Trojaner-Board - Habe den Trojaner ukash bundeskriminalamt: weiterführung zu vorherigem Thread

Hallo,

ich hoffe auf HIlfe. Habe mir den Virus eingefangen und alles nach eurer Anleitung gemacht. Das ist der OTl. text. Ich hoffe, dass es irgendwas bringt. Vielen Dank schonmal im Voraus.

OTL logfile created on: 17.12.2011 23:09:47 - Run
OTLPE by OldTimer - Version 3.1.48.0 Folder = D:\Programs\OTLPE
Windows Vista (TM) Home Premium Service Pack 2 (Version = 6.0.6002) - Type = System
Internet Explorer (Version = 7.0.6002.18005)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 38,00% Memory free
4,00 Gb Paging File | 3,00 Gb Available in Paging File | 67,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 148,05 Gb Total Space | 25,61 Gb Free Space | 17,30% Space Free | Partition Type: NTFS
Drive D: | 436,59 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS

Computer Name: ROBERTA-PC | User Name: Roberta
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet001

========== Win32 Services (SafeList) ==========

SRV - [2011.06.28 15:29:36 | 000,269,480 | ---- | M] (Avira GmbH) [Auto] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011.04.28 21:46:59 | 000,136,360 | ---- | M] (Avira GmbH) [Auto] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2010.12.08 13:31:06 | 000,628,736 | ---- | M] (Nokia) [On_Demand] -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
SRV - [2008.12.01 11:01:02 | 000,033,752 | ---- | M] (NOS Microsystems Ltd.) [On_Demand] -- C:\Programme\NOS\bin\getPlus_HelperSvc.exe -- (getPlus(R) Helper) getPlus(R)
SRV - [2008.01.19 08:38:24 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2008.01.19 08:36:49 | 000,365,568 | ---- | M] (Microsoft Corporation) [Auto] -- C:\Windows\WindowsMobile\wcescomm.dll -- (WcesComm)
SRV - [2008.01.19 08:36:15 | 000,167,936 | ---- | M] (Microsoft Corporation) [Auto] -- C:\Windows\WindowsMobile\rapimgr.dll -- (RapiMgr)
SRV - [2007.09.04 10:14:34 | 000,087,344 | ---- | M] (AVM Berlin) [Auto] -- C:\Program Files\FRITZ!DSL\IGDCTRL.EXE -- (IGDCTRL)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand] -- -- (VcommMgr)
DRV - File not found [Kernel | On_Demand] -- -- (VComm)
DRV - File not found [Kernel | On_Demand] -- -- (USBAAPL)
DRV - File not found [Kernel | On_Demand] -- -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand] -- -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand] -- -- (IpInIp)
DRV - File not found [Kernel | Boot] -- -- (BTHidMgr)
DRV - File not found [Kernel | Boot] -- -- (BTHidEnum)
DRV - File not found [Kernel | On_Demand] -- -- (Btcsrusb)
DRV - File not found [Kernel | On_Demand] -- -- (BT)
DRV - File not found [Kernel | On_Demand] -- -- (BlueletSCOAudio)
DRV - File not found [Kernel | On_Demand] -- -- (BlueletAudio)
DRV - [2011.06.28 15:29:41 | 000,138,192 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2011.06.28 15:29:41 | 000,066,616 | ---- | M] (Avira GmbH) [File_System | Auto] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2010.07.30 13:16:46 | 000,008,192 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\Windows\System32\drivers\usbser_lowerfltj.sys -- (UsbserFilt)
DRV - [2010.07.30 13:16:44 | 000,008,192 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\Windows\System32\drivers\usbser_lowerflt.sys -- (upperdev)
