlCore.sys -- (WmXlCore)
DRV - [2005/03/25 12:18:48 | 000,082,148 | ---- | M] (IVT Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\VcommMgr.sys -- (VcommMgr)
DRV - [2005/03/09 02:53:00 | 000,036,352 | R--- | M] (Advanced Micro Devices) [Kernel | System] -- C:\WINDOWS\system32\drivers\AmdK8.sys -- (AmdK8)
DRV - [2004/12/16 11:32:54 | 000,013,304 | ---- | M] () [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\BTNetFilter.sys -- (BTNetFilter)
DRV - [2004/10/19 08:37:38 | 000,061,312 | ---- | M] (IVT Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\VComm.sys -- (VComm)
DRV - [2004/08/23 07:55:54 | 000,029,440 | ---- | M] (Siemens AG) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\actser.sys -- (actser)
DRV - [2004/04/30 03:37:02 | 000,160,640 | ---- | M] ( ) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\a347bus.sys -- (a347bus)
DRV - [2004/04/30 03:33:00 | 000,005,248 | ---- | M] ( ) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\a347scsi.sys -- (a347scsi)
DRV - [2004/02/06 16:40:02 | 000,012,160 | ---- | M] (Dhauzimmer) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\P8000f.sys -- (P8000f)
DRV - [2001/11/29 04:45:26 | 000,214,368 | R--- | M] (Divio Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\pcam800.sys -- (DCamUSBNW800)
DRV - [2001/08/17 09:02:32 | 000,008,576 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\hidgame.sys -- (hidgame)
DRV - [2001/08/17 08:51:32 | 000,018,688 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\irsir.sys -- (irsir)
DRV - [2001/08/17 07:19:34 | 000,040,704 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\es1371mp.sys -- (es1371) Creative AudioPCI (ES1371,ES1373) (WDM)
DRV - [2001/08/17 07:14:24 | 000,444,416 | ---- | M] (AVM GmbH) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\fpcibase.sys -- (fpcibase)
DRV - [2001/08/17 07:13:48 | 000,037,568 | ---- | M] (AVM GmbH) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\avmwan.sys -- (AVMWAN)
DRV - [1998/08/06 19:00:00 | 000,069,840 | ---- | M] (AVM Berlin) [Kernel | Auto] -- C:\WINDOWS\System32\drivers\avmport.sys -- (AVMPORT)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========



IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\IceTea_ON_C\Software\Microsoft\Internet Explorer\Main,AlwaysUseDefaultPrinter =
IE - HKU\IceTea_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0






