Trojaner-Board - BKA Trojaner/Virus eingefangen, kann außer abgesichertem Modus nix mehr machen

Trojaner-Board (https://www.trojaner-board.de/)

- Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)

- - BKA Trojaner/Virus eingefangen, kann außer abgesichertem Modus nix mehr machen (https://www.trojaner-board.de/104872-bka-trojaner-virus-eingefangen-ausser-abgesichertem-modus-nix-mehr.html)

BKA Trojaner/Virus eingefangen, kann außer abgesichertem Modus nix mehr machen

Hallo

Mein Sohn hat mir seinen Laptop (HP Pavilion g series, Windows7) zur "Rettung" überlassen.

Er hat bereits versucht im abgesicherten Modus AntiVir laufen zu lassen, findet wohl auch 4 Trojaner/Viren, stoppt aber laut seiner Aussage bei ca. 45%.

Ich komme nicht mehr an die normale Bildschirmoberfläche, den Taskmanager kann ich auch nicht öffnen.

Ich habe schon gelesen was ich mir Alles runterladen soll, das geht ja aber nun nicht.

Wäre toll wenn mir Jemand helfen kann.

Gruß
Mondstein

aber du hast doch nen zweiten pc zur verfügung, sonst könntest du uns nicht schreiben oder schreibst du von nem smartphone etc?
download:
http://filepony.de/download-otlpe/
und brenne es mit ISOBurner auf eine CD.
ISO Burner Download - ISO Burner 2.5
isoburner anleitung:
http://www.trojaner-board.de/83208-b...ei-cd-dvd.html
• Wenn der Download fertig ist mache ein doppel Klick auf die Datei, was ISOBurner öffnet um es auf die CD zu brennen.
Starte dein System neu und boote von der CD die du gerade erstellt hast.
Wenn du nicht weist wie du deinen Computer dazu bringst von der CD zu booten,
http://www.trojaner-board.de/81857-c...cd-booten.html

• Dein System sollte jetzt einen REATOGO-X-PE Desktop anzeigen.
• Mache einen doppel Klick auf das OTLPE Icon.
• Wenn du gefragt wirst "Do you wish to load the remote registry", dann wähle Yes.
• Wenn du gefragt wirst "Do you wish to load remote user profile(s) for scanning", dann wähle Yes.
• entferne den haken bei "Automatically Load All Remaining Users" wenn er gesetzt ist.

• OTL sollte nun starten.
• Drücke Run Scan um den Scan zu starten.
• Wenn er fertig ist werden die Dateien in C:\otl.txt gesichert
• Kopiere diesen Ordner auf deinen USB-Stick wenn du keine Internetverbindung auf diesem System hast.
poste beide logs

Hallo Markusg

Ich hab mir die Programme runtergeladen, die CD gebrannt, aber ich bekomme es irgendwie nicht hin von der CD zu booten:headbang:

allerdings habe ich jetzt den Laptop hochgefahren und das lästige BKA-Fenster ist nicht mehr zu sehen, kann ich OTLPE direkt von der CD starten?

Edit: Ich glaub ich habe es doch geschafft, der Scan läuft

Mondstein

Hallo

Ich hoffe ich hab jetzt nix falsch gemachtOTL Logfile:

Code:

OTL logfile created on: 07.11.2011 13:50:24 - Run 

OTLPE by OldTimer - Version 3.1.48.0     Folder = E:\Programs\OTLPE

64bit-Windows 7 Home Premium  (Version = 6.1.7600) - Type = System

Internet Explorer (Version = 8.0.7600.16385)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

4,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 62,00% Memory free

8,00 Gb Paging File | 6,00 Gb Available in Paging File | 75,00% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 450,93 Gb Total Space | 323,28 Gb Free Space | 71,69% Space Free | Partition Type: NTFS

Drive D: | 14,53 Gb Total Space | 1,79 Gb Free Space | 12,33% Space Free | Partition Type: NTFS

Drive E: | 436,59 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS

Drive F: | 99,02 Mb Total Space | 88,70 Mb Free Space | 89,57% Space Free | Partition Type: FAT32

 

Computer Name: H-CRITTERSHAUß | User Name: H.-C.Rittershauß

Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

Using ControlSet: ControlSet001

 
 ========== Win32 Services (SafeList) ==========

 

SRV:64bit: - [2010.09.22 18:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled] -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)

SRV:64bit: - [2010.08.05 19:51:08 | 000,291,896 | ---- | M] (Hewlett-Packard Company) [Auto] -- C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe -- (HPClientSvc)

SRV:64bit: - [2010.08.05 19:47:48 | 000,681,528 | ---- | M] (Hewlett-Packard) [Auto] -- C:\Program Files\Hewlett-Packard\HP Auto\HPAuto.exe -- (HPAuto)

SRV:64bit: - [2010.07.21 14:33:00 | 000,103,992 | ---- | M] (Hewlett-Packard Company) [Auto] -- C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe -- (HP Wireless Assistant Service)

SRV:64bit: - [2010.04.23 12:00:00 | 000,514,232 | ---- | M] (EasyBits Software AS) [Auto] -- C:\Windows\System32\ezSharedSvcHost.exe -- (ezSharedSvc)

SRV - [2011.11.07 13:27:36 | 000,419,624 | ---- | M] (Valve Corporation) [On_Demand] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)

SRV - [2011.07.05 16:02:58 | 000,227,384 | ---- | M] (Hewlett-Packard Company) [Auto] -- C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe -- (HPDrvMntSvc.exe)

SRV - [2011.06.28 18:36:42 | 000,269,480 | ---- | M] (Avira GmbH) [Auto] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)

SRV - [2011.06.21 14:57:34 | 000,085,560 | ---- | M] (Hewlett-Packard Company) [Auto] -- C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe -- (HP Support Assistant Service)

SRV - [2011.04.28 21:46:05 | 000,136,360 | ---- | M] (Avira GmbH) [Auto] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)

SRV - [2011.02.28 17:44:14 | 000,183,560 | ---- | M] (Microsoft Corporation.) [On_Demand] -- C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE -- (BBSvc)

SRV - [2011.02.25 09:46:22 | 000,249,648 | ---- | M] (Microsoft Corporation) [Auto] -- C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE -- (SeaPort)

SRV - [2011.01.12 17:00:42 | 000,013,336 | ---- | M] (Intel Corporation) [Auto] -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc) Intel(R)

SRV - [2010.12.13 23:04:46 | 000,275,968 | ---- | M] (IDT, Inc.) [Auto] -- C:\Programme\IDT\WDM\stacsv64.exe -- (STacSV)

SRV - [2010.11.21 10:49:24 | 000,247,608 | ---- | M] () [Auto] -- C:\Program Files (x86)\ICQ6Toolbar\ICQ Service.exe -- (ICQ Service)

SRV - [2010.11.09 15:20:34 | 000,026,680 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Auto] -- C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe -- (HPWMISVC)

