Hey..
mein internet exploer öffnet sich ständig, obwohl ich ihn nie benutze!
und es geht ab und zu ein fenster auf wo steht "meldung von webside: sie haben ein ipohne gewonnen" (schön wärs)
naja anti vir hat mir gestern auch gesagt ich habe einen trojaner!
hab dieses OTL mal laufen lassen! hoffe mir kan wer helfen
danke schonmal im voraus!


OTL Extras logfile created on: 16.05.2011 16:23:34 - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Users\mw\Downloads
Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 53,00% Memory free
6,00 Gb Paging File | 4,00 Gb Available in Paging File | 71,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 134,73 Gb Total Space | 72,96 Gb Free Space | 54,15% Space Free | Partition Type: NTFS
Drive E: | 98,15 Gb Total Space | 10,02 Gb Free Space | 10,20% Space Free | Partition Type: NTFS
Drive F: | 74,56 Gb Total Space | 32,17 Gb Free Space | 43,15% Space Free | Partition Type: NTFS

Computer Name: MW-PC | User Name: mw | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [ACDBrowse] -- "C:\Program Files\ACD Systems\ACDSee\5.0\ACDSee5.exe" "%1" (ACD Systems Ltd.)
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0C826C5B-B131-423A-A229-C71B3CACCD6A}" = CDDRV_Installer
"{13B792AA-C078-43A4-8A3A-8B12D629940D}" = Counter-Strike 1.6
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1FF713E1-FE5E-4AD0-9C8C-B2E877846B45}" = Catalyst Control Center - Branding
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{20D4A895-748C-4D88-871C-FDB1695B0169}" = Platform
"{23D6C05C-E8BB-0812-7C96-33F0E25A6388}" = HydraVision
"{306D0BDC-4E4D-D95A-F067-5C2FD0A41055}" = Catalyst Control Center Graphics Full New
"{3101CB58-3482-4D21-AF1A-7057FC935355}" = KhalInstallWrapper
"{353FE16B-30FE-469A-BF55-B978F4218003}" = iTunes
"{3921A67A-5AB1-4E48-9444-C71814CF3027}" = VCRedistSetup
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3D3E663D-4E7E-4577-A560-7ECDDD45548A}" = PVSonyDll
"{413B1AC7-E076-B765-C6BF-8780AE6124CB}" = ATI AVIVO Codecs
"{47948554-90C6-4AAC-8CFA-D23CE11C1031}" = Nero 8 Essentials
"{4CBABDFD-49F8-47FD-BE7D-ECDE7270525A}" = Windows Live PIMT Platform
"{5396FBD8-8BD7-47F9-92AE-F62F13D5A11D}" = NETGEAR WG111v3 wireless USB 2.0 adapter
"{542068F1-9AAE-4E1B-8ACA-094FE03728BE}" = Carambis Driver Updater
"{548D4E14-F59D-4FA3-A357-CE5BA0D41D34}" = Opera 11.01
"{569FA061-07B7-3992-358E-3A58582B2E6D}" = ccc-core-static
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{5C474A83-A45F-470C-9AC8-2BD1C251BF9A}" = Skype™ 4.2
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{606BC780-101C-41DB-808D-4539BFA0774A}" = MobileMe Control Panel
"{61AD15B2-50DB-4686-A739-14FE180D4429}" = Windows Live ID Sign-in Assistant
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{6E31BF40-D2A5-D189-3676-7BA82927F4F0}" = Skins
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7578ADEA-D65F-4C89-A249-B1C88B6FFC20}" = ICQ7.5
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{853A4763-6643-4604-8D64-28BDD8925F4C}" = Apple Application Support
"{873E4648-6F6E-47F6-A7B2-A6F8DFABDCE6}" = Windows Live Messenger
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{90110407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{95A4C317-5EF8-7E59-BC82-5DFCB18EE17A}" = CCC Help English
"{9E48FF52-082C-4CC2-BB67-6E10D09C0431}" = Windows Live UX Platform Language Pack
"{A498D9EB-927B-459B-85D6-DD6EF8C2C564}" = erLT
"{A513E1BC-2F10-9661-3105-2674F11841AA}" = ccc-utility
"{A72D8248-4E4D-63CF-BF39-E041AF380012}" = Catalyst Control Center Graphics Full Existing
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AC76BA86-7AD7-1031-7B44-A94000000001}" = Adobe Reader 9.4.4 - Deutsch
"{AF5E8D43-49AD-4BE7-A941-2BB0A8CACA62}" = ACDSee 5.0 Standard
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B6CF045D-51E5-6E4B-7C62-FD402ACB38FB}" = Catalyst Control Center Graphics Previews Common
"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common
"{C2E4B5BD-32DB-4817-A060-341AB17C3F90}" = Bonjour
"{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update
"{CACAEB5F-174D-4C7C-AC56-A33289A807CA}" = Apple Mobile Device Support
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{CF06C093-A1D1-5CAB-DF87-B890377970D0}" = Catalyst Control Center Localization All
"{D3405B2E-79A5-3EAF-3E8C-20E8CD64F2D1}" = Catalyst Control Center Core Implementation
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D6E5C6D5-E96F-C90E-0BF5-94F6E4ED3B6A}" = Catalyst Control Center Graphics Previews Vista
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{EB4DF488-AAEF-406F-A341-CB2AAA315B90}" = Windows Live Messenger
"{F25BE225-4A79-941A-A257-1BB37968F773}" = Catalyst Control Center HydraVision Full
"{F29B21BD-CAA6-445F-8EF7-A7E2B9D8B14E}" = Logitech SetPoint
"{F3759A9F-7AFA-4FB4-8DF1-53F26B979DEE}" = Belkin 54Mbps Wireless Network Adapter
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{F8A2DD2D-581D-372A-71CD-1339CFE86EC8}" = Catalyst Control Center Graphics Light
"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials
"{FE838287-9CFF-1C2F-C6C3-DD788F4BC761}" = ATI Catalyst Install Manager
"7-Zip" = 7-Zip 4.65
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Photoshop 7.0" = Adobe Photoshop 7.0
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"CCleaner" = CCleaner
"DivX Setup.divx.com" = DivX-Setup
"Dr. Hardware 2010_is1" = Dr. Hardware 2010 10.2d
"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.4.7
"Free Video to iPod Converter_is1" = Free Video to iPod Converter version 3.5
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.9.35.324
"Graffiti Studio 2.0_is1" = Graffiti Studio 2.0
"ICQToolbar" = ICQ Toolbar
"InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}" = VIA Plattform-Geräte-Manager
"InstallShield_{5396FBD8-8BD7-47F9-92AE-F62F13D5A11D}" = NETGEAR WG111v3 wireless USB 2.0 adapter
"Intelore - RAR Password Recovery" = RAR Password Recovery v1.1 RC17 (remove only)
"KaloMa_is1" = KaloMa 4.92
"McAfee Security Scan" = McAfee Security Scan Plus
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Mozilla Firefox 4.0.1 (x86 de)" = Mozilla Firefox 4.0.1 (x86 de)
"NVIDIA Display Control Panel" = NVIDIA Display Control Panel
"NVIDIA Drivers" = NVIDIA Drivers
"PhotoScape" = PhotoScape
"Picasa 3" = Picasa 3
"RocketDock_is1" = RocketDock 1.3.5
"Uninstall_is1" = Uninstall 1.0.0.1
"VLC media player" = VLC media player 1.0.5
"WinGimp-2.0_is1" = GIMP 2.6.7
"WinLiveSuite" = Windows Live Essentials
"XMedia Recode" = XMedia Recode 2.2.9.7
"Zattoo4" = Zattoo4 4.0.4