Hosts file not found
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - File not found
O2 - BHO: (bho2gr Class) - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - File not found
O2 - BHO: (Canon Easy-WebPrint EX BHO) - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Programme\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll (Google Inc.)
O2 - BHO: (PDFCreator Toolbar Helper) - {C451C08A-EC37-45DF-AAAD-18B51AB5E837} - C:\Programme\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll ()
O3 - HKLM\..\Toolbar: (PDFCreator Toolbar) - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Programme\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll ()
O3 - HKLM\..\Toolbar: (Canon Easy-WebPrint EX) - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Programme\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
O3 - HKU\IceTea_ON_C\..\Toolbar\WebBrowser: (PDFCreator Toolbar) - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Programme\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll ()
O3 - HKU\IceTea_ON_C\..\Toolbar\WebBrowser: (Canon Easy-WebPrint EX) - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Programme\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\Alcmtr.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [amd_dc_opt] C:\Programme\AMD\Dual-Core Optimizer\amd_dc_opt.exe (AMD)
O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [BluetoothAuthenticationAgent] C:\WINDOWS\System32\bthprops.cpl (Microsoft Corporation)
O4 - HKLM..\Run: [CanonMyPrinter] C:\Programme\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)
O4 - HKLM..\Run: [CanonSolutionMenu] C:\Programme\Canon\SolutionMenu\CNSLMAIN.exe (CANON INC.)
O4 - HKLM..\Run: [IJNetworkScanUtility] C:\Programme\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe (CANON INC.)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()
O4 - HKLM..\Run: [ProfilerU] C:\Programme\Saitek\SD6\Software\ProfilerU.exe (Saitek)
O4 - HKLM..\Run: [QuickTime Task] File not found
O4 - HKLM..\Run: [SaiMfd] C:\Programme\Saitek\SD6\Software\SaiMfd.exe (Saitek)
O4 - HKU\IceTea_ON_C..\Run: [4E3E0230AEBB4E96] C:\Recycle.Bin\Recycle.Bin.exe (Macromedia, Inc.)
O4 - HKU\IceTea_ON_C..\Run: [AnyDVD] File not found
O4 - HKU\IceTea_ON_C..\Run: [H/PC Connection Agent] File not found
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\BlueSoleil.lnk = File not found
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Logitech Desktop Messenger.lnk = C:\Programme\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe (Logitech Inc.)
O4 - Startup: C:\Dokumente und Einstellungen\IceTea\Startmenü\Programme\Autostart\DCS.bat ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\IceTea_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\LocalService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\NetworkService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra Button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - File not found
O9 - Extra 'Tools' menuitem : Mobilen Favoriten erstellen... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - File not found
O9 - Extra Button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - File not found
O9 - Extra 'Tools' menuitem : PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - File not found
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Reg Error: Key error.)
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab (System Requirements Lab Class)
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} hxxp://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst20040510.cab (YInstStarter Class)
O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} hxxp://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.4.1.cab (DLM Control)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1164491273796 (MUWebControl Class)
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} hxxp://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab (NVIDIA Smart Scan)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab (Java Plug-in 1.6.0_12)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {A922B6AB-3B87-11D3-B3C2-0008C7DA6CB9} hxxp://www.moviegroup.tv/activex/DownloadMgr.cab (InetDownload Class)
O16 - DPF: {CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_09-windows-i586.cab (Java Plug-in 1.5.0_09)
O16 - DPF: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab (Java Plug-in 1.6.0_12)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab (Java Plug-in 1.6.0_12)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O18 - Protocol\Handler\bwfile-8876480 {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll (Logitech Inc.)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mctp {d7b95390-b1c5-11d0-b111-0080c712fe82} - Reg Error: Key error. File not found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (C:\DOKUME~1\IceTea\LOKALE~1\Temp\1zu5iwsz.exe) - C:\Dokumente und Einstellungen\IceTea\Lokale Einstellungen\Temp\1zu5iwsz.exe ()
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/11/23 11:13:03 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O33 - MountPoints2\{ba57198e-8acb-11df-8ea1-001617bf0c25}\Shell\AutoRun\command - "" = H:\Menu.exe
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/04/26 12:18:32 | 000,143,360 | ---- | C] (Macromedia, Inc.) -- C:\WINDOWS\System32\null0.20446400493806582.exe
[2011/04/26 12:05:39 | 000,000,000 | R--D | C] -- C:\Dokumente und Einstellungen\NetworkService\Favoriten
[2011/04/26 12:05:35 | 000,143,360 | ---- | C] (Macromedia, Inc.) -- C:\WINDOWS\System32\null0.5873088251353679.exe
[2011/04/26 12:05:35 | 000,143,360 | ---- | C] (Macromedia, Inc.) -- C:\WINDOWS\System32\null0.5126565617414302.exe
[2011/04/26 12:05:23 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\NetworkService\Lokale Einstellungen\Anwendungsdaten\Adobe
[2011/04/26 12:05:10 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\NetworkService\Anwendungsdaten\Macromedia
[2011/04/26 12:05:08 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\NetworkService\Anwendungsdaten\Adobe
[2011/04/26 12:04:21 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\NetworkService\Anwendungsdaten\Sun
[2009/08/29 06:45:56 | 000,148,736 | ---- | C] (Avanquest Software) -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\hpeE.dll
[2007/05/18 07:33:23 | 000,160,640 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\a347bus.sys
[2007/05/18 07:33:23 | 000,005,248 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\a347scsi.sys
[2004/11/24 15:25:52 | 000,335,872 | ---- | C] ( ) -- C:\WINDOWS\System32\drvc.dll
[6 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/04/26 12:56:53 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011/04/26 12:33:59 | 000,013,762 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011/04/26 12:30:33 | 000,097,792 | ---- | M] () -- C:\Dokumente und Einstellungen\IceTea\Desktop\null0.29003917652426414.exe
[2011/04/26 12:23:00 | 000,001,088 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/04/26 12:18:32 | 000,143,360 | ---- | M] (Macromedia, Inc.) -- C:\WINDOWS\System32\null0.20446400493806582.exe
[2011/04/26 12:05:37 | 000,143,360 | ---- | M] (Macromedia, Inc.) -- C:\WINDOWS\System32\null0.5873088251353679.exe
[2011/04/26 12:05:36 | 000,143,360 | ---- | M] (Macromedia, Inc.) -- C:\WINDOWS\System32\null0.5126565617414302.exe
[2011/04/26 12:04:21 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2011/04/26 12:00:01 | 000,000,494 | ---- | M] () -- C:\WINDOWS\tasks\1-Klick-Wartung.job
[2011/04/26 11:56:00 | 000,196,795 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml
[2011/04/24 13:53:43 | 000,025,598 | ---- | M] () -- C:\WINDOWS\cdplayer.ini
[2011/04/23 13:23:00 | 000,001,084 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/04/23 06:10:45 | 000,002,479 | ---- | M] () -- C:\Dokumente und Einstellungen\IceTea\Desktop\Microsoft Outlook.lnk
[2011/04/15 12:27:49 | 002,566,664 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2011/04/15 11:35:25 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2011/04/15 11:34:48 | 000,459,588 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat
[2011/04/15 11:34:48 | 000,441,696 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2011/04/15 11:34:48 | 000,084,966 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat
[2011/04/15 11:34:48 | 000,071,632 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[6 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/04/26 12:30:32 | 000,097,792 | ---- | C] () -- C:\Dokumente und Einstellungen\IceTea\Desktop\null0.29003917652426414.exe
[2011/04/26 12:04:21 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2011/02/19 11:52:50 | 001,060,864 | ---- | C] () -- C:\WINDOWS\System32\vorbis.dll
[2011/02/19 11:52:50 | 000,909,312 | ---- | C] () -- C:\WINDOWS\System32\vorbisenc.dll
[2011/02/19 11:52:50 | 000,544,256 | ---- | C] () -- C:\WINDOWS\System32\janGraphics.dll
[2011/02/19 11:52:50 | 000,454,656 | ---- | C] () -- C:\WINDOWS\System32\PaintX.dll
[2011/02/19 11:52:50 | 000,182,784 | ---- | C] () -- C:\WINDOWS\System32\DGVorbis.dll
[2011/02/19 11:52:50 | 000,118,784 | ---- | C] () -- C:\WINDOWS\System32\MP3DEE.DLL
[2011/02/19 11:52:50 | 000,036,864 | ---- | C] () -- C:\WINDOWS\System32\ogg.dll
[2011/02/19 11:52:49 | 000,029,184 | ---- | C] () -- C:\WINDOWS\System32\kwab.dll
[2011/01/02 14:35:37 | 000,000,940 | ---- | C] () -- C:\Dokumente und Einstellungen\IceTea\.recently-used.xbel
[2010/12/27 14:53:15 | 000,155,648 | ---- | C] () -- C:\WINDOWS\System32\nY.exe
[2010/12/27 14:49:40 | 000,851,968 | ---- | C] () -- C:\WINDOWS\System32\SaiC0762.Dll
[2010/12/27 14:49:40 | 000,008,704 | ---- | C] () -- C:\WINDOWS\System32\SaiC0762_0C.dll
[2010/12/27 14:49:40 | 000,008,192 | ---- | C] () -- C:\WINDOWS\System32\SaiC0762_10.dll
[2010/12/27 14:49:40 | 000,008,192 | ---- | C] () -- C:\WINDOWS\System32\SaiC0762_0A.dll
[2010/12/27 14:49:40 | 000,008,192 | ---- | C] () -- C:\WINDOWS\System32\SaiC0762_07.dll
[2010/12/27 14:49:40 | 000,007,680 | ---- | C] () -- C:\WINDOWS\System32\SaiC0762_09.dll
[2010/12/27 14:49:40 | 000,007,168 | ---- | C] () -- C:\WINDOWS\System32\SaiC0762_0402.dll
[2010/12/27 14:49:40 | 000,005,632 | ---- | C] () -- C:\WINDOWS\System32\SaiC0762_11.dll