SRV - [2010.10.12 18:59:12 | 000,206,072 | ---- | M] (WildTangent, Inc.) [On_Demand] -- C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe -- (GamesAppService)

SRV - [2010.07.23 20:44:54 | 002,320,920 | ---- | M] (Intel Corporation) [Auto] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS) Intel(R)

SRV - [2010.07.23 20:44:48 | 000,268,824 | ---- | M] (Intel Corporation) [Auto] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS) Intel(R)

SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)

SRV - [2009.06.10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)

 

 
 ========== Driver Services (SafeList) ==========

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPNOT/4

 

 

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

 

 

IE - HKU\S-1-5-21-3880097196-1087461709-2136809990-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4

IE - HKU\S-1-5-21-3880097196-1087461709-2136809990-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.icq.com/sm

IE - HKU\S-1-5-21-3880097196-1087461709-2136809990-1000\..\URLSearchHook:  - Reg Error: Key error. File not found

IE - HKU\S-1-5-21-3880097196-1087461709-2136809990-1000\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll (ICQ)

IE - HKU\S-1-5-21-3880097196-1087461709-2136809990-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 
 ========== FireFox ==========

 

FF - prefs.js..browser.search.defaultenginename: "ICQ Search"

FF - prefs.js..browser.search.defaulturl: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.2.9&q="

FF - prefs.js..browser.search.selectedEngine: "ICQ Search"

FF - prefs.js..browser.startup.homepage: "hxxp://start.icq.com/"

FF - prefs.js..keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.3.3&q="

 

 

FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()

FF - HKLM\Software\Wow6432Node\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)

FF - HKLM\Software\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\Wow6432Node\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKLM\Software\Wow6432Node\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

FF - HKLM\Software\Wow6432Node\MozillaPlugins\@WildTangent.com/GamesAppPresenceDetector,Version=1.0: C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()

FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

 

FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Firefox\Extensions\\{3252b9ae-c69a-4eaf-9502-dc9c1f6c009e}: C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DMExtension\ [2011.02.20 01:50:52 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Mozilla Firefox 5.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011.07.03 17:51:19 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Mozilla Firefox 5.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins

 

[2011.03.22 17:27:10 | 000,000,000 | ---D | M] (No name found) -- C:\Users\H.-C.Rittershauß\AppData\Roaming\mozilla\Extensions

[2011.10.25 21:32:25 | 000,000,000 | ---D | M] (No name found) -- C:\Users\H.-C.Rittershauß\AppData\Roaming\mozilla\Firefox\Profiles\pn47jxqx.default\extensions

[2011.10.25 21:32:25 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Users\H.-C.Rittershauß\AppData\Roaming\mozilla\Firefox\Profiles\pn47jxqx.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}

[2011.09.29 19:46:31 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Users\H.-C.Rittershauß\AppData\Roaming\mozilla\Firefox\Profiles\pn47jxqx.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}

[2011.08.12 19:21:26 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\H.-C.Rittershauß\AppData\Roaming\mozilla\Firefox\Profiles\pn47jxqx.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}

[2011.10.07 14:21:13 | 000,000,000 | ---D | M] ("Ask Toolbar") -- C:\Users\H.-C.Rittershauß\AppData\Roaming\mozilla\Firefox\Profiles\pn47jxqx.default\extensions\toolbar@ask.com

[2011.11.01 19:33:24 | 000,000,950 | ---- | M] () -- C:\Users\H.-C.Rittershauß\AppData\Roaming\Mozilla\Firefox\Profiles\pn47jxqx.default\searchplugins\icqplugin-1.xml

[2011.05.13 17:31:14 | 000,000,950 | ---- | M] () -- C:\Users\H.-C.Rittershauß\AppData\Roaming\Mozilla\Firefox\Profiles\pn47jxqx.default\searchplugins\icqplugin-2.xml

[2011.06.21 22:59:21 | 000,000,950 | ---- | M] () -- C:\Users\H.-C.Rittershauß\AppData\Roaming\Mozilla\Firefox\Profiles\pn47jxqx.default\searchplugins\icqplugin-3.xml

[2011.07.04 18:44:25 | 000,000,950 | ---- | M] () -- C:\Users\H.-C.Rittershauß\AppData\Roaming\Mozilla\Firefox\Profiles\pn47jxqx.default\searchplugins\icqplugin-4.xml

[2011.08.17 04:48:20 | 000,000,950 | ---- | M] () -- C:\Users\H.-C.Rittershauß\AppData\Roaming\Mozilla\Firefox\Profiles\pn47jxqx.default\searchplugins\icqplugin-5.xml

[2011.08.22 15:20:17 | 000,000,950 | ---- | M] () -- C:\Users\H.-C.Rittershauß\AppData\Roaming\Mozilla\Firefox\Profiles\pn47jxqx.default\searchplugins\icqplugin-6.xml

[2011.10.04 18:59:19 | 000,000,950 | ---- | M] () -- C:\Users\H.-C.Rittershauß\AppData\Roaming\Mozilla\Firefox\Profiles\pn47jxqx.default\searchplugins\icqplugin-7.xml

[2011.03.30 14:14:34 | 000,001,042 | ---- | M] () -- C:\Users\H.-C.Rittershauß\AppData\Roaming\Mozilla\Firefox\Profiles\pn47jxqx.default\searchplugins\icqplugin.xml

[2011.07.18 20:28:17 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions

[2011.03.22 17:52:04 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}

[2011.07.18 20:28:17 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}

File not found (No name found) -- 

File not found (No name found) -- C:\USERS\H.-C.RITTERSHAUÃŸ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PN47JXQX.DEFAULT\EXTENSIONS\{635ABD67-4FE9-1B23-4F01-E679FA7484C1}

File not found (No name found) -- C:\USERS\H.-C.RITTERSHAUÃŸ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PN47JXQX.DEFAULT\EXTENSIONS\{800B5000-A755-47E1-992B-48A1C1357F07}

File not found (No name found) -- C:\USERS\H.-C.RITTERSHAUÃŸ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PN47JXQX.DEFAULT\EXTENSIONS\{ACAA314B-EEBA-48E4-AD47-84E31C44796C}

File not found (No name found) -- C:\USERS\H.-C.RITTERSHAUÃŸ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PN47JXQX.DEFAULT\EXTENSIONS\TOOLBAR@ASK.COM

[2011.07.03 17:51:18 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll

[2010.01.01 09:00:00 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml

[2010.01.01 09:00:00 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml

[2010.01.01 09:00:00 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml

[2010.01.01 09:00:00 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml

[2010.01.01 09:00:00 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml

[2010.01.01 09:00:00 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml

 

O1 HOSTS File: ([2009.06.10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts

O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)

O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)

O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)

O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll (ICQ)

O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)

O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)

O3 - HKU\S-1-5-21-3880097196-1087461709-2136809990-1000\..\Toolbar\WebBrowser: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No CLSID value found.