========== Last 10 Event Log Errors ==========

Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!

< End of report >

hallo
1. avira öffnen, fundmeldungen posten, "irgendwie" "irgendwas" solche aussagen nützen uns nicht
die meldungen sind, falls es guard meldungen sind, unter avira, ereignisse, falls scanner meldung, avira, reports.
2. otl.txt fehlt :-)

In der Datei 'C:\Users\mw\AppData\Local\Temp\Srb.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Dropper.Gen' [trojan] gefunden.
Ausgeführte Aktion: Zugriff verweigern
(diese meldung hat er 3mal, ist aber jedensmal genau die selbe um die gleiche uhrzeit)

Die Datei 'C:\Users\mw\AppData\Local\Temp\Srb.exe'
enthielt einen Virus oder unerwünschtes Programm 'TR/Dropper.Gen' [trojan].
Durchgeführte Aktion(en):
Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '4ad2a5c5.qua' verschoben!

OTL Logfile:

OTL logfile created on: 16.05.2011 16:47:07 - Run 1
OTL by OldTimer - Version 3.2.22.3     Folder = C:\Users\mw\Downloads
 Ultimate Edition  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 54,00% Memory free
6,00 Gb Paging File | 4,00 Gb Available in Paging File | 71,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 134,73 Gb Total Space | 72,96 Gb Free Space | 54,15% Space Free | Partition Type: NTFS
Drive E: | 98,15 Gb Total Space | 10,02 Gb Free Space | 10,20% Space Free | Partition Type: NTFS
Drive F: | 74,56 Gb Total Space | 32,17 Gb Free Space | 43,15% Space Free | Partition Type: NTFS
 