[2010/12/05 09:39:02 | 000,175,104 | ---- | C] () -- C:\WINDOWS\System32\lame_enc.dll
[2010/11/08 13:34:50 | 000,039,095 | ---- | C] () -- C:\WINDOWS\iccsigs.dat
[2010/10/20 14:25:31 | 000,080,896 | ---- | C] () -- C:\WINDOWS\cadkasdeinst01.exe
[2010/09/09 09:52:11 | 000,045,400 | ---- | C] () -- C:\Dokumente und Einstellungen\IceTea\Anwendungsdaten\mdbu.bin
[2010/08/07 12:07:27 | 000,000,029 | ---- | C] () -- C:\WINDOWS\Battle.ini
[2010/07/04 09:40:24 | 000,000,021 | ---- | C] () -- C:\WINDOWS\progman.ini
[2010/06/11 04:57:08 | 000,024,456 | ---- | C] () -- C:\WINDOWS\System32\TALDM32A.dll
[2010/06/11 04:57:06 | 000,052,616 | ---- | C] () -- C:\WINDOWS\System32\TAL12832.DLL
[2010/06/11 04:57:06 | 000,022,920 | ---- | C] () -- C:\WINDOWS\System32\TALDM32.DLL
[2010/06/11 04:56:58 | 000,255,368 | ---- | C] () -- C:\WINDOWS\System32\SBSPAIN3.DLL
[2010/06/11 04:56:54 | 000,075,656 | ---- | C] () -- C:\WINDOWS\System32\ENCODE32.DLL
[2010/03/19 09:27:23 | 000,000,112 | ---- | C] () -- C:\Dokumente und Einstellungen\IceTea\Mediaport.conf
[2009/01/14 12:29:42 | 000,000,958 | ---- | C] () -- C:\Dokumente und Einstellungen\IceTea\desinstart.bat
[2009/01/14 12:29:42 | 000,000,665 | ---- | C] () -- C:\Dokumente und Einstellungen\IceTea\desinst.bat
[2009/01/14 12:29:42 | 000,000,612 | ---- | C] () -- C:\Dokumente und Einstellungen\IceTea\dialogysMPFuser.prf
[2009/01/14 12:29:42 | 000,000,189 | ---- | C] () -- C:\Dokumente und Einstellungen\IceTea\save_uninst.bat
[2009/01/14 12:29:42 | 000,000,185 | ---- | C] () -- C:\Dokumente und Einstellungen\IceTea\dialogysClip.prf
[2009/01/14 12:29:42 | 000,000,130 | ---- | C] () -- C:\Dokumente und Einstellungen\IceTea\dialogysInstall.prf
[2009/01/03 15:50:59 | 000,000,008 | ---- | C] () -- C:\WINDOWS\System32\nvModes.dat
[2008/11/30 17:09:28 | 000,003,972 | ---- | C] () -- C:\WINDOWS\System32\drivers\PciBus.sys
[2008/10/02 14:37:48 | 000,014,852 | ---- | C] () -- C:\Programme\settings.dat
[2008/07/09 12:23:10 | 000,042,296 | ---- | C] () -- C:\WINDOWS\System32\SBSPAINT.DLL
[2008/07/09 12:23:06 | 000,050,488 | ---- | C] () -- C:\WINDOWS\System32\SBSPAIN2.DLL
[2008/05/18 08:25:27 | 000,000,320 | ---- | C] () -- C:\WINDOWS\game.ini
[2008/05/18 07:00:35 | 004,244,744 | ---- | C] () -- C:\WINDOWS\System32\qtp-mt334.dll
[2008/05/18 07:00:35 | 000,247,560 | ---- | C] () -- C:\WINDOWS\System32\prgiso.dll
[2008/05/18 07:00:35 | 000,013,576 | ---- | C] () -- C:\WINDOWS\System32\wnaspi32.dll
[2008/02/03 13:13:08 | 000,003,536 | ---- | C] () -- C:\WINDOWS\nero.INI
[2008/02/02 14:09:20 | 000,000,107 | ---- | C] () -- C:\WINDOWS\IfoEdit.INI
[2008/01/31 14:46:52 | 000,002,508 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\$_hpcst$.hpc
[2007/11/02 05:24:57 | 000,069,632 | R--- | C] () -- C:\WINDOWS\System32\xmltok.dll
[2007/11/02 05:24:57 | 000,036,864 | R--- | C] () -- C:\WINDOWS\System32\xmlparse.dll
[2007/11/02 05:24:32 | 000,185,344 | ---- | C] () -- C:\WINDOWS\patchw32.dll
[2007/10/13 12:51:54 | 000,036,864 | R--- | C] () -- C:\WINDOWS\jpgl.dll
[2007/10/13 12:51:54 | 000,032,768 | R--- | C] () -- C:\WINDOWS\div_iyuv.dll
[2007/09/17 16:03:00 | 000,038,332 | ---- | C] () -- C:\Dokumente und Einstellungen\IceTea\Anwendungsdaten\Microsoft Excel.ADR
[2007/09/17 14:59:16 | 000,000,000 | ---- | C] () -- C:\WINDOWS\mngui.INI
[2007/09/17 12:08:00 | 000,000,041 | ---- | C] () -- C:\WINDOWS\pos.ini
[2007/09/12 09:01:40 | 000,003,063 | ---- | C] () -- C:\WINDOWS\tm.ini
[2007/09/12 08:11:36 | 000,000,516 | ---- | C] () -- C:\WINDOWS\wiso.ini
[2007/09/12 08:06:58 | 000,000,276 | ---- | C] () -- C:\WINDOWS\BUHL.INI
[2007/08/23 05:27:02 | 000,053,760 | ---- | C] () -- C:\WINDOWS\System32\drivers\SSHDRV76.sys
[2007/07/28 08:58:30 | 000,006,537 | ---- | C] () -- C:\WINDOWS\mgxoschk.ini
[2007/06/16 08:49:16 | 000,188,416 | ---- | C] () -- C:\WINDOWS\AppTextG.dll
[2007/04/29 06:55:48 | 000,025,598 | ---- | C] () -- C:\WINDOWS\cdplayer.ini
[2007/04/04 11:46:36 | 000,000,952 | ---- | C] () -- C:\WINDOWS\uninstall_RG3.ini
[2007/03/27 12:40:35 | 000,000,061 | -HS- | C] () -- C:\WINDOWS\cnerolf.dat
[2007/03/17 05:47:05 | 000,180,224 | ---- | C] () -- C:\WINDOWS\System32\mrvtcl.dll
[2007/03/17 05:46:54 | 000,001,397 | ---- | C] () -- C:\WINDOWS\SimView.ini
[2007/03/17 05:46:54 | 000,000,107 | ---- | C] () -- C:\WINDOWS\Jeppesen.ini
[2007/03/10 06:00:14 | 000,108,032 | ---- | C] () -- C:\WINDOWS\System32\sh33w32.dll
[2007/02/07 17:23:32 | 000,002,528 | ---- | C] () -- C:\Dokumente und Einstellungen\IceTea\Anwendungsdaten\$_hpcst$.hpc
[2007/01/11 14:32:25 | 000,000,043 | -HS- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\.zreglib
[2007/01/03 13:56:56 | 000,037,376 | ---- | C] () -- C:\Dokumente und Einstellungen\IceTea\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2006/12/15 13:25:21 | 000,000,029 | ---- | C] () -- C:\Dokumente und Einstellungen\IceTea\B50LOAD.DAT
[2006/12/02 15:18:45 | 000,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2006/12/02 12:55:41 | 000,000,001 | ---- | C] () -- C:\WINDOWS\System32\SI.bin
[2006/12/02 06:35:33 | 000,040,960 | ---- | C] () -- C:\Programme\Uninstall_CDS.exe
[2006/12/02 06:14:33 | 000,000,125 | -HS- | C] () -- C:\Dokumente und Einstellungen\IceTea\Anwendungsdaten\.zreglib
[2006/11/29 12:51:56 | 000,000,139 | ---- | C] () -- C:\Dokumente und Einstellungen\IceTea\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat
[2006/11/25 11:45:24 | 000,373,248 | ---- | C] () -- C:\WINDOWS\EyeCand3.INI
[2006/11/25 11:34:00 | 000,026,112 | R--- | C] () -- C:\WINDOWS\RunUnDrv.exe
[2006/11/25 10:00:54 | 000,024,576 | ---- | C] () -- C:\WINDOWS\System32\TelPort.dll
[2006/11/25 09:49:59 | 000,283,648 | ---- | C] () -- C:\WINDOWS\unin0407.exe
[2006/11/24 10:28:14 | 000,049,152 | ---- | C] () -- C:\WINDOWS\System32\ChCfg.exe
[2006/11/23 18:43:05 | 000,217,088 | ---- | C] () -- C:\WINDOWS\NVGfxOgl.dll
[2006/11/23 15:51:46 | 000,006,702 | ---- | C] () -- C:\WINDOWS\System32\drivers\FlashSys.sys
[2006/11/23 15:24:26 | 000,006,656 | ---- | C] () -- C:\WINDOWS\System32\CNMVS5m.DLL
[2006/11/23 13:22:45 | 000,000,400 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2006/11/23 12:02:58 | 000,000,305 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\addr_file.html
[2006/11/23 11:37:24 | 000,000,000 | ---- | C] () -- C:\WINDOWS\msicpl.ini
[2006/11/23 11:22:45 | 000,200,704 | R--- | C] () -- C:\WINDOWS\System32\WinSys.exe
[2006/11/23 11:22:45 | 000,069,632 | R--- | C] () -- C:\WINDOWS\System32\sw24.exe
[2006/11/23 11:22:45 | 000,009,728 | R--- | C] () -- C:\WINDOWS\System32\sysinfoX64.sys
[2006/11/23 11:22:45 | 000,008,192 | R--- | C] () -- C:\WINDOWS\System32\sysinfo.sys
[2006/11/23 11:22:44 | 000,208,896 | R--- | C] () -- C:\WINDOWS\System32\sw20.exe
[2006/11/23 11:14:58 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2006/11/23 11:10:33 | 000,021,740 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2006/11/23 11:01:06 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2006/11/23 11:00:05 | 002,566,664 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2006/11/02 12:10:16 | 000,080,912 | ---- | C] () -- C:\WINDOWS\System32\sherlock2.exe
[2006/10/28 14:10:44 | 000,016,384 | ---- | C] () -- C:\WINDOWS\System32\ac3config.exe
[2006/08/08 02:54:00 | 001,703,936 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll
[2006/08/08 02:54:00 | 001,630,208 | ---- | C] () -- C:\WINDOWS\System32\nwiz.exe
[2006/08/08 02:54:00 | 001,486,848 | ---- | C] () -- C:\WINDOWS\System32\nview.dll
[2006/08/08 02:54:00 | 001,339,392 | ---- | C] () -- C:\WINDOWS\System32\nvdspsch.exe
[2006/08/08 02:54:00 | 001,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll
[2006/08/08 02:54:00 | 000,581,632 | ---- | C] () -- C:\WINDOWS\System32\nvhwvid.dll
[2006/08/08 02:54:00 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll
[2006/08/08 02:54:00 | 000,442,368 | ---- | C] () -- C:\WINDOWS\System32\nvappbar.exe
[2006/08/08 02:54:00 | 000,425,984 | ---- | C] () -- C:\WINDOWS\System32\keystone.exe
[2006/08/08 02:54:00 | 000,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll
[2006/02/28 08:00:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2006/02/28 08:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2006/02/28 08:00:00 | 000,459,588 | ---- | C] () -- C:\WINDOWS\System32\perfh007.dat
[2006/02/28 08:00:00 | 000,441,696 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2006/02/28 08:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2006/02/28 08:00:00 | 000,269,480 | ---- | C] () -- C:\WINDOWS\System32\perfi007.dat
[2006/02/28 08:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2006/02/28 08:00:00 | 000,084,966 | ---- | C] () -- C:\WINDOWS\System32\perfc007.dat
[2006/02/28 08:00:00 | 000,071,632 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2006/02/28 08:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2006/02/28 08:00:00 | 000,034,478 | ---- | C] () -- C:\WINDOWS\System32\perfd007.dat
[2006/02/28 08:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2006/02/28 08:00:00 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2006/02/28 08:00:00 | 000,004,461 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2006/02/28 08:00:00 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
[2006/02/28 08:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2005/07/29 11:21:32 | 000,011,988 | ---- | C] () -- C:\WINDOWS\System32\drivers\vbtenum.sys
[2004/12/16 11:32:54 | 000,013,304 | ---- | C] () -- C:\WINDOWS\System32\drivers\BTNetFilter.sys
[2004/10/12 02:40:58 | 002,255,360 | ---- | C] () -- C:\WINDOWS\System32\libavcodec.dll
[2004/10/12 02:39:48 | 000,028,160 | ---- | C] () -- C:\WINDOWS\System32\ff_wmv9.dll
[2004/10/12 02:39:08 | 000,110,592 | ---- | C] () -- C:\WINDOWS\System32\ff_theora.dll
[2004/10/09 02:40:16 | 000,454,144 | ---- | C] () -- C:\WINDOWS\System32\ff_x264.dll
[2004/10/05 04:16:08 | 000,395,776 | ---- | C] () -- C:\WINDOWS\System32\libmplayer.dll
[2004/10/03 13:50:54 | 000,129,024 | ---- | C] () -- C:\WINDOWS\System32\ff_mpeg2enc.dll
[2004/07/11 15:41:53 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\zlib.dll
[2004/07/11 15:41:52 | 000,094,208 | ---- | C] () -- C:\WINDOWS\System32\vbpng.dll
[2002/09/17 19:45:00 | 000,119,808 | ---- | C] () -- C:\WINDOWS\lsb_un20.exe