O3 - HKU\S-1-5-21-3880097196-1087461709-2136809990-1000\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)

O4:64bit: - HKLM..\Run: [HotKeysCmds]  File not found

O4:64bit: - HKLM..\Run: [HPWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\DelayedAppStarter.exe ()

O4:64bit: - HKLM..\Run: [IgfxTray]  File not found

O4:64bit: - HKLM..\Run: [Persistence]  File not found

O4:64bit: - HKLM..\Run: [SysTrayApp] C:\Programme\IDT\WDM\sttray64.exe (IDT, Inc.)

O4 - HKLM..\Run: []  File not found

O4 - HKLM..\Run: [ApnUpdater] C:\Program Files (x86)\Ask.com\Updater\Updater.exe (Ask)

O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)

O4 - HKLM..\Run: [Easybits Recovery] C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe (EasyBits Software AS)

O4 - HKLM..\Run: [HP Quick Launch] C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe (Hewlett-Packard Development Company, L.P.)

O4 - HKLM..\Run: [HPOSD] C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe (Hewlett-Packard Development Company, L.P.)

O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)

O4 - HKLM..\Run: [IMSS] C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe ()

O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)

O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)

O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)

O4 - HKU\S-1-5-21-3880097196-1087461709-2136809990-1000..\Run: [DriverScanner] C:\Program Files (x86)\Uniblue\DriverScanner\launcher.exe (Uniblue Systems Limited)

O4 - HKU\S-1-5-21-3880097196-1087461709-2136809990-1000..\Run: [ICQ] C:\Program Files (x86)\ICQ7.4\ICQ.exe (ICQ, LLC.)

O4 - HKU\S-1-5-21-3880097196-1087461709-2136809990-1000..\Run: [SpybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe (Safer Networking Limited)

O4 - HKU\S-1-5-21-3880097196-1087461709-2136809990-1000..\Run: [Steam] C:\Program Files (x86)\Steam\Steam.exe (Valve Corporation)

O4 - HKU\S-1-5-19..\RunOnce: [mctadmin]  File not found

O4 - HKU\S-1-5-20..\RunOnce: [mctadmin]  File not found

O4 - Startup: C:\Users\H.-C.Rittershauß\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: EnableShellExecuteHooks = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideFastUserSwitching = 0

O7 - HKU\S-1-5-21-3880097196-1087461709-2136809990-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableLockWorkstation = 0

O7 - HKU\S-1-5-21-3880097196-1087461709-2136809990-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableChangePassword = 0

O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\H.-C.Rittershauß\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()

O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\H.-C.Rittershauß\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()

O9 - Extra Button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files (x86)\ICQ7.5\ICQ.exe (ICQ, LLC.)

O9 - Extra 'Tools' menuitem : ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files (x86)\ICQ7.5\ICQ.exe (ICQ, LLC.)

O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)

O13:64bit: - gopher Prefix: missing

O13 - gopher Prefix: missing

O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)

O16:64bit: - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)

O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Reg Error: Key error.)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)

O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)

O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1

O18:64bit: - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found

O18:64bit: - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found

O18:64bit: - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not found

O18:64bit: - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - Reg Error: Key error. File not found

O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\System32\explorer.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O20:64bit: - Winlogon\Notify\igfxcui: DllName - Reg Error: Key error. -  File not found

O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.

O28 - HKLM ShellExecuteHooks: {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWOW64\ezUPBHook.dll (EasyBits Software Corp.)

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2006.03.24 12:06:41 | 000,000,053 | R--- | M] () - E:\AUTORUN.INF -- [ CDFS ]

O33 - MountPoints2\{c02ac8a7-5490-11e0-be39-806e6f6e6963}\Shell - "" = AutoRun

O33 - MountPoints2\{c02ac8a7-5490-11e0-be39-806e6f6e6963}\Shell\AutoRun\command - "" = E:\reatogoMenu.exe -- [2005.07.16 22:36:50 | 000,240,128 | R--- | M] ()

O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
 64bit: O35 - HKLM\..comfile [open] -- "%1" %* File not found
 64bit: O35 - HKLM\..exefile [open] -- "%1" %* File not found

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*

O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2011.11.07 13:31:49 | 000,000,000 | ---D | C] -- C:\Users\H.-C.Rittershauß\AppData\Local\{AAA4EE5E-5FCC-45FC-B348-D5A980AA2D90}

[2011.11.07 13:27:31 | 000,000,000 | ---D | C] -- C:\Users\H.-C.Rittershauß\AppData\Local\{2808D92A-4C3E-45E2-8718-CD1281DE6F9B}

[2011.11.07 13:27:08 | 000,000,000 | ---D | C] -- C:\Users\H.-C.Rittershauß\AppData\Local\{3A528712-D4E6-4AE1-B7CD-36C497B15D20}

[2011.11.06 12:20:21 | 000,000,000 | ---D | C] -- C:\Users\H.-C.Rittershauß\AppData\Local\{3C2EC5CF-FF50-4948-A207-83D3A8EC2E76}

[2011.11.06 12:19:59 | 000,000,000 | ---D | C] -- C:\Users\H.-C.Rittershauß\AppData\Local\{B6EACB21-85FA-4BE9-ADFA-F166408CE04D}

[2011.11.04 14:35:52 | 000,000,000 | ---D | C] -- C:\Users\H.-C.Rittershauß\AppData\Local\{6CD8C1B7-AE7F-4912-B6A3-BF69F3A72D6D}

[2011.11.04 14:35:35 | 000,000,000 | ---D | C] -- C:\Users\H.-C.Rittershauß\AppData\Local\{BA4B479F-72C8-4E19-A5A7-E7E482451452}

[2011.11.04 05:54:16 | 000,000,000 | ---D | C] -- C:\Users\H.-C.Rittershauß\AppData\Local\{72AAFC1F-5D3E-4226-96B2-F5C39BF0C2D4}

[2011.11.04 05:54:05 | 000,000,000 | ---D | C] -- C:\Users\H.-C.Rittershauß\AppData\Local\{278EFBFC-45E8-445A-9EB7-EE07657F9272}

[2011.11.03 16:58:06 | 000,000,000 | ---D | C] -- C:\Users\H.-C.Rittershauß\AppData\Local\{0807F6A3-5658-4208-A66D-A6B89C6DA8CF}

[2011.11.03 16:57:46 | 000,000,000 | ---D | C] -- C:\Users\H.-C.Rittershauß\AppData\Local\{70757A9B-AC12-4D45-BBD1-E94087F0350A}

[2011.10.31 16:03:46 | 000,000,000 | ---D | C] -- C:\Users\H.-C.Rittershauß\AppData\Local\{6442CFE0-5768-4EF0-A3EC-1A1A994C0E1F}

[2011.10.31 16:03:34 | 000,000,000 | ---D | C] -- C:\Users\H.-C.Rittershauß\AppData\Local\{7AFFFB25-246E-41BC-A41D-4B9931F20FAF}