Computer Name: MW-PC | User Name: mw | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\mw\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Users\mw\AppData\Local\Temp\Srd.exe (Simon Tatham)
PRC - C:\Windows\Ssehya.exe (Simon Tatham)
PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Programme\ICQ7.5\ICQ.exe (ICQ, LLC.)
PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Programme\DivX\DivX Update\DivXUpdate.exe ()
PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Programme\Avira\AntiVir Desktop\avcenter.exe (Avira GmbH)
PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.)
PRC - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE (Microsoft Corp.)
PRC - C:\Programme\Windows Media Player\wmplayer.exe (Microsoft Corporation)
PRC - C:\Programme\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.)
PRC - C:\Programme\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH)
PRC - C:\Programme\ICQ6Toolbar\ICQ Service.exe ()
PRC - C:\Programme\NETGEAR\WG111v3\WG111v3.exe ()
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Windows\System32\atieclxx.exe (AMD)
PRC - C:\Windows\System32\atiesrxx.exe (AMD)
PRC - C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)
PRC - C:\Windows\System32\conhost.exe (Microsoft Corporation)
PRC - C:\Windows\System32\audiodg.exe (Microsoft Corporation)
PRC - C:\Programme\VIA\VIAudioi\VDeck\VDeck.exe (VIA)
PRC - C:\Programme\Logitech\SetPoint\SetPoint.exe (Logitech, Inc.)
PRC - C:\Programme\Common Files\Logishrd\KHAL2\KHALMNPR.exe (Logitech, Inc.)
PRC - C:\Programme\Common Files\Nero\Lib\NMIndexStoreSvr.exe (Nero AG)
PRC - C:\Programme\RocketDock\RocketDock.exe ()
PRC - C:\Windows\PixArt\PAC7311\Monitor.exe (PixArt Imaging Incorporation)
PRC - C:\Programme\Common Files\microsoft shared\VS7DEBUG\MDM.EXE (Microsoft Corporation)
PRC - C:\Windows\twain_32\PUSH650C.exe ()
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Users\mw\Downloads\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (McComponentHostService) -- C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe (McAfee, Inc.)
SRV - (ICQ Service) -- C:\Programme\ICQ6Toolbar\ICQ Service.exe ()
SRV - (AMD External Events Utility) -- C:\Windows\System32\atiesrxx.exe (AMD)
SRV - (SensrSvc) -- C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)
SRV - (PeerDistSvc) -- C:\Windows\System32\PeerDistSvc.dll (Microsoft Corporation)
SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (LBTServ) -- C:\Programme\Common Files\Logishrd\Bluetooth\LBTServ.exe (Logitech, Inc.)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH)
DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (RTL8187B) -- C:\Windows\System32\drivers\wg111v3.sys (NETGEAR Inc.                           )
DRV - (atikmdag) -- C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (vmbus) -- C:\Windows\system32\DRIVERS\vmbus.sys (Microsoft Corporation)
DRV - (storflt) -- C:\Windows\system32\DRIVERS\vmstorfl.sys (Microsoft Corporation)
DRV - (storvsc) -- C:\Windows\system32\DRIVERS\storvsc.sys (Microsoft Corporation)
DRV - (vwifimp) -- C:\Windows\System32\drivers\vwifimp.sys (Microsoft Corporation)
DRV - (WinUsb) -- C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)
DRV - (s3cap) -- C:\Windows\system32\DRIVERS\vms3cap.sys (Microsoft Corporation)
DRV - (VMBusHID) -- C:\Windows\system32\DRIVERS\VMBusHID.sys (Microsoft Corporation)
DRV - (NVENETFD) -- C:\Windows\System32\drivers\nvm62x32.sys (NVIDIA Corporation)
DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (VIAHdAudAddService) -- C:\Windows\System32\drivers\viahduaa.sys (VIA Technologies, Inc.)
DRV - (LMouKE) -- C:\Windows\System32\drivers\LMouKE.Sys (Logitech, Inc.)
DRV - (LMouFilt) -- C:\Windows\System32\drivers\LMouFilt.Sys (Logitech, Inc.)
DRV - (L8042mou) -- C:\Windows\System32\drivers\L8042mou.Sys (Logitech, Inc.)
DRV - (LHidFilt) -- C:\Windows\System32\drivers\LHidFilt.Sys (Logitech, Inc.)
DRV - (L8042Kbd) -- C:\Windows\System32\drivers\L8042Kbd.sys (Logitech, Inc.)
DRV - (nvstor32) -- C:\Windows\system32\DRIVERS\nvstor32.sys (NVIDIA Corporation)
DRV - (netr73) -- C:\Windows\System32\drivers\netr73.sys (Ralink Technology, Corp.)
DRV - (PAC7311) -- C:\Windows\System32\drivers\PA707UCM.SYS (PixArt Imaging Inc.)
DRV - (drhard) -- C:\Windows\System32\drivers\drhard.sys (Licensed for Gebhard Software)
DRV - (VM650FVM11) -- C:\Windows\System32\drivers\USB650c.SYS (Windows (R) 2000 DDK provider)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = Google Toolbar
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = ICQ.com Suche
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = Google Toolbar
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = Google Toolbar
IE - HKCU\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.defaultthis.engineName: "Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "about:home"
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:1.5.4.20081105
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.3
FF - prefs.js..extensions.enabledItems: {e9911ec6-1bcc-40b0-9993-e0eea7f6953f}:2.5.8.6
FF - prefs.js..extensions.enabledItems: {23fcfd51-4958-4f00-80a3-ae97e717ed8b}:2.1.1.94
FF - prefs.js..extensions.enabledItems: {6904342A-8307-11DF-A508-4AE2DFD72085}:2.1.1.94
FF - prefs.js..extensions.enabledItems: {07b2a769-ed19-4483-87ce-c643914c9626}:1.6
FF - prefs.js..keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=2.0.0.8&q="
 
 
FF - HKLM\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\html5video [2011.03.20 16:42:46 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{6904342A-8307-11DF-A508-4AE2DFD72085}: C:\Program Files\DivX\DivX Plus Web Player\firefox\wpa [2011.03.20 16:42:46 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.05.03 13:47:46 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.05.07 12:27:34 | 000,000,000 | ---D | M]
 