========== LOP Check ==========

[2009/02/17 17:18:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\IceTea\Anwendungsdaten\Azureus
[2011/02/16 20:36:05 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\IceTea\Anwendungsdaten\BitTorrent
[2008/09/07 14:05:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\IceTea\Anwendungsdaten\Buhl Data Service
[2010/10/20 14:25:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\IceTea\Anwendungsdaten\CAD-KAS
[2010/08/14 12:08:51 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\IceTea\Anwendungsdaten\Cambridge Silicon Radio
[2010/12/13 15:56:33 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\IceTea\Anwendungsdaten\Canon
[2010/12/03 14:34:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\IceTea\Anwendungsdaten\Canon Easy-WebPrint EX
[2007/09/12 13:59:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\IceTea\Anwendungsdaten\CD-LabelPrint
[2009/12/08 10:37:29 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\IceTea\Anwendungsdaten\Desktopicon
[2011/03/05 12:44:36 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\IceTea\Anwendungsdaten\Dropbox
[2006/12/02 06:20:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\IceTea\Anwendungsdaten\Elaborate Bytes
[2011/02/28 16:04:05 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\IceTea\Anwendungsdaten\Elsay
[2010/01/04 15:02:38 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\IceTea\Anwendungsdaten\FileZilla
[2010/02/10 16:26:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\IceTea\Anwendungsdaten\FRITZ!
[2010/02/16 10:54:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\IceTea\Anwendungsdaten\FRITZ!fax für FRITZ!Box
[2007/01/02 09:18:49 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\IceTea\Anwendungsdaten\GetRightToGo
[2009/09/30 15:12:07 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\IceTea\Anwendungsdaten\GoPal Assistant
[2010/10/20 14:41:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\IceTea\Anwendungsdaten\gtk-2.0
[2010/07/04 09:40:08 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\IceTea\Anwendungsdaten\HaCon
[2007/07/28 09:30:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\IceTea\Anwendungsdaten\MAGIX
[2008/02/26 14:34:01 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\IceTea\Anwendungsdaten\Mobile Master
[2008/12/27 06:02:49 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\IceTea\Anwendungsdaten\Mp3tag
[2008/12/28 15:06:22 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\IceTea\Anwendungsdaten\MrJobs
[2011/01/05 14:46:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\IceTea\Anwendungsdaten\MyPhoneExplorer
[2009/01/03 08:56:26 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\IceTea\Anwendungsdaten\Notepad++
[2006/12/02 06:15:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\IceTea\Anwendungsdaten\SlySoft
[2007/09/17 14:56:45 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\IceTea\Anwendungsdaten\Teleca
[2010/11/24 17:31:33 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\IceTea\Anwendungsdaten\TS3Client
[2006/11/25 13:36:22 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\IceTea\Anwendungsdaten\TuneUp Software
[2007/11/02 05:24:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\IceTea\Anwendungsdaten\ubi.com
[2008/02/05 12:11:38 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\IceTea\Anwendungsdaten\Ulead Systems
[2011/03/02 15:12:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\IceTea\Anwendungsdaten\Umonyk
[2008/05/17 12:52:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\IceTea\Anwendungsdaten\XCPCSync.OEM
[2010/10/30 07:47:59 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\FRITZ!
[2010/09/09 09:27:05 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Aldi Sued Fotoservice
[2010/02/06 07:53:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Bluetooth
[2008/09/07 14:05:16 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Buhl Data Service GmbH
[2010/12/03 14:29:51 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CanonBJ
[2011/01/26 15:03:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CanonIJ
[2010/12/03 14:51:46 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CanonIJEGV
[2010/12/13 16:31:35 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CanonIJEPPEX
[2010/12/05 14:50:15 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CanonIJMyPrinter
[2011/04/15 10:44:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CanonIJPLM
[2010/12/13 15:58:30 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CanonIJScan
[2010/12/05 14:50:19 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CanonIJSolutionMenu
[2007/01/18 13:49:26 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Elaborate Bytes
[2010/07/04 09:40:08 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\HaCon
[2010/02/16 10:54:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ISDNWatch
[2007/07/28 09:00:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\MAGIX
[2010/12/29 16:43:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Saitek
[2007/04/13 08:16:38 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SlySoft
[2008/02/05 12:08:45 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SmartSound Software Inc
[2010/09/09 08:53:38 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\STAMPIT
[2011/02/16 16:41:29 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP
[2006/11/25 13:35:16 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TuneUp Software
[2008/02/05 12:11:36 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Ulead Systems
[2007/03/22 14:04:22 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\WinZip
[2010/01/05 11:14:13 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\WOP
[2008/12/04 15:28:56 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{55A29068-F2CE-456C-9148-C869879E2357}
[2011/04/26 12:00:01 | 000,000,494 | ---- | M] () -- C:\WINDOWS\Tasks\1-Klick-Wartung.job

========== Purity Check ==========



========== Alternate Data Streams ==========

@Alternate Data Stream - 24 bytes -> C:\WINDOWS:E72A738A8FCD6DE6
@Alternate Data Stream - 229 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:8FF81EB0
@Alternate Data Stream - 164 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:A5B56640
< End of report >

Ich hoffe Ihr koennt mir helfen und sage schon mal vielen Dank.

auf deinem zweiten pc gehe auf start, programme zubehör editor, kopiere dort rein:

:OTL
O4 - HKU\IceTea_ON_C..\Run: [4E3E0230AEBB4E96] C:\Recycle.Bin\Recycle.Bin.exe (Macromedia, Inc.)
O20 - HKLM Winlogon: Shell - (C:\DOKUME~1\IceTea\LOKALE~1\Temp\1zu5iwsz.exe) - C:\Dokumente und Einstellungen\IceTea\Lokale Einstellungen\Temp\1zu5iwsz.exe
()
:Files
C:\Recycle.Bin
C:\Dokumente und Einstellungen\IceTea\Lokale Einstellungen\Temp\1zu5iwsz.exe
:Commands
[purity]
[EMPTYFLASH] 
[emptytemp]
[Reboot]
         

dieses speicherst du auf nem usb stick als fix.txt
nutze nun wieder OTLPENet.exe (starte also von der erstellten cd) und hake alles an, wie es bereits in meinem post zu OTLPENet.exe beschrieben ist.
• Klicke nun bitte auf den Fix Button.
es sollte nun eine meldung ähnlich dieser: "load fix from file" erscheinen, lade also die fix.txt von deinem stick.
wenn dies nicht funktioniert, bitte den fix manuell eintragen.
dann klicke erneut den fix buton. pc startet evtl. neu. wenn ja, nimm die cd aus dem laufwerk, windows sollte nun normal starten und die otl.txt öffnen,
log posten bitte.

öffne arbeitsplatz, öffne C: dann _OTL
dort rechtsklick auf moved files
wähle zu moved files.rar oder zip hinzufügen.
http://www.trojaner-board.de/54791-a...ner-board.html

Soweit hat alles geklappt. Nur den Upload vom moved rar file sehe ich hier nirgendwo.
Darum nur zur Sicherheit der OTL Text:

========== OTL ==========
Registry value HKEY_USERS\IceTea_ON_C\Software\Microsoft\Windows\CurrentVersion\Run\\4E3E0230AEBB4E96 deleted successfully.
C:\Recycle.Bin\Recycle.Bin.exe moved successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell:C:\DOKUME~1\IceTea\LOKALE~1\Temp\1zu5iwsz.exe deleted successfully.
C:\Dokumente und Einstellungen\IceTea\Lokale Einstellungen\Temp\1zu5iwsz.exe moved successfully.
========== FILES ==========
C:\Recycle.Bin folder moved successfully.
File\Folder C:\Dokumente und Einstellungen\IceTea\Lokale Einstellungen\Temp\1zu5iwsz.exe not found.
========== COMMANDS ==========

[EMPTYFLASH]

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 41 bytes

User: IceTea
->Temp folder emptied: 6344231 bytes
->Temporary Internet Files folder emptied: 478768233 bytes
->Java cache emptied: 104371225 bytes
->Flash cache emptied: 148357 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 354616 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 837431 bytes
->Java cache emptied: 9900 bytes
->Flash cache emptied: 456 bytes

Total Flash Files Cleaned = 563.00 mb


[EMPTYTEMP]

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: IceTea
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 15068937 bytes
%systemroot%\System32 .tmp files removed: 4397959 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 2712164 bytes

Total Files Cleaned = 21.00 mb


OTLPE by OldTimer - Version 3.1.46.0 log created on 04272011_202800

Ihr seit klasse!

bitte erstelle und poste ein combofix log.
Ein Leitfaden und Tutorium zur Nutzung von ComboFix

Hier kommt die ComboFix Logdatei:

Combofix Logfile:

ComboFix 11-04-27.01 - IceTea 27.04.2011  20:05:39.1.2 - x86
Microsoft Windows XP Professional  5.1.2600.3.1252.49.1031.18.2047.1465 [GMT 2:00]
ausgeführt von:: c:\dokumente und einstellungen\IceTea\Desktop\ComboFix.exe
AV: AntiVir Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
AV: Avira AntiVir PersonalEdition Classic *Disabled/Updated* {8875E29C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Disabled/Updated* {8887371C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Disabled/Updated* {888BB71C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Disabled/Updated* {8893071C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Disabled/Updated* {8898D71C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Disabled/Updated* {889C771C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Disabled/Updated* {88BA1784-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Disabled/Updated* {88BCD784-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Disabled/Updated* {88BF1784-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Disabled/Updated* {88C69784-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Disabled/Updated* {88D36784-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Disabled/Updated* {8911871C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Disabled/Updated* {894AD784-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Disabled/Updated* {899D6C44-FFA4-00EF-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Disabled/Updated* {89A4C2B4-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Disabled/Updated* {89A7ECE4-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Disabled/Updated* {89A90B7C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Disabled/Updated* {89B64A64-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Disabled/Updated* {89B7972C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Disabled/Updated* {89CF58FC-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Disabled/Updated* {89DC0C54-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {00000000-0000-0000-0000-000000000000}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {00000246-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {884D471C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8864C47C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8882171C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8882971C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8882A71C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8883D7A4-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8886771C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8887B71C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8888F71C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8889F7A4-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {888B271C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {888CB71C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {888D271C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {888E071C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {888E271C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {888F27A4-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {888FD71C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {888FF71C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8890671C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8892671C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8892D71C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8892F71C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8894B71C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8895E71C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8897271C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8897C71C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8898F71C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8899A71C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {889A171C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {889B071C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {889B471C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {889BA71C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {889C371C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {889C671C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {889D971C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {889DC71C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {889E271C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {889EC71C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {889FB71C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {88A0971C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {88A0E71C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {88A1A71C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {88A2971C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {88A2A71C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {88A2C71C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {88A3271C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {88A4A71C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {88A5971C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {88A62784-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {88A6F71C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {88A8171C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {88A8F71C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {88A9E71C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {88AAC71C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {88AC471C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {88AF9784-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {88B1971C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {88B26784-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {88B3D724-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {88B47784-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {88B69784-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {88B6B784-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {88B8D784-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {88B95784-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {88B99784-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {88BA5784-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {88BC1784-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {88BD7784-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {88BE1784-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {88BE3784-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {88BE5784-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {88BE7784-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {88BF7784-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {88C06784-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {88C15784-FFA4-00EF-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {88C33784-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {88C37784-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {88C3E784-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {88C58784-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {88C66784-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {88C71784-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {88C7A784-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {88C7D784-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {88C80784-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {88C82784-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {88C88784-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {88C8E784-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {88C90784-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {88C9C784-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {88CA6784-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {88CBD784-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {88CC1784-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {88CD3784-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {88CD9784-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {88CE8784-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {88CEB784-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {88CF7784-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {88D16784-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {88D23784-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {88D25784-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {88D28784-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {88D2A784-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {88D2B784-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {88D2F784-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {88D31784-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {88D46784-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {88D4B784-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {88D4B784-FFA4-00EF-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {88D55784-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {88D5B784-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {88D73784-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {88E96DDC-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {890D171C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {890DD71C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8910C7A4-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8911171C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8911671C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8913271C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8913871C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8915271C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8918871C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8918C71C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {891AC7A4-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {891B471C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {891D971C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8921071C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8921671C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8922871C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8922971C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8923F71C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8924271C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8924471C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8925671C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {892A171C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8933271C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {89489784-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {89523784-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {89558784-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {89575784-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {89587784-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {895B5784-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {895E2784-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {89620784-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {89626784-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {89651784-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8967D784-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {89683784-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {8969A784-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {896B5784-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {896BD784-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {89942DB4-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {89947654-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {89999BF4-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {899A46FC-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {899B0DDC-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {899C2054-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {899C3684-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {899D3D8C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {89A07684-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {89A2434C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {89A2B5CC-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {89A2F3F4-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {89A383C4-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {89A3A734-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {89A3B804-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {89A46DDC-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {89A484BC-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {89A4F4BC-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {89A58DDC-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {89A642CC-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {89A6D24C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {89A7628C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {89A766D4-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {89A827CC-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {89A87324-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {89A8B494-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {89A91DDC-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {89A9252C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {89A954EC-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {89A96DDC-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {89ABDDDC-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {89AC05DC-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {89ACC894-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {89ACEA34-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {89ADEDDC-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {89AF3DDC-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {89AF9DB4-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {89AFD96C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {89AFE4FC-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {89B078F4-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {89B082FC-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {89B0C054-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {89B0C894-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {89B0D9E4-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {89B0E81C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {89B1B41C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {89B1B44C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {89B2198C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {89B279EC-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {89B27B7C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {89B2F2AC-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {89B32DDC-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {89B379EC-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {89B3B8BC-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {89B496AC-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {89B597CC-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {89B5D14C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {89B5F444-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {89B619E4-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {89B64054-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {89B666AC-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {89B80C24-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {89B81B64-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {89B83DDC-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {89B8465C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {89BB3614-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {89BC740C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {89BDAA74-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {89BDEABC-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {89BE0054-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {89BECD4C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {89C147CC-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {89C1D97C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {89C2F054-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {89C54DDC-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {89CAAB7C-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {89CD95DC-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {89CE18EC-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {89CF53FC-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {89CFA6AC-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {89D0F844-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {89D51654-FFA4-00DE-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *Enabled/Updated* {FFFFFFFF-FFA4-00DE-0D24-347CA8A3377C}
.
 ADS - WINDOWS: deleted 24 bytes in 1 streams. 
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\dokumente und einstellungen\All Users\Anwendungsdaten\hpeE.dll