[2011.10.30 15:52:51 | 000,000,000 | ---D | C] -- C:\Users\H.-C.Rittershauß\AppData\Local\{FA122D67-F685-47D0-B756-726C89A31B4F}

[2011.10.30 15:52:37 | 000,000,000 | ---D | C] -- C:\Users\H.-C.Rittershauß\AppData\Local\{1516970C-C30F-42E7-9D0A-1826751FE354}

[2011.10.29 08:08:44 | 000,000,000 | ---D | C] -- C:\Users\H.-C.Rittershauß\AppData\Local\{DE21146E-D089-491B-8447-C9D2F4E6DAEC}

[2011.10.29 08:08:32 | 000,000,000 | ---D | C] -- C:\Users\H.-C.Rittershauß\AppData\Local\{5C8416F3-B12E-4B15-BDF5-367E60ECA585}

[2011.10.28 16:36:21 | 000,000,000 | ---D | C] -- C:\Users\H.-C.Rittershauß\AppData\Local\{294268B9-EE2A-48C3-9C5B-C1586BA9C39C}

[2011.10.28 16:36:11 | 000,000,000 | ---D | C] -- C:\Users\H.-C.Rittershauß\AppData\Local\{02F1C2BE-4826-4775-8E4E-4ACB87677035}

[2011.10.28 05:40:51 | 000,000,000 | ---D | C] -- C:\Users\H.-C.Rittershauß\AppData\Local\{12913327-ED89-451A-A0B6-578802CE6EC0}

[2011.10.27 13:58:36 | 000,000,000 | ---D | C] -- C:\Users\H.-C.Rittershauß\Desktop\family guy

[2011.10.27 13:57:57 | 000,000,000 | ---D | C] -- C:\Users\H.-C.Rittershauß\Desktop\Stromberg - Chef Sein Mensch Bleiben

[2011.10.27 13:28:16 | 000,000,000 | ---D | C] -- C:\Users\H.-C.Rittershauß\AppData\Local\{128482B9-2751-406F-AECD-4B09ADB49FD9}

[2011.10.27 13:26:38 | 000,000,000 | ---D | C] -- C:\Users\H.-C.Rittershauß\AppData\Local\{2A47ADC1-47AA-4E8D-BC7E-14A82EB6157A}

[2011.10.26 14:12:20 | 000,000,000 | ---D | C] -- C:\Users\H.-C.Rittershauß\AppData\Local\{A86B1A9B-3506-4B11-9722-0D4DDE3BEF37}

[2011.10.25 20:57:14 | 000,000,000 | ---D | C] -- C:\Users\H.-C.Rittershauß\AppData\Local\{7A75E972-A53F-44C0-B3D4-81AEFCCA2597}

[2011.10.24 20:48:47 | 000,000,000 | ---D | C] -- C:\Users\H.-C.Rittershauß\AppData\Local\{7D665531-E24F-481B-BFDD-430570DD1BD0}

[2011.10.24 20:48:25 | 000,000,000 | ---D | C] -- C:\Users\H.-C.Rittershauß\AppData\Local\{687ED896-3C7E-47DB-B17E-B7D6A3175529}

[2011.10.23 02:19:26 | 000,000,000 | ---D | C] -- C:\Users\H.-C.Rittershauß\AppData\Local\{DF319AAB-FDD2-4303-BDA2-EFC46E350BA0}

[2011.10.23 02:19:05 | 000,000,000 | ---D | C] -- C:\Users\H.-C.Rittershauß\AppData\Local\{43C5FFCF-9A61-4855-B996-03B8FA63338A}

[2011.10.22 14:20:10 | 000,000,000 | ---D | C] -- C:\Users\H.-C.Rittershauß\AppData\Local\{03BECAC7-5270-403A-ACF0-30F129A7FB9F}

[2011.10.22 14:19:57 | 000,000,000 | ---D | C] -- C:\Users\H.-C.Rittershauß\AppData\Local\{17F10FD6-57ED-47D6-AC04-8E110133470F}

[2011.10.22 12:20:04 | 000,000,000 | ---D | C] -- C:\Users\H.-C.Rittershauß\AppData\Local\{213C3E00-0495-4868-B7AE-C3230C25E92B}

[2011.10.22 12:19:49 | 000,000,000 | ---D | C] -- C:\Users\H.-C.Rittershauß\AppData\Local\{DD2638DC-0FA0-4153-93E7-6836DCBBB0F6}

[2011.10.21 23:59:38 | 000,000,000 | ---D | C] -- C:\Users\H.-C.Rittershauß\AppData\Local\{706088CB-A61A-4191-AE1A-14A45B920025}

[2011.10.21 23:58:54 | 000,000,000 | ---D | C] -- C:\Users\H.-C.Rittershauß\AppData\Local\{0936D52C-4987-48BF-9A8A-333B0DDCE800}

[2011.10.21 18:13:34 | 000,000,000 | ---D | C] -- C:\Users\H.-C.Rittershauß\AppData\Local\{19ABBD3F-ED83-4E88-BB30-14AE929E9A32}

[2011.10.21 18:13:19 | 000,000,000 | ---D | C] -- C:\Users\H.-C.Rittershauß\AppData\Local\{84B8EC62-68EB-40F7-B2A5-A205F49B1DB2}

[2011.10.21 13:37:17 | 000,000,000 | ---D | C] -- C:\Users\H.-C.Rittershauß\AppData\Local\{B4E82126-C4E2-4FC5-80DF-9537F806AEF6}

[2011.10.21 13:37:04 | 000,000,000 | ---D | C] -- C:\Users\H.-C.Rittershauß\AppData\Local\{B23AC2D6-97A0-4778-8562-849E5A688D12}

[2011.10.20 21:51:05 | 000,000,000 | ---D | C] -- C:\Users\H.-C.Rittershauß\AppData\Local\{3053312E-9A49-4B1C-AB5B-C8BF0DAFBA43}

[2011.10.20 21:50:49 | 000,000,000 | ---D | C] -- C:\Users\H.-C.Rittershauß\AppData\Local\{079BF11F-DAB6-45D1-A19B-E105D2B22D75}

[2011.10.20 15:15:15 | 000,000,000 | ---D | C] -- C:\Users\H.-C.Rittershauß\AppData\Local\{1409E35E-7508-454D-895D-AEC82E98C2D3}

[2011.10.20 15:15:03 | 000,000,000 | ---D | C] -- C:\Users\H.-C.Rittershauß\AppData\Local\{558F4C1B-F3E0-4306-9B65-CA6F41BFF7AB}

[2011.10.19 16:32:25 | 000,000,000 | ---D | C] -- C:\Users\H.-C.Rittershauß\AppData\Local\{84190ED8-4183-4E6F-A72E-2DB502DB2FD6}

[2011.10.19 16:32:12 | 000,000,000 | ---D | C] -- C:\Users\H.-C.Rittershauß\AppData\Local\{1C07965C-8E2B-4109-A856-CD0831906181}