[2010.05.24 15:44:20 | 000,000,000 | ---D | M] (No name found) -- C:\Users\mw\AppData\Roaming\mozilla\Extensions
[2011.05.15 02:08:03 | 000,000,000 | ---D | M] (No name found) -- C:\Users\mw\AppData\Roaming\mozilla\Firefox\Profiles\8p5nn27v.default\extensions
[2010.07.21 22:09:26 | 000,000,000 | ---D | M] (ANTHEM) -- C:\Users\mw\AppData\Roaming\mozilla\Firefox\Profiles\8p5nn27v.default\extensions\{07b2a769-ed19-4483-87ce-c643914c9626}
[2010.05.25 13:56:19 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\mw\AppData\Roaming\mozilla\Firefox\Profiles\8p5nn27v.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010.05.25 14:32:13 | 000,000,000 | ---D | M] ("DVDVideoSoft Menu") -- C:\Users\mw\AppData\Roaming\mozilla\Firefox\Profiles\8p5nn27v.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2010.06.06 12:58:56 | 000,000,000 | ---D | M] (DVDVideoSoft Toolbar) -- C:\Users\mw\AppData\Roaming\mozilla\Firefox\Profiles\8p5nn27v.default\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}
[2010.06.24 01:53:41 | 000,000,687 | ---- | M] () -- C:\Users\mw\AppData\Roaming\Mozilla\Firefox\Profiles\8p5nn27v.default\searchplugins\icq-search.xml
[2010.07.21 20:10:02 | 000,000,950 | ---- | M] () -- C:\Users\mw\AppData\Roaming\Mozilla\Firefox\Profiles\8p5nn27v.default\searchplugins\icqplugin-1.xml
[2010.07.25 13:46:50 | 000,000,950 | ---- | M] () -- C:\Users\mw\AppData\Roaming\Mozilla\Firefox\Profiles\8p5nn27v.default\searchplugins\icqplugin-2.xml
[2010.09.10 12:44:15 | 000,000,950 | ---- | M] () -- C:\Users\mw\AppData\Roaming\Mozilla\Firefox\Profiles\8p5nn27v.default\searchplugins\icqplugin-3.xml
[2011.05.03 13:47:56 | 000,000,950 | ---- | M] () -- C:\Users\mw\AppData\Roaming\Mozilla\Firefox\Profiles\8p5nn27v.default\searchplugins\icqplugin-4.xml
[2010.06.29 18:55:34 | 000,000,950 | ---- | M] () -- C:\Users\mw\AppData\Roaming\Mozilla\Firefox\Profiles\8p5nn27v.default\searchplugins\icqplugin.xml
[2011.03.24 23:37:05 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2011.03.24 23:37:05 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\distribution\extensions
[2011.03.24 23:37:05 | 000,000,000 | ---D | M] (WEB.DE Toolbar) -- C:\Programme\Mozilla Firefox\distribution\extensions\toolbar@web.de
File not found (No name found) -- 
() (No name found) -- C:\USERS\MW\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8P5NN27V.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
[2011.05.03 13:47:43 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Programme\Mozilla Firefox\components\browsercomps.dll
[2011.05.03 13:47:45 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2011.05.03 13:47:45 | 000,002,252 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\bing.xml
[2011.05.03 13:47:45 | 000,001,153 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml
[2011.05.03 13:47:45 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2011.05.03 13:47:45 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2011.05.03 13:47:45 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1             localhost
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Programme\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
O2 - BHO: (DivX HiQ) - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Programme\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
O2 - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [HDAudDeck] C:\Program Files\VIA\VIAudioi\VDeck\VDeck.exe (VIA)
O4 - HKLM..\Run: [Kernel and Hardware Abstraction Layer] C:\Windows\KHALMNPR.Exe (Logitech, Inc.)
O4 - HKLM..\Run: [NBKeyScan] C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe (Nero AG)
O4 - HKLM..\Run: [PAC7311_Monitor] C:\Windows\PixArt\PAC7311\Monitor.exe (PixArt Imaging Incorporation)
O4 - HKCU..\Run: [ICQ] C:\Program Files\ICQ7.5\ICQ.exe (ICQ, LLC.)
O4 - HKCU..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe (Nero AG)
O4 - HKCU..\Run: [R8388QA8U8] C:\Users\mw\AppData\Local\Temp\Srd.exe (Simon Tatham)
O4 - HKCU..\Run: [RocketDock] C:\Program Files\RocketDock\RocketDock.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\mw\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - C:\Programme\Microsoft Office\OFFICE11\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Programme\ICQ7.5\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Programme\ICQ7.5\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Common Files\microsoft shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Common Files\microsoft shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Common Files\microsoft shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - Winlogon\Notify\LBTWlgn: DllName - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll - c:\Programme\Common Files\Logishrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O24 - Desktop WallPaper: C:\Users\mw\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O24 - Desktop BackupWallPaper: C:\Users\mw\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.05.15 18:35:24 | 000,143,360 | ---- | C] (Simon Tatham) -- C:\Windows\Ssehya.exe
[2011.05.10 15:37:24 | 000,000,000 | ---D | C] -- C:\Users\mw\AppData\Local\PokerStars
[2011.05.10 15:37:15 | 000,000,000 | ---D | C] -- C:\Programme\PokerStars
[2011.05.05 15:43:51 | 000,000,000 | ---D | C] -- C:\Users\mw\Desktop\Favorite-Christoph_Alex-2CD-DE-2011-NOiR
[2011.04.26 22:22:28 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ICQ7.5
[2011.04.26 22:21:53 | 000,000,000 | ---D | C] -- C:\Programme\ICQ7.5
[2011.04.26 18:22:27 | 000,000,000 | ---D | C] -- C:\Users\mw\Desktop\Marteria-Zum_Glueck_in_Die_Zukunft-2CD-Limited_Edition-DE-2010-NOiR
[2011.04.26 16:14:38 | 000,000,000 | ---D | C] -- C:\Users\mw\Desktop\rtrt
[2011.04.26 16:14:22 | 000,000,000 | ---D | C] -- C:\Users\mw\Desktop\BPM-Studio Profi
[2011.04.25 17:16:41 | 000,000,000 | ---D | C] -- C:\Users\mw\Desktop\F.I.K
[2011.04.25 14:42:30 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2011.04.25 14:42:10 | 000,000,000 | ---D | C] -- C:\Programme\iTunes
[2011.04.25 14:42:10 | 000,000,000 | ---D | C] -- C:\Programme\iPod
[2011.04.25 14:40:56 | 000,000,000 | ---D | C] -- C:\Programme\Bonjour