c:\dokumente und einstellungen\IceTea\Anwendungsdaten\Desktopicon
c:\dokumente und einstellungen\IceTea\Desktop\Setup.exe
c:\dokumente und einstellungen\IceTea\WINDOWS
c:\windows\system32\kWab.dll
c:\windows\system32\SysInfo.dll
.
Infizierte Kopie von c:\windows\system32\DRIVERS\atapi.sys wurde gefunden und desinfiziert 
Kopie von - c:\windows\ServicePackFiles\i386\atapi.sys wurde wiederhergestellt 
.
.
(((((((((((((((((((((((   Dateien erstellt von 2011-03-27 bis 2011-04-27  ))))))))))))))))))))))))))))))
.
.
2011-04-28 00:29 . 2011-03-06 22:12	2234368	----a-r-	C:\OTLPE.exe
2011-04-28 00:28 . 2011-04-27 15:34	--------	d-----w-	C:\_OTL
2011-04-27 17:56 . 2011-04-27 17:56	--------	d-----w-	c:\dokumente und einstellungen\IceTea\Anwendungsdaten\Avira
2011-04-26 16:18 . 2011-04-26 16:18	143360	----a-w-	c:\windows\system32\null0.20446400493806582.exe
2011-04-26 16:05 . 2011-04-26 16:05	--------	d-----r-	c:\dokumente und einstellungen\NetworkService\Favoriten
2011-04-26 16:05 . 2011-04-26 16:05	143360	----a-w-	c:\windows\system32\null0.5873088251353679.exe
2011-04-26 16:05 . 2011-04-26 16:05	143360	----a-w-	c:\windows\system32\null0.5126565617414302.exe
2011-04-26 16:05 . 2011-04-26 16:05	--------	d-----w-	c:\dokumente und einstellungen\NetworkService\Lokale Einstellungen\Anwendungsdaten\Adobe
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-03-17 18:24 . 2009-03-20 10:22	137656	----a-w-	c:\windows\system32\drivers\avipbb.sys
2011-03-07 05:33 . 2006-11-23 15:11	692736	----a-w-	c:\windows\system32\inetcomm.dll
2011-03-04 06:36 . 2006-02-28 12:00	420864	----a-w-	c:\windows\system32\vbscript.dll
2011-03-03 13:53 . 2006-02-28 12:00	1858048	----a-w-	c:\windows\system32\win32k.sys
2011-02-22 23:05 . 2006-02-28 12:00	916480	----a-w-	c:\windows\system32\wininet.dll
2011-02-22 23:05 . 2006-02-28 12:00	43520	----a-w-	c:\windows\system32\licmgr10.dll
2011-02-22 23:05 . 2006-02-28 12:00	1469440	------w-	c:\windows\system32\inetcpl.cpl
2011-02-22 11:41 . 2006-02-28 12:00	385024	----a-w-	c:\windows\system32\html.iec
2011-02-17 13:18 . 2006-02-28 12:00	455936	----a-w-	c:\windows\system32\drivers\mrxsmb.sys
2011-02-17 13:18 . 2006-02-28 12:00	357888	----a-w-	c:\windows\system32\drivers\srv.sys
2011-02-17 12:54 . 2008-05-05 05:25	5632	----a-w-	c:\windows\system32\xpsp4res.dll
2011-02-15 12:56 . 2006-02-28 12:00	290432	----a-w-	c:\windows\system32\atmfd.dll
2011-02-09 13:53 . 2006-02-28 12:00	270848	----a-w-	c:\windows\system32\sbe.dll
2011-02-09 13:53 . 2006-02-28 12:00	186880	----a-w-	c:\windows\system32\encdec.dll
2011-02-08 13:33 . 2006-02-28 12:00	978944	------w-	c:\windows\system32\mfc42.dll
2011-02-08 13:33 . 2006-02-28 12:00	974848	----a-w-	c:\windows\system32\mfc42u.dll
2011-02-02 07:58 . 2006-11-23 15:09	2067456	----a-w-	c:\windows\system32\mstscax.dll
2004-10-01 14:00 . 2006-12-02 10:35	40960	----a-w-	c:\programme\Uninstall_CDS.exe
.
.
------- Sigcheck -------
.
[7] 2008-04-13 . 9F3A2F5AA6875C72BF062C712CFA2674 . 96512 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\atapi.sys
[-] 2008-04-13 18:40 . !HASH: COULD NOT OPEN FILE !!!!! . 96512 . . [------] . . c:\windows\system32\drivers\atapi.sys
[7] 2006-02-28 . CDFE4411A69C224BD1D11B2DA92DAC51 . 95360 . . [5.1.2600.2180] . . c:\windows\system32\ReinstallBackups\0001\DriverFiles\i386\atapi.sys
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2009-12-09 01:19	94208	----a-w-	c:\dokumente und einstellungen\IceTea\Anwendungsdaten\Dropbox\bin\DropboxExt.13.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2009-12-09 01:19	94208	----a-w-	c:\dokumente und einstellungen\IceTea\Anwendungsdaten\Dropbox\bin\DropboxExt.13.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2009-12-09 01:19	94208	----a-w-	c:\dokumente und einstellungen\IceTea\Anwendungsdaten\Dropbox\bin\DropboxExt.13.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AnyDVD"="d:\programme\Multimedia\Kopieren\DVD\AnyDVD\AnyDVDtray.exe" [2009-12-28 3214272]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"amd_dc_opt"="c:\programme\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [2006-11-17 77824]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-10-07 13574144]
"RTHDCPL"="RTHDCPL.EXE" [2006-11-14 16270848]
"avgnt"="c:\programme\Avira\AntiVir Desktop\avgnt.exe" [2010-11-09 281768]
"QuickTime Task"="d:\programme\Tools\Quicktime\qttask.exe" [2008-03-28 413696]
"nwiz"="nwiz.exe" [2008-10-07 1630208]
"SunJavaUpdateSched"="c:\programme\Java\jre6\bin\jusched.exe" [2009-10-03 148888]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 110592]
"CanonMyPrinter"="c:\programme\Canon\MyPrinter\BJMyPrt.exe" [2009-10-19 1983816]
"CanonSolutionMenu"="c:\programme\Canon\SolutionMenu\CNSLMAIN.exe" [2009-09-04 767312]
"IJNetworkScanUtility"="c:\programme\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe" [2009-05-19 136544]
"ProfilerU"="c:\programme\Saitek\SD6\Software\ProfilerU.exe" [2009-06-03 237568]
"SaiMfd"="c:\programme\Saitek\SD6\Software\SaiMfd.exe" [2009-06-03 131072]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
c:\dokumente und einstellungen\IceTea\Startmen�\Programme\Autostart\
DCS.bat [2009-11-12 104]
.
c:\dokumente und einstellungen\All Users\Startmen�\Programme\Autostart\
BlueSoleil.lnk - d:\programme\Internet\Kommunikation\Handy\BlueSoleil\BlueSoleil.exe [2005-9-20 1200128]
Logitech Desktop Messenger.lnk - c:\programme\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2010-4-1 66864]
.
[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^CoreCenter.lnk]
path=c:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\CoreCenter.lnk
backup=c:\windows\pss\CoreCenter.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Corel MEDIA FOLDERS INDEXER 8.LNK]
path=c:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\Corel MEDIA FOLDERS INDEXER 8.LNK
backup=c:\windows\pss\Corel MEDIA FOLDERS INDEXER 8.LNKCommon Startup
.
[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Easy-PrintToolBox.lnk]
path=c:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\Easy-PrintToolBox.lnk
backup=c:\windows\pss\Easy-PrintToolBox.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Microsoft Office.lnk]
path=c:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^IceTea^Startmenü^Programme^Autostart^Dropbox.lnk]
path=c:\dokumente und einstellungen\IceTea\Startmenü\Programme\Autostart\Dropbox.lnk
backup=c:\windows\pss\Dropbox.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent]
2007-01-12 06:35	43008	----a-w-	d:\programme\Internet\Downloader\BitTorrent\bittorrent.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LiveMonitor]
2006-09-05 15:45	497152	----a-w-	c:\programme\MSI\Live Update 3\LMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 02:22	1695232	------w-	c:\programme\Messenger\msmsgs.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel]
2006-05-16 17:04	2879488	----a-w-	c:\windows\SkyTel.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
2006-07-21 15:14	86016	----a-w-	c:\windows\SoundMan.exe
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"MSMSGS"="c:\programme\Messenger\msmsgs.exe" /background
"CTFMON.EXE"=c:\windows\system32\ctfmon.exe
"AnyDVD"=d:\programme\Multimedia\Kopieren\DVD\AnyDVD\AnyDVDtray.exe
"H/PC Connection Agent"="d:\programme\tools\Navi\Microsoft ActiveSync\wcescomm.exe"
"Personal ID"=d:\progra~1\INTERNET\PID\PID.EXE
"BitTorrent"="d:\programme\Internet\Downloader\BitTorrent\bittorrent.exe" --force_start_minimized
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"RemoteControl"="d:\programme\Multimedia\Kopieren\CyberLink DVD Solution\PowerDVD\PDVDServ.exe"
"NeroFilterCheck"=c:\windows\system32\NeroCheck.exe
"SunJavaUpdateSched"="c:\programme\Java\jre1.5.0_09\bin\jusched.exe"
"SW20"=c:\windows\system32\sw20.exe
"SW24"=c:\windows\system32\sw24.exe
"NvMediaCenter"=RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
"NvCplDaemon"=RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
"HotKey"=c:\windows\Twain_32\SlimU2\HotKey.exe
"QuickTime Task"="d:\programme\Tools\Quicktime\qttask.exe" -atboottime
"nwiz"=nwiz.exe /install
"AdobeCS4ServiceManager"="c:\programme\Gemeinsame Dateien\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"d:\\Programme\\Spiele\\Flugsim\\FS2004\\fs9.exe"=
"c:\\WINDOWS\\system32\\dpnsvr.exe"=
"d:\\Programme\\Spiele\\Rennsim\\GTR2\\GTR2.exe"=
"d:\\Programme\\Spiele\\Marinesim\\Battlestation Midway\\Battlestationsmidway.exe"=
"d:\\Programme\\Spiele\\Flugsim\\IL-2 Sturmovik 1946\\il2fb.exe"=
"d:\\Programme\\Spiele\\Flugsim\\Razorworks\\aphavoc\\aphavoc.exe"=
"d:\\Programme\\Spiele\\Flugsim\\Razorworks\\cohokum\\cohokum.exe"=
"d:\\Programme\\Spiele\\Shooter\\ArmA\\arma.exe"=
"d:\\Programme\\Internet\\Downloader\\Azureus\\Azureus.exe"=
"d:\\Programme\\Internet\\Downloader\\SmartFTP Client\\SmartFTP.exe"=
"d:\\Programme\\Internet\\Downloader\\BitTorrent\\bittorrent.exe"=
"c:\\Programme\\Gemeinsame Dateien\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
"d:\programme\Tools\Navi\Microsoft ActiveSync\rapimgr.exe"= d:\programme\Tools\Navi\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"d:\programme\Tools\Navi\Microsoft ActiveSync\wcescomm.exe"= d:\programme\Tools\Navi\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"d:\programme\Tools\Navi\Microsoft ActiveSync\WCESMgr.exe"= d:\programme\Tools\Navi\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"d:\\Programme\\Tools\\Navi\\Medion GoPal Assistant\\Assistant.exe"=
"c:\\Programme\\Java\\jre6\\bin\\javaw.exe"=
"d:\\Programme\\Spiele\\Flugsim\\Wings of Prey\\launcher.exe"=
"d:\\Programme\\Spiele\\Flugsim\\Wings of Prey\\aces.exe"=
"d:\\Programme\\Spiele\\Flugsim\\Wings of Prey\\yuPlay\\yuPlay.exe"=
"d:\\Programme\\Internet\\Kommunikation\\Handy\\BlueSoleil\\BlueSoleil.exe"=
"d:\\Programme\\Internet\\Kommunikation\\FRITZ!\\fritz!fax\\FriFax32.exe"=
"c:\\Programme\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"c:\\Programme\\Logitech\\Logitech Harmony Remote Software 7\\HarmonyRemote.exe"=
"c:\\Dokumente und Einstellungen\\IceTea\\Anwendungsdaten\\Dropbox\\bin\\Dropbox.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"2934:UDP"= 2934:UDP:Falcon AF Port 1
"2935:UDP"= 2935:UDP:Falcon AF Port 2
"5353:TCP"= 5353:TCP:Adobe CSI CS4
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
.
R0 a347bus;a347bus;c:\windows\system32\drivers\a347bus.sys [18.05.2007 13:33 160640]
R0 a347scsi;a347scsi;c:\windows\system32\drivers\a347scsi.sys [18.05.2007 13:33 5248]
R0 hotcore3;hotcore3;c:\windows\system32\drivers\hotcore3.sys [18.05.2008 13:00 39472]
R1 SSHDRV76;SSHDRV76;c:\windows\system32\drivers\SSHDRV76.sys [23.08.2007 11:27 53760]
R2 AntiVirSchedulerService;Avira AntiVir Planer;c:\programme\Avira\AntiVir Desktop\sched.exe [20.03.2009 12:22 135336]
R2 AVMPORT;AVMPORT;c:\windows\system32\drivers\avmport.sys [25.11.2006 16:01 69840]
R2 OMSI download service;Sony Ericsson OMSI download service;d:\programme\Internet\Kommunikation\Handy\PC_Suite\SupServ.exe [29.08.2009 12:45 90112]
R2 SaiDOutput;Saitek DirectOutput;c:\programme\Saitek\DirectOutput\DirectOutputService.exe [04.04.2008 12:34 147456]
R3 AVMWAN;AVM NDIS WAN CAPI-Treiber;c:\windows\system32\drivers\avmwan.sys [25.11.2006 15:39 37568]
R3 seehcri;Sony Ericsson seehcri Device Driver;c:\windows\system32\drivers\seehcri.sys [29.08.2009 12:47 27632]
S2 gupdate;Google Update Service (gupdate);c:\programme\Google\Update\GoogleUpdate.exe [06.01.2010 19:57 135664]
S3 DCamUSBNW800;SPACEC@M100PORTABLE Version 1.0;c:\windows\system32\drivers\pcam800.sys [13.10.2007 18:51 214368]
S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;d:\programme\Multimedia\Bildbearbeitung\Common\Database\bin\fbserver.exe [28.07.2007 15:00 1527900]
S3 fpcibase;AVM ISDN-Controller FRITZ!Card PCI;c:\windows\system32\drivers\fpcibase.sys [25.11.2006 15:39 444416]
S3 NPUSB;NPUSB;c:\windows\system32\drivers\npusb.sys [23.11.2006 22:10 22816]
S3 npusbio;npusbio;c:\windows\system32\drivers\npusbio.sys [19.11.2008 19:28 36384]
S3 P8000f;P8000 USB Filter Driver Service;c:\windows\system32\drivers\P8000f.sys [16.05.2005 18:23 12160]
S3 s0016bus;Sony Ericsson Device 0016 driver (WDM);c:\windows\system32\drivers\s0016bus.sys [29.08.2009 12:46 89256]
S3 s0016mdfl;Sony Ericsson Device 0016 USB WMC Modem Filter;c:\windows\system32\drivers\s0016mdfl.sys [29.08.2009 12:46 15016]
S3 s0016mdm;Sony Ericsson Device 0016 USB WMC Modem Driver;c:\windows\system32\drivers\s0016mdm.sys [29.08.2009 12:46 120744]
S3 s0016mgmt;Sony Ericsson Device 0016 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s0016mgmt.sys [29.08.2009 12:46 114216]
S3 s0016nd5;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (NDIS);c:\windows\system32\drivers\s0016nd5.sys [29.08.2009 12:46 25512]
S3 s0016obex;Sony Ericsson Device 0016 USB WMC OBEX Interface;c:\windows\system32\drivers\s0016obex.sys [29.08.2009 12:46 110632]
S3 s0016unic;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (WDM);c:\windows\system32\drivers\s0016unic.sys [29.08.2009 12:46 115752]
S3 SaiH0762;SaiH0762;c:\windows\system32\drivers\SaiH0762.sys [27.12.2010 20:49 136832]
S3 SetupNTGLM7X;SetupNTGLM7X;\??\e:\ntglm7x.sys --> e:\NTGLM7X.sys [?]
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
UxTuneUp
.
Inhalt des "geplante Tasks" Ordners
.
2011-04-27 c:\windows\Tasks\1-Klick-Wartung.job
- c:\programme\TuneUp Utilities 2009\OneClickStarter.exe [2008-11-24 11:32]
.
2010-12-30 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\programme\Apple Software Update\SoftwareUpdate.exe [2007-08-29 12:57]
.
2011-04-23 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\programme\Google\Update\GoogleUpdate.exe [2010-01-06 17:57]
.
2011-04-27 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\programme\Google\Update\GoogleUpdate.exe [2010-01-06 17:57]
.
.
------- Zusätzlicher Suchlauf -------
.
uInternet Connection Wizard,ShellNext = iexplore
IE: Download with GetRight - d:\programme\Internet\Downloader\GetRight\GRdownload.htm
IE: Nach Microsoft &Excel exportieren - d:\progra~1\MICROS~1\Office10\EXCEL.EXE/3000
IE: Open with GetRight Browser - d:\programme\Internet\Downloader\GetRight\GRbrowse.htm
Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\programme\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
MSConfigStartUp-MSI Live - c:\programme\MSI\MSI Live\SetWallpaper.exe
AddRemove-Grand Prix 1979 for Rfactor v2.0 - d:\programme\Spiele\Rennsim\rFactor\uninstall79v20.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2011-04-27 20:20
Windows 5.1.2600 Service Pack 3 NTFS
.
Scanne versteckte Prozesse... 
.
Scanne versteckte Autostarteinträge... 
.
Scanne versteckte Dateien... 
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-343818398-1085031214-839522115-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:01,57,c2,e2,2c,c6,1d,5b,3b,8f,45,0e,92,c8,f0,31,23,df,f2,d9,5b,f4,23,
   cc,30,a4,ef,cd,e5,23,63,8e,05,53,ce,12,37,90,28,a9,d5,6f,cb,a9,4b,dd,14,c5,\
"??"=hex:52,e0,15,45,fa,fb,c9,5c,60,0d,06,90,41,32,84,8b
.
[HKEY_USERS\S-1-5-21-343818398-1085031214-839522115-1003\Software\SecuROM\License information*]
"datasecu"=hex:d2,c1,d7,ac,ad,07,c1,ef,39,04,9d,dd,09,cb,4a,8a,cd,4f,44,9e,d8,
   b7,73,53,38,9f,fc,2e,3f,92,78,56,cb,2b,2d,18,c7,c2,03,bf,6d,76,8d,36,4c,ad,\
"rkeysecu"=hex:01,a8,a3,d0,1c,32,b3,d5,ab,e9,a0,17,12,71,11,ec
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10p_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10p_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'winlogon.exe'(1080)
c:\programme\Gemeinsame Dateien\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll
.
- - - - - - - > 'explorer.exe'(3688)
d:\programme\Multimedia\Kopieren\DVD\AnyDVD\ADvdDiscHlp.dll
c:\windows\system32\nview.dll
c:\windows\system32\NVWRSDE.DLL
c:\dokumente und einstellungen\IceTea\Anwendungsdaten\Dropbox\bin\DropboxExt.13.dll
c:\progra~1\WINDOW~2\wmpband.dll
d:\programme\Tools\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\programme\Avira\AntiVir Desktop\avguard.exe
d:\programme\Internet\Kommunikation\Handy\BlueSoleil\BTNtService.exe
c:\programme\Avira\AntiVir Desktop\avshadow.exe
c:\programme\Canon\IJPLM\IJPLMSVC.EXE
c:\programme\Java\jre6\bin\jqs.exe
c:\programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe
c:\windows\system32\nvsvc32.exe
c:\windows\System32\TUProgSt.exe
c:\programme\Gemeinsame Dateien\Ulead Systems\DVD\ULCDRSvr.exe
c:\windows\RTHDCPL.EXE
c:\windows\system32\rundll32.exe
c:\windows\system32\rundll32.exe
d:\progra~1\tools\Navi\MICROS~1\rapimgr.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\wbem\wmiapsrv.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2011-04-27  20:22:40 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2011-04-27 18:22
.
Vor Suchlauf: 3.587.534.848 Bytes frei
Nach Suchlauf: 3.677.241.344 Bytes frei
.
WindowsXP-KB310994-SP2-Pro-BootDisk-DEU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect /usepmtimer
.
- - End Of File - - 4C127D66DAA5EA3E43449E6D4C4AA3B4
         