[2011.10.19 05:06:33 | 000,000,000 | ---D | C] -- C:\Users\H.-C.Rittershauß\AppData\Local\{00286B12-437D-4C1E-BD02-EE0FDB3C244D}

[2011.10.19 05:06:20 | 000,000,000 | ---D | C] -- C:\Users\H.-C.Rittershauß\AppData\Local\{2A31BBAB-A6C7-45D7-8073-27A0D315CFE3}

[2011.10.18 15:48:08 | 000,000,000 | ---D | C] -- C:\Users\H.-C.Rittershauß\AppData\Local\{DE96E773-11F9-4CB8-B6A9-8564CCB815A4}

[2011.10.18 15:47:56 | 000,000,000 | ---D | C] -- C:\Users\H.-C.Rittershauß\AppData\Local\{C286C7C7-3815-47E8-9ACF-226CA3810D74}

[2011.10.17 15:04:20 | 000,000,000 | ---D | C] -- C:\Users\H.-C.Rittershauß\AppData\Local\{A5499C33-0903-4D88-9177-6AC222EFBB37}

[2011.10.17 15:03:10 | 000,000,000 | ---D | C] -- C:\Users\H.-C.Rittershauß\AppData\Local\{CB68DC37-7CAE-4317-8888-A56C904CA24C}

[2011.10.15 18:35:02 | 000,000,000 | ---D | C] -- C:\Users\H.-C.Rittershauß\AppData\Local\{CB5EF00A-FADD-47DE-B4DB-7C51CCAB746E}

[2011.10.15 18:34:44 | 000,000,000 | ---D | C] -- C:\Users\H.-C.Rittershauß\AppData\Local\{BAC76647-879C-4082-8B67-366F233A1D59}

[2011.10.14 23:59:40 | 000,000,000 | ---D | C] -- C:\Users\H.-C.Rittershauß\AppData\Local\{5AD8CA3D-A1F6-4A8E-9FEB-8D0EAEB93A64}

[2011.10.14 23:59:23 | 000,000,000 | ---D | C] -- C:\Users\H.-C.Rittershauß\AppData\Local\{D2D0DFB3-9A45-4E04-8AC1-837B63EBD543}

[2011.10.14 13:39:14 | 000,000,000 | ---D | C] -- C:\Users\H.-C.Rittershauß\AppData\Local\{BF34165B-0EB4-407D-BE36-5D26CE000C3F}

[2011.10.14 13:38:56 | 000,000,000 | ---D | C] -- C:\Users\H.-C.Rittershauß\AppData\Local\{E504C5DB-4486-4E70-9A47-80A593874526}

[2011.10.13 15:41:00 | 000,000,000 | ---D | C] -- C:\Users\H.-C.Rittershauß\AppData\Local\{3C8E22E7-61F3-4857-8905-5572EFAECF67}

[2011.10.13 15:40:47 | 000,000,000 | ---D | C] -- C:\Users\H.-C.Rittershauß\AppData\Local\{CB122559-9B78-4B6B-B2BC-75B01DF0A3F9}

[2011.10.12 15:41:44 | 000,000,000 | ---D | C] -- C:\Users\H.-C.Rittershauß\AppData\Local\{99E8F5B2-1400-40A1-AB8E-6AF47FBFE0B6}

[2011.10.12 15:41:31 | 000,000,000 | ---D | C] -- C:\Users\H.-C.Rittershauß\AppData\Local\{2E3C5009-D2BE-4787-B7F4-C229B60F12BD}

[2011.10.12 05:05:49 | 000,000,000 | ---D | C] -- C:\Users\H.-C.Rittershauß\AppData\Local\{01226BAA-1DA9-470A-B331-66914EDAE438}

[2011.10.12 05:05:36 | 000,000,000 | ---D | C] -- C:\Users\H.-C.Rittershauß\AppData\Local\{03F9036B-514C-48FE-BB04-77531EFE0A1F}

[2011.10.12 01:25:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP Help and Support

[2011.10.12 01:23:42 | 000,000,000 | ---D | C] -- C:\ProgramData\{D3B41B92-9BC2-43EB-916A-4FA9E8191837}

[2011.10.11 23:21:56 | 000,599,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msfeeds.dll

[2011.10.11 23:21:56 | 000,599,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll

[2011.10.11 23:21:56 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll

[2011.10.11 23:21:56 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll

[2011.10.11 23:21:55 | 000,185,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iepeers.dll

[2011.10.11 23:21:55 | 000,185,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll

[2011.10.11 23:21:55 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll

[2011.10.11 23:21:55 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtmled.dll

[2011.10.11 23:21:54 | 000,132,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll

[2011.10.11 23:21:54 | 000,132,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll

[2011.10.11 23:21:54 | 000,044,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\licmgr10.dll

[2011.10.11 23:21:54 | 000,044,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\licmgr10.dll

[2011.10.11 23:21:53 | 000,386,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\html.iec

[2011.10.11 23:21:53 | 000,386,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\html.iec

[2011.10.11 23:21:53 | 000,012,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msfeedssync.exe

[2011.10.11 23:21:53 | 000,012,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedssync.exe

[2011.10.11 23:21:39 | 000,075,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\psisrndr.ax

[2011.10.11 23:21:39 | 000,075,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\psisrndr.ax

[2011.10.11 23:21:38 | 000,465,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\psisdecd.dll

[2011.10.11 23:21:38 | 000,465,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\psisdecd.dll

[2011.10.11 23:21:38 | 000,204,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MSNP.ax

[2011.10.11 23:21:38 | 000,204,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MSNP.ax

[2011.10.11 23:21:37 | 000,072,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\Mpeg2Data.ax

[2011.10.11 23:21:37 | 000,072,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\Mpeg2Data.ax

[2011.10.11 23:21:37 | 000,059,904 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MSDvbNP.ax

[2011.10.11 23:21:37 | 000,059,904 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MSDvbNP.ax

[2011.10.11 23:21:32 | 000,571,904 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\oleaut32.dll

[2011.10.11 23:21:30 | 000,233,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\oleacc.dll

[2011.10.11 15:20:52 | 000,000,000 | ---D | C] -- C:\Users\H.-C.Rittershauß\AppData\Local\{8AE2F6AC-E219-4FB3-88BB-A674B8CCE05C}

[2011.10.11 15:20:37 | 000,000,000 | ---D | C] -- C:\Users\H.-C.Rittershauß\AppData\Local\{A4C3CCF3-A0B3-4435-BA20-AFEE3F203636}

[2011.10.10 18:16:51 | 000,000,000 | ---D | C] -- C:\Users\H.-C.Rittershauß\AppData\Local\{0B9BAC30-0633-46AC-BAFF-FB09B72D3630}

[2011.10.10 18:16:30 | 000,000,000 | ---D | C] -- C:\Users\H.-C.Rittershauß\AppData\Local\{B51720A1-8621-4488-A9D4-D206FA04EF83}