[2 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2011.05.16 16:32:19 | 000,000,274 | -H-- | M] () -- C:\Windows\tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job
[2011.05.16 16:10:02 | 000,000,240 | -H-- | M] () -- C:\Windows\tasks\{810401E2-DDE0-454e-B0E2-AA89C9E5967C}.job
[2011.05.16 16:00:26 | 000,000,274 | -H-- | M] () -- C:\Windows\tasks\{BBAEAEAF-1275-40e2-BD6C-BC8F88BD114A}.job
[2011.05.16 15:24:48 | 000,013,232 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011.05.16 15:24:48 | 000,013,232 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011.05.16 15:17:19 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011.05.16 15:17:16 | 2415,370,240 | -HS- | M] () -- C:\hiberfil.sys
[2011.05.15 18:35:20 | 000,143,360 | ---- | M] (Simon Tatham) -- C:\Windows\Ssehya.exe
[2011.05.02 13:28:40 | 020,533,281 | ---- | M] () -- C:\Users\mw\Documents\vlc-1.1.9-win32.exe
[2011.04.29 14:18:57 | 000,653,928 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2011.04.29 14:18:57 | 000,615,810 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011.04.29 14:18:57 | 000,129,800 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2011.04.29 14:18:57 | 000,106,190 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011.04.25 16:57:23 | 000,010,240 | -H-- | M] () -- C:\Users\mw\Documents\photothumb.db
[2 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2011.05.15 18:35:29 | 000,000,274 | -H-- | C] () -- C:\Windows\tasks\{BBAEAEAF-1275-40e2-BD6C-BC8F88BD114A}.job
[2011.05.15 18:35:25 | 000,000,274 | -H-- | C] () -- C:\Windows\tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job
[2011.05.15 18:35:21 | 000,000,240 | -H-- | C] () -- C:\Windows\tasks\{810401E2-DDE0-454e-B0E2-AA89C9E5967C}.job
[2011.05.02 13:22:53 | 020,533,281 | ---- | C] () -- C:\Users\mw\Documents\vlc-1.1.9-win32.exe
[2011.03.20 15:51:18 | 000,028,672 | ---- | C] () -- C:\Windows\System32\sschadmin.dll
[2010.12.20 17:53:00 | 000,000,760 | ---- | C] () -- C:\Users\mw\AppData\Roaming\setup_ldm.iss
[2010.07.27 16:54:05 | 000,000,037 | ---- | C] () -- C:\Windows\avitoiPodconverter.ini
[2010.07.27 16:52:59 | 000,000,069 | ---- | C] () -- C:\Windows\NeroDigital.ini
[2010.07.27 16:52:56 | 000,003,584 | ---- | C] () -- C:\Users\mw\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.07.27 16:51:49 | 000,000,001 | ---- | C] () -- C:\Windows\System32\SysAVItoiPod.dat
[2010.06.16 23:14:49 | 000,007,599 | ---- | C] () -- C:\Users\mw\AppData\Local\Resmon.ResmonCfg
[2010.05.24 15:47:33 | 000,021,532 | ---- | C] () -- C:\Windows\System32\emptyregdb.dat
[2010.05.24 15:37:42 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2010.05.24 11:27:53 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat
[2010.05.24 08:36:38 | 000,200,704 | ---- | C] () -- C:\Windows\System32\UpdateDriver.exe
[2010.05.24 08:36:38 | 000,005,224 | ---- | C] () -- C:\Windows\System32\ucuiinfo.ini
[2010.05.21 19:16:17 | 000,000,400 | ---- | C] () -- C:\Windows\ODBC.INI
[2010.05.21 18:55:07 | 000,003,948 | R--- | C] () -- C:\Windows\System32\drivers\nvphy.bin
[2010.05.21 18:53:56 | 000,004,552 | ---- | C] () -- C:\Windows\Ascd_tmp.ini
[2009.08.26 18:58:14 | 000,195,854 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat
[2009.07.14 10:47:43 | 000,653,928 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2009.07.14 10:47:43 | 000,295,922 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2009.07.14 10:47:43 | 000,129,800 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2009.07.14 10:47:43 | 000,038,104 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2009.07.14 06:57:37 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009.07.14 06:33:53 | 000,410,096 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2009.07.14 04:05:48 | 000,615,810 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2009.07.14 04:05:48 | 000,291,294 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2009.07.14 04:05:48 | 000,106,190 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2009.07.14 04:05:48 | 000,031,548 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2009.07.14 04:05:05 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2009.07.14 04:04:11 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2009.07.14 02:55:09 | 000,587,776 | ---- | C] () -- C:\Windows\System32\hpotscl1.dll
[2009.07.14 02:19:49 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe
[2009.07.14 01:55:01 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009.07.14 01:51:43 | 000,073,728 | ---- | C] () -- C:\Windows\System32\BthpanContextHandler.dll
[2009.07.14 01:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\System32\BWContextHandler.dll
[2009.06.10 23:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2009.02.18 19:55:20 | 000,294,912 | ---- | C] () -- C:\Windows\System32\ATIODE.exe
[2009.02.03 22:52:02 | 000,045,056 | ---- | C] () -- C:\Windows\System32\ATIODCLI.exe
[2007.01.31 14:48:36 | 000,000,518 | ---- | C] () -- C:\Windows\System32\SP7311.ini
[2006.10.11 05:33:58 | 000,010,288 | ---- | C] () -- C:\Windows\System32\drivers\ASUSHWIO.SYS
[2003.02.20 17:53:42 | 000,005,702 | ---- | C] () -- C:\Windows\System32\OUTLPERF.INI
[2002.03.21 12:51:52 | 000,503,808 | R--- | C] () -- C:\Windows\System32\lt_xtrans.dll
[2002.03.21 12:51:52 | 000,286,720 | R--- | C] () -- C:\Windows\System32\MrSIDD.dll
[2002.03.21 12:51:52 | 000,163,840 | R--- | C] () -- C:\Windows\System32\lt_common.dll
[2002.03.21 12:51:52 | 000,126,976 | R--- | C] () -- C:\Windows\System32\lt_trans.dll
[2002.03.21 12:51:52 | 000,069,632 | R--- | C] () -- C:\Windows\System32\lt_meta.dll
[2002.03.21 12:51:52 | 000,053,248 | R--- | C] () -- C:\Windows\System32\lt_encrypt.dll
[2002.03.21 12:51:52 | 000,020,480 | R--- | C] () -- C:\Windows\System32\lt_messagetext.dll
[2002.03.20 21:01:06 | 000,006,688 | R--- | C] () -- C:\Windows\System32\Digita.sys
[2002.03.20 21:00:20 | 000,049,152 | R--- | C] () -- C:\Windows\System32\TransportUSB.dll
[2002.03.20 21:00:20 | 000,049,152 | R--- | C] () -- C:\Windows\System32\TransportSerial.dll
[2002.03.20 21:00:20 | 000,049,152 | R--- | C] () -- C:\Windows\System32\TransportIrDA.dll
[2002.03.20 21:00:20 | 000,049,152 | R--- | C] () -- C:\Windows\System32\TransportIrCOMM.dll