DRV - [2010.07.30 13:16:42 | 000,023,040 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\Windows\System32\drivers\ccdcmbo.sys -- (nmwcdc)
DRV - [2010.07.30 13:16:38 | 000,018,048 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\Windows\System32\drivers\ccdcmb.sys -- (nmwcd)
DRV - [2010.02.05 04:16:10 | 000,028,048 | ---- | M] (CSR, plc) [Kernel | On_Demand] -- C:\Windows\System32\drivers\BthAvrcp.sys -- (BthAvrcp)
DRV - [2009.05.11 09:12:49 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009.04.11 05:42:52 | 000,031,616 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\winusb.sys -- (winusb)
DRV - [2009.02.13 11:35:01 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\Programme\Avira\AntiVir Desktop\avgio.sys -- (avgio)
DRV - [2008.08.26 08:26:12 | 000,018,816 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\Windows\System32\drivers\pccsmcfd.sys -- (pccsmcfd)
DRV - [2008.05.07 08:55:22 | 000,767,488 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\athr.sys -- (athr)
DRV - [2007.08.22 10:50:38 | 001,749,760 | ---- | M] () [Kernel | On_Demand] -- C:\Windows\System32\drivers\snp2uvc.sys -- (SNP2UVC) USB2.0 PC Camera (SNP2UVC)
DRV - [2007.01.19 00:03:24 | 002,314,752 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\atikmdag.sys -- (R300)
DRV - [2006.11.02 08:41:50 | 000,983,552 | ---- | M] (Agere Systems) [Kernel | On_Demand] -- C:\Windows\System32\drivers\AGRSM.sys -- (AgereSoftModem)
DRV - [2006.11.02 08:30:54 | 001,781,760 | ---- | M] (Intel® Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\NETw3v32.sys -- (NETw3v32) Intel(R)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-342047434-1463686945-2099041522-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.ask.com?o=15015&l=dis
IE - HKU\S-1-5-21-342047434-1463686945-2099041522-1000\Software\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-342047434-1463686945-2099041522-1000\..\URLSearchHook: - Reg Error: Key error. File not found
IE - HKU\S-1-5-21-342047434-1463686945-2099041522-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-342047434-1463686945-2099041522-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.defaultthis.engineName: "Messenger Plus Live France Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2567681&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.selectedEngine: "Ecosia"
FF - prefs.js..browser.search.suggest.enabled: false
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://www.ecosia.org/"
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:2.1.3.20100310105313
FF - prefs.js..extensions.enabledItems: {d04b0b40-3dab-4f0b-97a6-04ec3eddbfb0}:2.0.5
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1
FF - prefs.js..extensions.enabledItems: {872b5b88-9db5-4310-bdd0-ac189557e5f5}:3.3.3.2
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: zoteroOpenOfficeIntegration@zotero.org:3.5a1
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..extensions.enabledItems: engine@conduit.com:3.3.3.2
FF - prefs.js..extensions.enabledItems: {A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}:7.3.4.51
FF - prefs.js..keyword.URL: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2567681&SearchSource=2&q="