[2011.10.09 02:38:34 | 000,000,000 | ---D | C] -- C:\Users\H.-C.Rittershauß\AppData\Local\{8ABB390F-8984-4566-9374-54A3077D4AAC}

[2011.10.09 02:38:19 | 000,000,000 | ---D | C] -- C:\Users\H.-C.Rittershauß\AppData\Local\{4823DB64-50AB-41E7-822E-79317ED05C22}

[2011.10.08 15:08:02 | 000,000,000 | ---D | C] -- C:\Users\H.-C.Rittershauß\AppData\Local\{9BE03A92-77A4-42D8-97F4-A5740A1A7F28}

 
 ========== Files - Modified Within 30 Days ==========

 

[2011.11.07 13:30:43 | 000,000,362 | ---- | M] () -- C:\Windows\tasks\DriverScanner.job

[2011.11.07 13:30:27 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2011.11.07 13:30:19 | 3062,255,616 | -HS- | M] () -- C:\hiberfil.sys

[2011.11.03 19:14:30 | 000,001,867 | ---- | M] () -- C:\Users\H.-C.Rittershauß\Documents\rechnung.rtf

[2011.11.03 16:53:46 | 000,000,376 | ---- | M] () -- C:\Windows\tasks\HPCeeScheduleForH.-C.Rittershauß.job

[2011.11.03 16:53:46 | 000,000,354 | ---- | M] () -- C:\Windows\tasks\HPCeeScheduleForH-CRITTERSHAUß$.job

[2011.10.25 16:04:06 | 000,001,902 | ---- | M] () -- C:\Users\H.-C.Rittershauß\Documents\wochenberichte.rtf

[2011.10.12 02:08:36 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight

[2011.10.12 01:26:05 | 000,000,000 | R--D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP

[2011.10.12 01:25:42 | 000,002,139 | ---- | M] () -- C:\Users\Public\Desktop\HP Support Assistant.lnk

[2011.10.12 01:25:42 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP Help and Support

[2011.10.11 19:45:35 | 000,000,192 | ---- | M] () -- C:\Users\H.-C.Rittershauß\Documents\loveless.rtf

[2011.10.09 10:29:41 | 000,001,776 | ---- | M] () -- C:\Users\H.-C.Rittershauß\Documents\beschreibung.rtf

 
 ========== Files Created - No Company Name ==========

 

[2011.11.03 19:14:30 | 000,001,867 | ---- | C] () -- C:\Users\H.-C.Rittershauß\Documents\rechnung.rtf

[2011.10.26 18:09:59 | 000,000,354 | ---- | C] () -- C:\Windows\tasks\HPCeeScheduleForH-CRITTERSHAUß$.job

[2011.10.25 22:11:08 | 110,447,557 | ---- | C] () -- C:\Users\H.-C.Rittershauß\Desktop\01 - Schranz Total 18.0 CD2ey hansi intro is    hard techno anthem-viper xxl.mp3

[2011.10.12 01:25:42 | 000,002,139 | ---- | C] () -- C:\Users\Public\Desktop\HP Support Assistant.lnk

[2011.10.11 19:45:35 | 000,000,192 | ---- | C] () -- C:\Users\H.-C.Rittershauß\Documents\loveless.rtf

[2011.10.09 10:18:12 | 000,001,776 | ---- | C] () -- C:\Users\H.-C.Rittershauß\Documents\beschreibung.rtf

[2011.04.27 14:17:41 | 000,001,854 | ---- | C] () -- C:\Users\H.-C.Rittershauß\AppData\Roaming\GhostObjGAFix.xml

[2011.04.09 17:55:28 | 000,179,261 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat

[2011.03.23 19:09:23 | 000,087,040 | ---- | C] () -- C:\Windows\UnGins.exe

[2011.03.23 19:09:17 | 000,237,568 | ---- | C] () -- C:\Windows\SysWow64\Unlha32.dll

[2011.03.23 19:09:16 | 000,473,600 | ---- | C] () -- C:\Windows\SysWow64\Harmony.dll

[2011.03.22 17:26:16 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat

[2011.02.20 01:42:15 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin

[2011.02.20 01:40:43 | 000,014,051 | ---- | C] () -- C:\Windows\SysWow64\RaCoInst.dat

[2011.02.20 01:36:05 | 000,002,901 | ---- | C] () -- C:\Windows\SysWow64\atipblup.dat

[2011.02.20 01:31:26 | 000,000,048 | -H-- | C] () -- C:\Windows\SysWow64\ezsidmv.dat

[2011.01.09 18:11:06 | 000,000,202 | ---- | C] () -- C:\Windows\SysWow64\HPWA.ini

[2011.01.09 18:04:09 | 000,009,644 | ---- | C] () -- C:\Windows\SysWow64\ezdigsgn.dat

[2010.12.17 03:26:22 | 000,066,856 | ---- | C] () -- C:\Windows\SysWow64\SynTPEnhPS.dll

[2010.12.01 23:12:44 | 000,002,901 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat

[2010.11.29 06:21:30 | 000,128,204 | ---- | C] () -- C:\Windows\SysWow64\igcompkrng575.bin

[2010.11.29 06:21:28 | 000,867,020 | ---- | C] () -- C:\Windows\SysWow64\igkrng575.bin

[2010.11.29 06:21:28 | 000,105,408 | ---- | C] () -- C:\Windows\SysWow64\igfcg575m.bin

[2010.09.24 15:41:34 | 000,007,736 | ---- | C] () -- C:\Windows\hpDSTRES.DLL

[2009.07.14 06:38:36 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat

[2009.07.14 03:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT

[2009.07.14 03:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat

[2009.07.14 01:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin

[2009.07.14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll

[2009.07.13 22:59:36 | 001,498,564 | ---- | C] () -- C:\Windows\SysWow64\igkrng400.bin

[2009.07.13 22:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll

[2009.06.10 22:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat

[2005.08.29 23:00:00 | 000,781,312 | ---- | C] () -- C:\Windows\SysWow64\RGSS102J.dll

[2005.08.29 23:00:00 | 000,778,752 | ---- | C] () -- C:\Windows\SysWow64\RGSS102E.dll

[2005.08.29 23:00:00 | 000,771,584 | ---- | C] () -- C:\Windows\SysWow64\RGSS100J.dll

 
 ========== LOP Check ==========

 

[2011.10.17 21:47:17 | 000,000,000 | ---D | M] -- C:\Users\H.-C.Rittershauß\AppData\Roaming\.minecraft

[2011.08.06 13:20:35 | 000,000,000 | ---D | M] -- C:\Users\H.-C.Rittershauß\AppData\Roaming\Canneverbe Limited

[2011.08.12 19:36:21 | 000,000,000 | ---D | M] -- C:\Users\H.-C.Rittershauß\AppData\Roaming\DVDVideoSoft

[2011.08.12 19:21:25 | 000,000,000 | ---D | M] -- C:\Users\H.-C.Rittershauß\AppData\Roaming\DVDVideoSoftIEHelpers