< End of report >
         

--- --- ---

• Starte bitte die OTL.exe
• Kopiere nun das Folgende in die Textbox.

:OTL
PRC - C:\Users\mw\AppData\Local\Temp\Srd.exe (Simon Tatham)
PRC - C:\Windows\Ssehya.exe (Simon Tatham)
O4 - HKCU..\Run: [R8388QA8U8] C:\Users\mw\AppData\Local\Temp\Srd.exe (Simon Tatham)
[2011.05.16 16:32:19 | 000,000,274 | -H-- | M] () -- C:\Windows\tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job
[2011.05.16 16:10:02 | 000,000,240 | -H-- | M] () -- C:\Windows\tasks\{810401E2-DDE0-454e-B0E2-AA89C9E5967C}.job
[2011.05.16 16:00:26 | 000,000,274 | -H-- | M] () -- C:\Windows\tasks\{BBAEAEAF-1275-40e2-BD6C-BC8F88BD114A}.job
:Files
C:\Windows\Ssehya.exe
C:\Users\mw\AppData\Local\Temp\Srd.exe
:Commands
[purity]
[EMPTYFLASH]
[emptytemp]
[Reboot]

• Schliesse bitte nun alle Programme.
• Klicke nun bitte auf den Fix Button.
• OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
• Nach dem Neustart findest Du ein Textdokument, dessen inhalt in deiner nächsten antwort hier reinkopieren.
öffne computer, öffne C: dann _OTL
dort rechtsklick auf moved files
wähle zu moved files.rar oder zip hinzufügen.
http://www.trojaner-board.de/54791-a...ner-board.html

All processes killed
========== OTL ==========
No active process named Srd.exe was found!
No active process named Ssehya.exe was found!
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\R8388QA8U8 deleted successfully.
C:\Users\mw\AppData\Local\Temp\Srd.exe moved successfully.
C:\Windows\Tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job moved successfully.
C:\Windows\Tasks\{810401E2-DDE0-454e-B0E2-AA89C9E5967C}.job moved successfully.
C:\Windows\Tasks\{BBAEAEAF-1275-40e2-BD6C-BC8F88BD114A}.job moved successfully.
========== FILES ==========
C:\Windows\Ssehya.exe moved successfully.
File\Folder C:\Users\mw\AppData\Local\Temp\Srd.exe not found.
========== COMMANDS ==========

[EMPTYFLASH]

User: All Users

User: Default

User: Default User

User: mw
->Flash cache emptied: 38583 bytes

User: Public

Total Flash Files Cleaned = 0,00 mb


[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: mw
->Temp folder emptied: 1875768416 bytes
->Temporary Internet Files folder emptied: 94994588 bytes
->FireFox cache emptied: 278480406 bytes
->Opera cache emptied: 13339154 bytes
->Flash cache emptied: 0 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 10864 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 26892494 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 2.183,00 mb


OTL by OldTimer - Version 3.2.22.3 log created on 05162011_200821

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

ok danke für den upload.
bitte erstelle und poste ein combofix log.
Ein Leitfaden und Tutorium zur Nutzung von ComboFix

Sooo bin der beschreibung gefolgt. aber als die txt. datei aufging die ich posten sollte ging mozilla nicht mehr auch opera ging nicht Fehlermeldung: "Es wurde versucht einen Registrierungsschlüssel einem unzulässigen Vorgang zu unterziehen der zum Löschen markiert wurde"
was soll ich jetzt tun? neustart? oder lieber nicht weil er vlt. nicht hochfährt.. hab wichtige daten die am besten nicht verlorgen gehen sollen!

PS: bin jetzt an einem anderem PC und habe die txt datei mit nem stick auf diesen pc gezogen um ihn zu poste... hoffe ich hab die virus jetzt hier nicht auch?!

hier noch die datei die er noch ausgespuckt hat. dannach hat sich das programm beendet und es ging kein firefox mehr
Combofix Logfile:

ComboFix 11-05-16.01 - mw 16.05.2011  20:35:44.1.2 - x86
Microsoft Windows 7 Ultimate   6.1.7600.0.1252.49.1031.18.3071.1859 [GMT 2:00]
ausgeführt von:: c:\users\mw\Downloads\ComboFix.exe
AV: AntiVir Desktop *Disabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: AntiVir Desktop *Disabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((   Dateien erstellt von 2011-04-16 bis 2011-05-16  ))))))))))))))))))))))))))))))
.
.
2011-05-16 18:39 . 2011-05-16 18:39	--------	d-----w-	c:\users\Default\AppData\Local\temp
2011-05-16 18:08 . 2011-05-16 18:13	--------	d-----w-	C:\_OTL
2011-05-10 13:37 . 2011-05-10 13:37	--------	d-----w-	c:\users\mw\AppData\Local\PokerStars
2011-05-10 13:37 . 2011-05-15 17:26	--------	d-----w-	c:\program files\PokerStars
2011-04-26 20:21 . 2011-05-05 12:28	--------	d-----w-	c:\program files\ICQ7.5
2011-04-25 12:42 . 2011-04-25 12:42	--------	d-----w-	c:\program files\iTunes
2011-04-25 12:42 . 2011-04-25 12:42	--------	d-----w-	c:\program files\iPod
2011-04-25 12:40 . 2011-04-25 12:40	--------	d-----w-	c:\program files\Bonjour
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-04-13 22:40 . 2011-04-13 22:40	4284416	----a-w-	c:\windows\system32\GPhotos.scr
2011-04-06 14:20 . 2011-04-06 14:20	91424	----a-w-	c:\windows\system32\dnssd.dll
2011-04-06 14:20 . 2011-04-06 14:20	107808	----a-w-	c:\windows\system32\dns-sd.exe
2011-03-21 14:09 . 2010-05-23 10:53	137656	----a-w-	c:\windows\system32\drivers\avipbb.sys
2011-03-20 13:51 . 2011-03-20 13:51	28672	----a-w-	c:\windows\system32\sschadmin.dll
2011-03-12 15:26 . 2010-06-24 09:33	18328	----a-w-	c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2011-02-18 15:36 . 2011-02-18 15:36	41984	----a-w-	c:\windows\system32\drivers\usbaapl.sys
2011-02-18 15:36 . 2011-02-18 15:36	4184352	----a-w-	c:\windows\system32\usbaaplrc.dll
2011-05-03 11:47 . 2011-03-24 21:37	142296	----a-w-	c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [2008-02-28 1828136]
"RocketDock"="c:\program files\RocketDock\RocketDock.exe" [2007-09-02 495616]
"ICQ"="c:\program files\ICQ7.5\ICQ.exe" [2011-05-01 124216]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-11-02 281768]
"HDAudDeck"="c:\program files\VIA\VIAudioi\VDeck\VDeck.exe" [2009-05-18 1409024]
"NBKeyScan"="c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-02-18 2221352]
"PAC7311_Monitor"="c:\windows\PixArt\PAC7311\Monitor.exe" [2006-11-03 319488]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-07-13 47904]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-01-31 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2008-10-10 69632]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2011-03-21 1230704]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-04-14 421160]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2010-5-23 110592]
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2010-12-20 809488]
McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536]
NETGEAR WG111v3 Setup-Assistent.lnk - c:\program files\NETGEAR\WG111v3\WG111v3.exe [2009-11-6 2080768]
PUSH650C.lnk - c:\windows\twain_32\PUSH650C.exe [2010-10-16 36864]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2008-11-07 15:41	72208	----a-w-	c:\program files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux4"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages	REG_MULTI_SZ   	kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
2010-09-22 22:47	4240760	----a-w-	c:\program files\Windows Live\Messenger\msnmsgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sidebar]
2009-07-14 01:14	1173504	----a-w-	c:\program files\Windows Sidebar\sidebar.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2010-04-06 00:27	26105128	----a-r-	c:\program files\Skype\Phone\Skype.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WindowsWelcomeCenter]
2009-07-14 01:16	859648	----a-w-	c:\windows\System32\OobeFldr.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\setup\disabledrunkeys]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-01-15 227232]
R3 netr73;Belkin Wireless 54G USB Network Adapter Driver for Vista;c:\windows\system32\DRIVERS\netr73.sys [2007-12-04 464384]
R3 VM650FVM11;UMAX AstraSlim Scanner ProdID x0104;c:\windows\system32\Drivers\USB650C.sys [2001-05-24 10830]
S1 VWiFiFlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2009-10-02 172032]
S2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2011-04-28 136360]
S2 drhard;drhard; [x]
S2 ICQ Service;ICQ Service;c:\program files\ICQ6Toolbar\ICQ Service.exe [2010-01-03 246520]
S3 PAC7311;Trust WB-3400T Webcam;c:\windows\system32\DRIVERS\PA707UCM.SYS [2007-03-14 449024]
S3 RTL8187B;NETGEAR WG111v3 Wireless-G USB Adapter Win7 Driver;c:\windows\system32\DRIVERS\wg111v3.sys [2009-11-18 376832]
S3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [2009-05-08 1047552]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-13 14336]
.
.
.
------- Zusätzlicher Suchlauf -------
.
uDefault_Search_URL = hxxp://www.google.com/ie
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uStart Page = hxxp://start.icq.com/
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Free YouTube to Mp3 Converter - c:\users\mw\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: {{7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - c:\program files\ICQ7.5\ICQ.exe
FF - ProfilePath - c:\users\mw\AppData\Roaming\Mozilla\Firefox\Profiles\8p5nn27v.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.startup.homepage - about:home
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=2.0.0.8&q=
FF - user.js: yahoo.homepage.dontask - true
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'Explorer.exe'(1496)
c:\program files\Logitech\SetPoint\lgscroll.dll
.
Zeit der Fertigstellung: 2011-05-16  20:40:22
ComboFix-quarantined-files.txt  2011-05-16 18:40
.
Vor Suchlauf: 9 Verzeichnis(se), 79.533.391.872 Bytes frei
Nach Suchlauf: 17 Verzeichnis(se), 79.441.616.896 Bytes frei
.
- - End Of File - - 9FC97D10DE3C7B88887551B1869D43AF
         