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\System32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Programme\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Programme\DivX\DivX Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0:
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Programme\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Programme\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Programme\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Programme\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}: C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension\ [2011.04.05 18:40:34 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.11.28 16:34:39 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.11.28 16:34:39 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\{CCB7D94B-CA92-4E3F-B79D-ADE0F07ADC74}: C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Thunderbird Connector\ThunderbirdExtension\ [2011.04.05 18:40:35 | 000,000,000 | ---D | M]

[2011.02.16 20:12:27 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Roberta\AppData\Roaming\mozilla\Extensions
[2011.02.16 20:12:27 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Roberta\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2011.12.12 19:30:31 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Roberta\AppData\Roaming\mozilla\Firefox\Profiles\431t23o3.default\extensions
[2010.04.29 12:16:31 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Roberta\AppData\Roaming\mozilla\Firefox\Profiles\431t23o3.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011.12.05 16:52:27 | 000,000,000 | ---D | M] (Messenger Plus Live France Community Toolbar) -- C:\Users\Roberta\AppData\Roaming\mozilla\Firefox\Profiles\431t23o3.default\extensions\{59994074-c06d-4a75-9768-49e5a8c21264}
[2010.08.09 09:52:50 | 000,000,000 | ---D | M] ("DVDVideoSoft Menu") -- C:\Users\Roberta\AppData\Roaming\mozilla\Firefox\Profiles\431t23o3.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2011.04.01 15:55:48 | 000,000,000 | ---D | M] (Conduit Engine) -- C:\Users\Roberta\AppData\Roaming\mozilla\Firefox\Profiles\431t23o3.default\extensions\engine@conduit.com
[2011.05.10 20:46:54 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Roberta\AppData\Roaming\mozilla\Firefox\Profiles\431t23o3.default\extensions\nostmp
[2011.11.08 18:51:04 | 000,000,000 | ---D | M] (Zotero LibreOffice Integration) -- C:\Users\Roberta\AppData\Roaming\mozilla\Firefox\Profiles\431t23o3.default\extensions\zoteroOpenOfficeIntegration@zotero.org
[2011.09.27 13:01:12 | 000,000,955 | ---- | M] () -- C:\Users\Roberta\AppData\Roaming\Mozilla\Firefox\Profiles\431t23o3.default\searchplugins\conduit.xml
[2011.05.17 19:25:45 | 000,005,212 | ---- | M] () -- C:\Users\Roberta\AppData\Roaming\Mozilla\Firefox\Profiles\431t23o3.default\searchplugins\ecosia.xml
[2011.12.13 19:28:25 | 000,000,950 | ---- | M] () -- C:\Users\Roberta\AppData\Roaming\Mozilla\Firefox\Profiles\431t23o3.default\searchplugins\icqplugin-1.xml
[2010.12.10 17:50:16 | 000,000,950 | ---- | M] () -- C:\Users\Roberta\AppData\Roaming\Mozilla\Firefox\Profiles\431t23o3.default\searchplugins\icqplugin-2.xml
[2010.04.02 11:36:13 | 000,000,950 | ---- | M] () -- C:\Users\Roberta\AppData\Roaming\Mozilla\Firefox\Profiles\431t23o3.default\searchplugins\icqplugin-3.xml
[2010.04.30 17:32:52 | 000,000,950 | ---- | M] () -- C:\Users\Roberta\AppData\Roaming\Mozilla\Firefox\Profiles\431t23o3.default\searchplugins\icqplugin-4.xml
[2010.07.02 18:27:24 | 000,000,950 | ---- | M] () -- C:\Users\Roberta\AppData\Roaming\Mozilla\Firefox\Profiles\431t23o3.default\searchplugins\icqplugin-5.xml
[2010.07.21 14:03:38 | 000,000,950 | ---- | M] () -- C:\Users\Roberta\AppData\Roaming\Mozilla\Firefox\Profiles\431t23o3.default\searchplugins\icqplugin-6.xml
[2010.10.05 18:16:46 | 000,000,950 | ---- | M] () -- C:\Users\Roberta\AppData\Roaming\Mozilla\Firefox\Profiles\431t23o3.default\searchplugins\icqplugin-7.xml
[2010.10.30 10:39:28 | 000,000,950 | ---- | M] () -- C:\Users\Roberta\AppData\Roaming\Mozilla\Firefox\Profiles\431t23o3.default\searchplugins\icqplugin-8.xml
[2010.10.30 10:41:10 | 000,000,950 | ---- | M] () -- C:\Users\Roberta\AppData\Roaming\Mozilla\Firefox\Profiles\431t23o3.default\searchplugins\icqplugin-9.xml
[2009.06.07 13:21:06 | 000,000,944 | ---- | M] () -- C:\Users\Roberta\AppData\Roaming\Mozilla\Firefox\Profiles\431t23o3.default\searchplugins\icqplugin.xml
[2011.11.13 09:35:27 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2009.06.10 17:09:38 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Programme\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
File not found (No name found) --
[2011.11.13 09:35:20 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2011.05.04 03:52:23 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2011.10.07 12:40:59 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011.10.07 12:40:59 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2011.10.07 12:40:59 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2011.10.07 12:40:59 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2011.10.07 12:40:59 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2011.10.07 12:40:59 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml

O1 HOSTS File: ([2006.09.18 22:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (XTTBPos00 Class) - {055FD26D-3A88-4e15-963D-DC8493744B1D} - C:\Programme\ICQToolbar\toolbaru.dll (IE Toolbar)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O3 - HKU\S-1-5-21-342047434-1463686945-2099041522-1000\..\Toolbar\WebBrowser: (no name) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - No CLSID value found.
O3 - HKU\S-1-5-21-342047434-1463686945-2099041522-1000\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [NokiaMServer] C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe (Nokia)
O4 - HKLM..\Run: [SMSTray] C:\Programme\Samsung\EmoDio\SMSTray.exe (SAMSUNG ELECTRONICS)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKLM..\Run: [Windows Mobile-based device management] C:\Windows\WindowsMobile\wmdSync.exe (Microsoft Corporation)
O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-21-342047434-1463686945-2099041522-1000..\Run: [] File not found
O4 - HKU\S-1-5-21-342047434-1463686945-2099041522-1000..\Run: [NokiaOviSuite2] C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe (Nokia)
O4 - HKU\S-1-5-21-342047434-1463686945-2099041522-1000..\Run: [WMPNSCFG] C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)
O4 - Startup: C:\Users\Roberta\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FRITZ!DSL Internet.lnk = C:\Programme\FRITZ!DSL\FritzDsl.exe (AVM Berlin)
O4 - Startup: C:\Users\Roberta\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk = C:\Programme\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
O4 - Startup: C:\Users\Roberta\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.1.lnk = C:\Programme\OpenOffice.org 3\program\quickstart.exe ()
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\Roberta\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm ()
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\FRITZ!DSL\\sarah.dll ()
O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\FRITZ!DSL\sarah.dll (AVM Berlin)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\FRITZ!DSL\sarah.dll (AVM Berlin)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files\FRITZ!DSL\sarah.dll (AVM Berlin)
O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\Program Files\FRITZ!DSL\sarah.dll (AVM Berlin)
O13 - gopher Prefix: missing
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} hxxp://download.divx.com/player/DivXBrowserPlugin.cab (DivXBrowserPlugin Object)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programme\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img33.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img33.jpg
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2006.03.24 12:06:41 | 000,000,053 | R--- | M] () - D:\AUTORUN.INF -- [ CDFS ]
O33 - MountPoints2\{50ad3862-84ae-11dd-8d86-00e091330c2a}\Shell\AutoRun\command - "" = E:\Menu.exe
O33 - MountPoints2\{62ee4ada-494b-11de-a2e9-000df0469d78}\Shell\AutoRun\command - "" = E:\wd_windows_tools\setup.exe
O33 - MountPoints2\{642e1664-9d6e-11dd-8723-00e091330c2a}\Shell - "" = AutoRun
O33 - MountPoints2\{642e1664-9d6e-11dd-8723-00e091330c2a}\Shell\AutoRun\command - "" = F:\Menu.exe
O33 - MountPoints2\{85269f56-bb09-11dc-ae4b-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{85269f56-bb09-11dc-ae4b-806e6f6e6963}\Shell\AutoRun\command - "" = D:\reatogoMenu.exe -- [2005.07.16 22:36:50 | 000,240,128 | R--- | M] ()
O33 - MountPoints2\{94b960b3-0c34-11e0-847d-000df0469d78}\Shell - "" = AutoRun
O33 - MountPoints2\{94b960b3-0c34-11e0-847d-000df0469d78}\Shell\AutoRun\command - "" = G:\LaunchU3.exe -a
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011.12.14 19:00:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
[2011.12.14 19:00:13 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2011.12.14 08:27:25 | 000,000,000 | ---D | C] -- C:\88d7a5bcc16051f97a
[2011.12.14 07:15:02 | 003,602,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntkrnlpa.exe
[2011.12.14 07:15:02 | 003,550,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntoskrnl.exe
[2011.12.14 07:14:58 | 000,429,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\EncDec.dll
[2011.12.14 07:14:51 | 002,043,904 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2011.12.14 07:14:42 | 001,383,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2011.12.14 07:14:42 | 000,671,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mstime.dll
[2011.12.14 07:14:42 | 000,471,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll
[2011.12.14 07:14:42 | 000,389,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\html.iec
[2011.12.14 07:14:42 | 000,193,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll
[2011.12.14 07:14:42 | 000,106,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll
[2011.12.14 07:14:41 | 000,380,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieapfltr.dll
[2011.12.14 07:14:38 | 000,049,152 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\csrsrv.dll
[2011.12.14 07:14:26 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\tzres.dll
[2011.11.28 16:34:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
[2011.11.28 16:33:32 | 000,000,000 | ---D | C] -- C:\Program Files\QuickTime
[2011.11.28 16:29:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2011.11.28 16:27:28 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[2011.11.28 16:16:29 | 000,000,000 | ---D | C] -- C:\Program Files\Bonjour
[2011.11.26 12:47:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth
[2007.07.04 08:28:52 | 000,176,128 | ---- | C] ( ) -- C:\Windows\System32\csnp2uvc.dll