[2011.11.07 13:32:24 | 000,000,000 | ---D | M] -- C:\Users\H.-C.Rittershauß\AppData\Roaming\ICQ

[2011.08.06 13:20:18 | 000,000,000 | ---D | M] -- C:\Users\H.-C.Rittershauß\AppData\Roaming\OpenCandy

[2011.03.25 19:07:13 | 000,000,000 | ---D | M] -- C:\Users\H.-C.Rittershauß\AppData\Roaming\OpenOffice.org

[2011.07.01 04:11:21 | 000,000,000 | ---D | M] -- C:\Users\H.-C.Rittershauß\AppData\Roaming\PhotoFiltre

[2011.03.22 16:59:44 | 000,000,000 | ---D | M] -- C:\Users\H.-C.Rittershauß\AppData\Roaming\PictureMover

[2011.03.22 16:58:41 | 000,000,000 | ---D | M] -- C:\Users\H.-C.Rittershauß\AppData\Roaming\Synaptics

[2011.10.04 16:33:04 | 000,000,000 | ---D | M] -- C:\Users\H.-C.Rittershauß\AppData\Roaming\Ubisoft

[2011.08.06 13:20:47 | 000,000,000 | ---D | M] -- C:\Users\H.-C.Rittershauß\AppData\Roaming\Uniblue

[2011.04.23 09:10:46 | 000,000,000 | ---D | M] -- C:\Users\H.-C.Rittershauß\AppData\Roaming\Windows Live Writer

[2011.03.22 17:43:09 | 000,000,000 | ---D | M] -- C:\Users\H.-C.Rittershauß\AppData\Roaming\_MDLogs

[2011.03.22 16:46:28 | 000,000,000 | -HSD | M] -- C:\ProgramData\Anwendungsdaten

[2009.07.14 06:08:56 | 000,000,000 | -HSD | M] -- C:\ProgramData\Application Data

[2011.08.06 13:20:35 | 000,000,000 | ---D | M] -- C:\ProgramData\Canneverbe Limited

[2009.07.14 06:08:56 | 000,000,000 | -HSD | M] -- C:\ProgramData\Desktop

[2009.07.14 06:08:56 | 000,000,000 | -HSD | M] -- C:\ProgramData\Documents

[2011.03.22 16:46:28 | 000,000,000 | -HSD | M] -- C:\ProgramData\Dokumente

[2011.03.22 16:46:28 | 000,000,000 | -HSD | M] -- C:\ProgramData\Favoriten

[2009.07.14 06:08:56 | 000,000,000 | -HSD | M] -- C:\ProgramData\Favorites

[2011.07.18 08:55:43 | 000,000,000 | ---D | M] -- C:\ProgramData\ICQ

[2011.02.20 01:48:01 | 000,000,000 | ---D | M] -- C:\ProgramData\PictureMover

[2011.06.27 19:19:26 | 000,000,000 | ---D | M] -- C:\ProgramData\PMB Files

[2011.02.20 01:40:42 | 000,000,000 | ---D | M] -- C:\ProgramData\Ralink Driver

[2011.01.09 17:51:08 | 000,000,000 | ---D | M] -- C:\ProgramData\Stardock

[2009.07.14 06:08:56 | 000,000,000 | -HSD | M] -- C:\ProgramData\Start Menu

[2011.03.22 16:46:28 | 000,000,000 | -HSD | M] -- C:\ProgramData\Startmenü

[2011.02.20 01:48:11 | 000,000,000 | ---D | M] -- C:\ProgramData\Temp

[2009.07.14 06:08:56 | 000,000,000 | -HSD | M] -- C:\ProgramData\Templates

[2011.10.04 16:21:00 | 000,000,000 | ---D | M] -- C:\ProgramData\Ubisoft

[2011.08.07 07:40:50 | 000,000,000 | ---D | M] -- C:\ProgramData\Uniblue

[2011.03.22 16:46:28 | 000,000,000 | -HSD | M] -- C:\ProgramData\Vorlagen

[2011.03.27 20:47:48 | 000,000,000 | ---D | M] -- C:\ProgramData\WildTangent

[2011.01.09 18:06:56 | 000,000,000 | ---D | M] -- C:\ProgramData\{7A89BFAF-D4AA-434A-B652-6F880DD86278}

[2011.10.12 01:23:43 | 000,000,000 | ---D | M] -- C:\ProgramData\{D3B41B92-9BC2-43EB-916A-4FA9E8191837}

[2011.06.23 16:45:44 | 000,000,000 | ---D | M] -- C:\ProgramData\{E91883C8-8CDC-46A4-A45F-CB40EB82ED60}

[2011.11.07 13:30:43 | 000,000,362 | ---- | M] () -- C:\Windows\Tasks\DriverScanner.job

[2011.07.18 15:46:37 | 000,032,624 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

 
 ========== Purity Check ==========

 

 

< End of report >

--- --- ---

Mondstein

du sagst ja windows läuft wieder?

Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich
ziehen und eine Bereinigung der Infektion noch erschweren.

Bitte downloade dir Combofix.exe und speichere es unbedingt auf deinem Desktop.

Besuche folgende Seite für Downloadlinks und Anweisungen für dieses
Tool

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
Hinweis:
Gehe sicher das all deine Anti Virus und Anti Malware Programme abgeschalten sind, damit diese Combofix nicht bei der Arbeit stören.
Poste bitte die C:\Combofix.txt in deiner nächsten Antwort.

Hallo

Hier das Ergebnis:

Combofix Logfile:

Code:

ComboFix 11-11-07.03 - H.-C.Rittershauß 07.11.2011  17:44:08.2.4 - x64

Microsoft Windows 7 Home Premium   6.1.7600.0.1252.49.1031.18.3894.2395 [GMT 1:00]

ausgeführt von:: c:\users\H.-C.Rittershauß\Downloads\ComboFix.exe

AV: AntiVir Desktop *Disabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}

SP: AntiVir Desktop *Disabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

(((((((((((((((((((((((   Dateien erstellt von 2011-10-07 bis 2011-11-07  ))))))))))))))))))))))))))))))

.

.