--- --- ---

1. neustarten, dann läufts wieder.
2.
download malwarebytes:
Malwarebytes : Malwarebytes Anti-Malware is a free download that removes viruses and malware from your computer
instalieren, öffnen, registerkarte aktualisierung, programm updaten.
schalte alle laufenden programme ab, trenne die internetverbindung.
registerkarte scanner, komplett scan, funde entfernen, log posten.

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Datenbank Version: 6592

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

16.05.2011 22:19:02
mbam-log-2011-05-16 (22-18-55).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|E:\|F:\|)
Durchsuchte Objekte: 263181
Laufzeit: 44 Minute(n), 50 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 2

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
c:\_OTL\movedfiles\05162011_200821\C_Users\mw\AppData\Local\Temp\Srd.exe (Trojan.Downloader) -> No action taken.
c:\_OTL\movedfiles\05162011_200821\c_windows\Ssehya.exe (Trojan.Downloader) -> No action taken.

wie läuft das system?

Es funktioniert alles und die Werbung kommt nicht mehr! =)
Ist Entgültig alles weg?

lade den CCleaner slim:
Piriform - Builds
falls der CCleaner bereits instaliert, überspringen.
instalieren, öffnen, extras, liste der instalierten programme, als txt speichern. öffnen.
hinter, jedes von dir benötigte programm, schreibe notwendig.
hinter, jedes, von dir nicht benötigte, unnötig.
hinter, dir unbekannte, unbekannt.
liste posten.