========== Files - Modified Within 30 Days ==========

[2011.12.17 23:09:36 | 000,000,680 | ---- | M] () -- C:\Users\Roberta\AppData\Local\d3d9caps.dat
[2011.12.17 23:08:11 | 000,001,096 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011.12.17 23:08:11 | 000,000,442 | ---- | M] () -- C:\Windows\tasks\RegCure Program Check.job
[2011.12.17 23:05:08 | 000,003,168 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011.12.17 23:05:07 | 000,003,168 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011.12.17 23:04:41 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011.12.17 23:04:37 | 1874,989,056 | -HS- | M] () -- C:\hiberfil.sys
[2011.12.17 22:43:00 | 000,001,100 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011.12.17 22:30:05 | 000,002,140 | ---- | M] () -- C:\Windows\bthservsdp.dat
[2011.12.17 22:10:40 | 000,000,894 | ---- | M] () -- C:\Users\Roberta\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0.4150505284230738.exe.lnk
[2011.12.17 15:52:57 | 000,618,794 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011.12.17 15:52:56 | 000,655,196 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2011.12.17 15:52:56 | 000,140,184 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2011.12.17 15:52:56 | 000,114,882 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011.12.14 19:00:16 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
[2011.12.14 19:00:15 | 000,000,810 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2011.12.14 09:11:06 | 000,390,592 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2011.12.10 14:06:30 | 000,015,872 | ---- | M] () -- C:\Users\Roberta\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.11.28 16:34:10 | 000,001,732 | ---- | M] () -- C:\Users\Public\Desktop\QuickTime Player.lnk
[2011.11.28 16:34:10 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
[2011.11.28 16:29:27 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2011.11.28 16:29:26 | 000,001,670 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk
[2011.11.26 12:47:55 | 000,002,079 | ---- | M] () -- C:\Users\Public\Desktop\Google Earth.lnk
[2011.11.26 12:47:55 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth
[2011.11.23 14:37:27 | 002,043,904 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys

========== Files Created - No Company Name ==========

[2011.12.17 22:10:40 | 000,000,894 | ---- | C] () -- C:\Users\Roberta\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0.4150505284230738.exe.lnk
[2011.12.14 19:00:15 | 000,000,810 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2011.11.28 16:34:10 | 000,001,732 | ---- | C] () -- C:\Users\Public\Desktop\QuickTime Player.lnk
[2011.11.28 16:29:26 | 000,001,670 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk
[2011.11.26 12:47:55 | 000,002,079 | ---- | C] () -- C:\Users\Public\Desktop\Google Earth.lnk
[2011.03.19 17:22:53 | 000,000,065 | ---- | C] () -- C:\Windows\FISHUI.INI
[2010.01.13 10:06:17 | 000,043,520 | ---- | C] () -- C:\Windows\System32\CmdLineExt03.dll
[2009.09.11 15:08:16 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2009.09.11 15:08:15 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2009.06.22 16:43:13 | 000,000,680 | ---- | C] () -- C:\Users\Roberta\AppData\Local\d3d9caps.dat
[2008.09.17 12:36:22 | 000,921,600 | ---- | C] () -- C:\Windows\System32\vorbisenc.dll
[2008.09.17 12:36:20 | 000,237,568 | ---- | C] () -- C:\Windows\System32\OggDS.dll
[2008.09.17 12:36:20 | 000,188,416 | ---- | C] () -- C:\Windows\System32\vorbis.dll
[2008.09.17 12:36:20 | 000,045,056 | ---- | C] () -- C:\Windows\System32\Ogg.dll
[2008.07.25 21:02:41 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2008.02.02 11:58:08 | 000,000,032 | ---- | C] () -- C:\ProgramData\ezsid.dat
[2008.01.05 12:37:56 | 000,015,872 | ---- | C] () -- C:\Users\Roberta\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007.08.22 10:50:38 | 001,749,760 | ---- | C] () -- C:\Windows\System32\drivers\snp2uvc.sys
[2007.08.22 09:16:00 | 000,046,456 | R--- | C] () -- C:\Windows\System32\exitwx.exe
[2007.05.09 06:16:40 | 000,028,160 | ---- | C] () -- C:\Windows\System32\drivers\sncduvc.sys
[2007.01.11 14:13:07 | 000,081,920 | ---- | C] () -- C:\Windows\WinReLetter.exe
[2007.01.09 19:49:26 | 000,002,140 | ---- | C] () -- C:\Windows\bthservsdp.dat
[2007.01.09 19:49:05 | 000,000,000 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat
[2006.11.02 16:33:31 | 000,655,196 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2006.11.02 16:33:31 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2006.11.02 16:33:31 | 000,140,184 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2006.11.02 16:33:31 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2006.11.02 13:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006.11.02 13:47:37 | 000,390,592 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006.11.02 13:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006.11.02 11:33:01 | 000,618,794 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2006.11.02 11:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2006.11.02 11:33:01 | 000,114,882 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2006.11.02 11:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2006.11.02 11:25:44 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll
[2006.11.02 11:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2006.11.02 09:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006.11.02 09:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2006.11.02 08:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006.11.02 08:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2006.05.19 02:39:58 | 000,015,497 | ---- | C] () -- C:\Windows\snp2uvc.ini