--- --- ---

machst du onlinebanking /einkäufe? oder sonst was wichtiges mit dem pc?

Ja, Onlinebanking und Einkäufe.

ok.
lasse sofort onlinebanking sperren!
falls du hast endere alle passwörter von nem sicheren pc.
du hast das tdss rootkit.
da wir nicht garantieren können das wir den pc sauber bekommen was logischerweise nötig ist ist folgendes angesagt:
- daten sichern.
- formatieren.
- pc absichern.
würde dir da tipps für die zukunft geben.

O.K.
Aber das wird jetzt erstmal dauern.
Onlinebanking sperre ich sofort.

ok meld dich einfach wenn du so weit bist

Reicht es eigentlich wenn ich die Daten der Bootpartition sichere?
Oder müssen wir die ganze Festplatte schrubben?

nein die partition wo windows drauf ist.

So, ich hoffe ich habe soweit alles wichtige gesichert. Ist ja ein Wahnsinn was sich im Laufe der Zeit alles ansammelt. Gar nicht so einfach dann wichtig von unwichtig zu unterscheiden.
Sei es wie es sei. Es kann losgehen.

hast du ne windows cd, recovery cd recovery partition?
weist du wie das mit dem formatieen läuft oder muss ich das auch beschreiben

Also eine Windows CD habe ich. Bei einer Recovery CD bin ich mir nicht sicher. Muss ich die selber erstellt haben oder wo kommt die her?
Formatieren bzw. ein Betriebssystem neu einrichten kann ich.
Aber ist das wirklich nötig? Wir wollten es doch erstmal anders probieren, oder?