7-Zip 4.65 23.05.2010 notwendig
ACDSee 5.0 Standard ACD Systems Ltd 20.05.2010 24,2MB 5.0.0 unbekannt
Adobe Flash Player 10 ActiveX Adobe Systems Incorporated 23.05.2010 10.0.45.2 unbekannt
Adobe Flash Player 10 Plugin Adobe Systems Incorporated 03.05.2011 6,00MB 10.2.159.1unbekannt
Adobe Photoshop 7.0 Adobe Systems, Inc. 23.05.2010 7.0 notwendig
Adobe Reader 9.4.4 - Deutsch Adobe Systems Incorporated 06.05.2011 164,8MB 9.4.4 unbekannt
Apple Application Support Apple Inc. 24.04.2011 51,0MB 1.5.1 unbekannt
Apple Mobile Device Support Apple Inc. 06.03.2011 21,8MB 3.4.0.25 unbekannt
Apple Software Update Apple Inc. 09.06.2010 2,26MB 2.1.2.120 unbekannt
ATI Catalyst Install Manager ATI Technologies, Inc. 23.05.2010 16,2MB 3.0.750.0 unbekannt
Avira AntiVir Personal - Free Antivirus Avira GmbH 27.04.2011 61,8MB 10.0.0.648 notwendig
Belkin 54Mbps Wireless Network Adapter Belkin 23.05.2010 1.00.01 notwendig
Bonjour Apple Inc. 24.04.2011 0,77MB 2.0.5.0 unbekannt
Carambis Driver Updater Media Fog Ltd. 20.05.2010 5,46MB 1.2.0.2077 unbekannt
CCleaner Piriform 23.05.2010 2.30 notwendig
Counter-Strike 1.6 25.05.2010 1.00.0000 notwendig
DivX-Setup DivX, LLC 04.04.2011 2.4.1.4 notwendig
Dr. Hardware 2010 10.2d Peter A. Gebhard 23.05.2010 unbekannt
Free Audio CD Burner version 1.4.7 DVDVideoSoft Limited. 25.03.2011 10,7MB unbekannt
Free Video to iPod Converter version 3.5 DVDVideoSoft Limited. 26.07.2010 24,6MB notwendig
Free YouTube to MP3 Converter version 3.9.35.324 DVDVideoSoft Limited. 25.03.2011 36,0MB notwendig
GIMP 2.6.7 27.05.2010 notwendig
Graffiti Studio 2.0 Less Rain 16.01.2011 unnötig
ICQ Toolbar ICQ 23.05.2010 3.0.0 notwendig
ICQ7.5 ICQ 25.04.2011 7.5 notwendig
iTunes Apple Inc. 24.04.2011 143,9MB 10.2.2.12 unbekannt
KaloMa 4.92 Frank Böpple 29.03.2011 4,14MB unbekannt
Logitech SetPoint Logitech 19.12.2010 4.70 notwendig
Malwarebytes' Anti-Malware Malwarebytes Corporation 15.05.2011 10,5MB unbekannt
McAfee Security Scan Plus McAfee, Inc. 29.08.2010 8,30MB 2.0.181.2 notwendig
Microsoft .NET Framework 4 Client Profile Microsoft Corporation 24.11.2010 38,8MB 4.0.30319 unbekannt
Microsoft .NET Framework 4 Client Profile DEU Language Pack Microsoft Corporation 24.11.2010 2,94MB 4.0.30319 unbekannt
Microsoft Office Professional Edition 2003 Microsoft Corporation 14.12.2010 857,4MB 11.0.8173.0 notwendig
Microsoft Silverlight Microsoft Corporation 20.12.2010 60,3MB 4.0.51204.0 unbekannt
Microsoft Visual C++ 2005 Redistributable Microsoft Corporation 23.05.2010 2,52MB 8.0.59193 unbekannt
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Microsoft Corporation 22.05.2010 0,58MB 9.0.30729.4148 unbekannt
MobileMe Control Panel Apple Inc. 22.07.2010 10,0MB 3.1.1.0 unbekannt
Mozilla Firefox 4.0.1 (x86 de) Mozilla 02.05.2011 32,0MB 4.0.1 notwendig
MSXML 4.0 SP2 (KB954430) Microsoft Corporation 21.05.2010 35,00KB 4.20.9870.0 unbekannt
MSXML 4.0 SP2 (KB973688) Microsoft Corporation 21.05.2010 1,34MB 4.20.9876.0 unbekannt
Nero 8 Essentials Nero AG 20.05.2010 1.937,5MB 8.3.124 unbekannt
NETGEAR WG111v3 wireless USB 2.0 adapter NETGEAR 29.12.2010 13,9MB 1.01.10 notwendig
NVIDIA Display Control Panel NVIDIA Corporation 24.10.2010 129,0MB 6.14.12.5896 unbekannt
NVIDIA Drivers NVIDIA Corporation 24.10.2010 79,8MB 1.10.62.40 unbekannt
Opera 11.01 Opera Software ASA 14.05.2011 28,1MB 11.01 notwendig
PhotoScape 24.07.2010 notwendig
Picasa 3 Google, Inc. 18.11.2010 3.8 unbekannt
QuickTime Apple Inc. 19.12.2010 73,7MB 7.69.80.9 unbekannt
RAR Password Recovery v1.1 RC17 (remove only) 20.07.2010 unbekannt
RocketDock 1.3.5 Punk Software 24.05.2010 notwendig
Skype™ 4.2 Skype Technologies S.A. 20.05.2010 25,6MB 4.2.158 unbekannt
Spybot - Search & Destroy Safer Networking Limited 06.06.2010 1.6.2 unbekannt
Uninstall 1.0.0.1 25.03.2011 10,9MB unbekannt
VIA Plattform-Geräte-Manager VIA Technologies, Inc. 23.05.2010 2,62MB 1.34 unbekannt
VLC media player 1.0.5 VideoLAN Team 23.05.2010 1.0.5 notwendig
Windows Live Essentials Microsoft Corporation 20.05.2010 15.4.3502.0922 unbekannt
XMedia Recode 2.2.9.7 Sebastian Dörfler 11.01.2011 2.2.9.7 unbekannt
Zattoo4 4.0.4 Zattoo Inc. 23.05.2010 4.0.4 unbekannt

deinstaliere
Adobe Reader 9
Adobe - Adobe Reader herunterladen - Alle Versionen
nimm den haken bei mcafee security scan raus.
öffne den adobe reader, bearbeiten, voreinstellungen, javascript, dort den haken raus,
internet, ebenfalls alle haken raus.
so werden keine pdfs mehr automatisch geladen und es kann dir kein schadcode mehr auf diese weise untergeschoben werden.
unter allgemein, nur zertifizierte zusatzmodule verwenden anhaken.
unter update, auf instalieren stellen.
klicke übernehmen /ok

deinstaliere.
Bonjour
Carambis
Dr. Hardware
Free Audio CD
Graffiti
ICQ Toolbar sicherheitsrisiko, weg damit.
iTunes für musik kaufen bei apple.
falls du das nicht benötigst weg damit und auch die einträge unter apple weg.
KaloMa
McAfee Security Scan hast avira, das reicht.
Nero
Opera öffnen und updaten.

Picasa
QuickTime
RAR Password
Skype™ internet telefonie, falls nötig, öffnen, updaten, falls unnötig, weg.
Spybot
VLC öffnen, updaten.

Windows Live Essentials
Zattoo4
bereinige mit dem ccleaner.

Was meinst du mit bereinige mit ccleaner..
hab jeztt alles rausgeworfen außer itunes, das brauhc ich für mein ipod!