========== LOP Check ==========

[2010.01.13 10:06:32 | 000,000,000 | ---D | M] -- C:\Users\Roberta\AppData\Roaming\Atari
[2011.03.19 12:12:18 | 000,000,000 | ---D | M] -- C:\Users\Roberta\AppData\Roaming\DataCast
[2009.10.11 17:48:12 | 000,000,000 | ---D | M] -- C:\Users\Roberta\AppData\Roaming\DriverCure
[2010.08.09 09:52:48 | 000,000,000 | ---D | M] -- C:\Users\Roberta\AppData\Roaming\DVDVideoSoftIEHelpers
[2011.10.07 13:19:11 | 000,000,000 | ---D | M] -- C:\Users\Roberta\AppData\Roaming\FRITZ!
[2008.04.30 10:06:02 | 000,000,000 | ---D | M] -- C:\Users\Roberta\AppData\Roaming\GoPal Assistant
[2010.11.05 19:37:17 | 000,000,000 | ---D | M] -- C:\Users\Roberta\AppData\Roaming\Hansenet
[2008.01.31 21:22:13 | 000,000,000 | ---D | M] -- C:\Users\Roberta\AppData\Roaming\ICQ Toolbar
[2010.01.13 10:05:17 | 000,000,000 | ---D | M] -- C:\Users\Roberta\AppData\Roaming\Leadertech
[2010.01.09 12:05:33 | 000,000,000 | ---D | M] -- C:\Users\Roberta\AppData\Roaming\OpenOffice.org
[2011.04.13 20:12:38 | 000,000,000 | ---D | M] -- C:\Users\Roberta\AppData\Roaming\PC Suite
[2011.02.16 20:12:25 | 000,000,000 | ---D | M] -- C:\Users\Roberta\AppData\Roaming\Thunderbird
[2008.01.04 22:21:35 | 000,000,000 | -HSD | M] -- C:\ProgramData\Anwendungsdaten
[2006.11.02 14:02:03 | 000,000,000 | -HSD | M] -- C:\ProgramData\Application Data
[2011.04.12 14:27:03 | 000,000,000 | ---D | M] -- C:\ProgramData\Bluetooth
[2006.11.02 14:02:03 | 000,000,000 | -HSD | M] -- C:\ProgramData\Desktop
[2006.11.02 14:02:03 | 000,000,000 | -HSD | M] -- C:\ProgramData\Documents
[2008.01.04 22:21:35 | 000,000,000 | -HSD | M] -- C:\ProgramData\Dokumente
[2009.10.31 12:01:50 | 000,000,000 | ---D | M] -- C:\ProgramData\DriverCure
[2008.01.04 22:21:35 | 000,000,000 | -HSD | M] -- C:\ProgramData\Favoriten
[2006.11.02 14:02:03 | 000,000,000 | -HSD | M] -- C:\ProgramData\Favorites
[2009.06.10 17:09:42 | 000,000,000 | ---D | M] -- C:\ProgramData\ICQ
[2011.04.13 20:14:25 | 000,000,000 | ---D | M] -- C:\ProgramData\Nokia
[2011.04.05 18:28:08 | 000,000,000 | ---D | M] -- C:\ProgramData\NokiaInstallerCache
[2009.10.11 17:46:44 | 000,000,000 | ---D | M] -- C:\ProgramData\ParetoLogic
[2011.04.20 18:02:46 | 000,000,000 | ---D | M] -- C:\ProgramData\PC Suite
[2006.11.02 14:02:03 | 000,000,000 | -HSD | M] -- C:\ProgramData\Start Menu
[2008.01.04 22:21:35 | 000,000,000 | -HSD | M] -- C:\ProgramData\Startmenü
[2006.11.02 14:02:04 | 000,000,000 | -HSD | M] -- C:\ProgramData\Templates
[2008.01.04 22:21:35 | 000,000,000 | -HSD | M] -- C:\ProgramData\Vorlagen
[2008.12.06 11:26:48 | 000,000,000 | ---D | M] -- C:\ProgramData\WindowsSearch
[2010.04.06 18:14:23 | 000,000,000 | ---D | M] -- C:\ProgramData\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2009.09.16 17:24:26 | 000,000,000 | ---D | M] -- C:\ProgramData\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2009.06.06 15:05:11 | 000,000,000 | ---D | M] -- C:\ProgramData\{7B6BA59A-FB0E-4499-8536-A7420338BF3B}
[2009.04.27 20:39:37 | 000,000,000 | ---D | M] -- C:\ProgramData\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2011.12.17 23:08:11 | 000,000,442 | ---- | M] () -- C:\Windows\Tasks\RegCure Program Check.job
[2011.11.11 17:48:06 | 000,000,376 | ---- | M] () -- C:\Windows\Tasks\RegCure.job
[2011.12.17 22:30:02 | 000,032,514 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========

< End of report >