2011-11-07 16:51 . 2011-11-07 16:51        --------        d-----w-        c:\users\Default\AppData\Local\temp

2011-10-25 17:56 . 2011-08-15 05:08        6144        ----a-w-        c:\program files\Internet Explorer\iecompat.dll

2011-10-25 17:56 . 2011-08-15 04:25        6144        ----a-w-        c:\program files (x86)\Internet Explorer\iecompat.dll

2011-10-12 00:23 . 2011-10-12 00:23        --------        d-----w-        c:\programdata\{D3B41B92-9BC2-43EB-916A-4FA9E8191837}

2011-10-11 22:22 . 2011-09-06 03:07        3134976        ----a-w-        c:\windows\system32\win32k.sys

2011-10-11 22:22 . 2011-08-20 05:40        1013248        ----a-w-        c:\program files\Internet Explorer\iedvtool.dll

2011-10-11 22:22 . 2011-08-20 05:45        1197568        ----a-w-        c:\windows\system32\wininet.dll

2011-10-11 22:22 . 2011-08-20 04:34        860672        ----a-w-        c:\program files (x86)\Internet Explorer\iedvtool.dll

2011-10-11 22:22 . 2011-08-20 04:38        981504        ----a-w-        c:\windows\SysWow64\wininet.dll

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-10-07 04:16 . 2011-11-07 15:43        8570192        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{07785155-F253-4FAA-9F48-4E28CCA38D1C}\mpengine.dll

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]

2011-05-17 11:29        1490312        ----a-w-        c:\program files (x86)\Ask.com\GenericAskToolbar.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]

"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files (x86)\Ask.com\GenericAskToolbar.dll" [2011-05-17 1490312]

.

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]

[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]

[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]

[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"msnmsgr"="c:\program files (x86)\Windows Live\Messenger\msnmsgr.exe" [2010-11-10 4240760]

"SpybotSD TeaTimer"="c:\program files (x86)\Spybot - Search & Destroy\TeaTimer.exe" [2009-01-26 2144088]

"Steam"="c:\program files (x86)\Steam\Steam.exe" [2011-08-02 1242448]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1475072]

"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2011-07-21 17357448]

"DriverScanner"="c:\program files (x86)\Uniblue\DriverScanner\launcher.exe" [2011-05-16 338296]

"ICQ"="c:\program files (x86)\ICQ7.4\ICQ.exe" [2011-03-23 119608]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-12-17 336384]

"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2011-01-12 283160]

"IMSS"="c:\program files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe" [2010-07-23 111640]

"Microsoft Default Manager"="c:\program files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2010-05-10 439568]

"HP Quick Launch"="c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe" [2010-11-09 586296]

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]

"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]

"Easybits Recovery"="c:\program files (x86)\EasyBits For Kids\ezRecover.exe" [2010-12-13 61112]

"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2011-03-04 281768]

"ApnUpdater"="c:\program files (x86)\Ask.com\Updater\Updater.exe" [2011-05-17 395144]

"HPOSD"="c:\program files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe" [2011-01-27 318520]

"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]

.

c:\users\H.-C.Rittershauß\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

OpenOffice.org 3.3.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

Snapfish PictureMover.lnk - c:\program files (x86)\PictureMover\Bin\PictureMover.exe [2010-11-18 1040952]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

"HideFastUserSwitching"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]

"EnableShellExecuteHooks"= 1 (0x1)

.

[hkey_local_machine\software\Wow6432Node\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

Security Packages        REG_MULTI_SZ           kerberos msv1_0 schannel wdigest tspkg pku2u livessp

.

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R2 HP Support Assistant Service;HP Support Assistant Service;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [2011-06-21 85560]

R2 HP Wireless Assistant Service;HP Wireless Assistant Service;c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe [2010-07-21 103992]

R3 BBSvc;Bing Bar Update Service;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-02-28 183560]

R3 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072]

R3 netw5v64;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;c:\windows\system32\DRIVERS\netw5v64.sys [x]

R3 RSPCIESTOR;Realtek PCIE CardReader Driver;c:\windows\system32\DRIVERS\RtsPStor.sys [x]

R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS [x]

R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS [x]

R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS [x]

R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys [x]

R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]

S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]

S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]

S2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2011-04-28 136360]

S2 HPAuto;HP Auto;c:\program files\Hewlett-Packard\HP Auto\HPAuto.exe [2010-08-05 681528]

S2 HPClientSvc;HP Client Services;c:\program files\Hewlett-Packard\HP Client Services\HPClientServices.exe [2010-08-05 291896]

S2 HPDrvMntSvc.exe;HP Quick Synchronization Service;c:\program files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2011-07-05 227384]

S2 HPWMISVC;HPWMISVC;c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [2010-11-09 26680]

S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2011-01-12 13336]

S2 ICQ Service;ICQ Service;c:\program files (x86)\ICQ6Toolbar\ICQ Service.exe [2010-11-21 247608]

S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2010-07-23 2320920]

S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x]

S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]

S3 clwvd;CyberLink WebCam Virtual Driver;c:\windows\system32\DRIVERS\clwvd.sys [x]

S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [x]

S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [x]

S3 IntcDAud;Intel(R) Display-Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [x]

S3 intelkmd;intelkmd;c:\windows\system32\DRIVERS\igdpmd64.sys [x]

S3 netr28x;Ralink 802.11n Extensible Wireless Driver;c:\windows\system32\DRIVERS\netr28x.sys [x]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]

.

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]

2010-11-22 13:18        451872        ----a-w-        c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe

.

Inhalt des "geplante Tasks" Ordners

.

2011-11-07 c:\windows\Tasks\DriverScanner.job

- c:\program files (x86)\Uniblue\DriverScanner\dsmonitor.exe [2011-08-06 09:22]

.

2011-11-03 c:\windows\Tasks\HPCeeScheduleForH-CRITTERSHAUß$.job

- c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-13 21:15]

.

2011-11-03 c:\windows\Tasks\HPCeeScheduleForH.-C.Rittershauß.job

- c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-13 21:15]

.

.

--------- x86-64 -----------

.

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00Zecter]

@="{D25B32FE-CB96-491A-98FF-AD59DA382D69}"

[HKEY_CLASSES_ROOT\CLSID\{D25B32FE-CB96-491A-98FF-AD59DA382D69}]

2010-11-09 22:16        2238976        ----a-w-        c:\program files (x86)\Hewlett-Packard\HP CloudDrive\ShellExt64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\01Zecter]

@="{EB24CA6D-F315-4A81-AC1A-C79CFD77F3F5}"

[HKEY_CLASSES_ROOT\CLSID\{EB24CA6D-F315-4A81-AC1A-C79CFD77F3F5}]

2010-11-09 22:16        2238976        ----a-w-        c:\program files (x86)\Hewlett-Packard\HP CloudDrive\ShellExt64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\02Zecter]

@="{B3C78E40-6B64-47C3-AE34-60B770881EB8}"

[HKEY_CLASSES_ROOT\CLSID\{B3C78E40-6B64-47C3-AE34-60B770881EB8}]

2010-11-09 22:16        2238976        ----a-w-        c:\program files (x86)\Hewlett-Packard\HP CloudDrive\ShellExt64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\03Zecter]

@="{622AFE52-33F6-4D9F-9966-E0BC52D7D69D}"

[HKEY_CLASSES_ROOT\CLSID\{622AFE52-33F6-4D9F-9966-E0BC52D7D69D}]

2010-11-09 22:16        2238976        ----a-w-        c:\program files (x86)\Hewlett-Packard\HP CloudDrive\ShellExt64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\04Zecter]

@="{855156F0-2A0F-11DE-8C30-0800200C9A66}"

[HKEY_CLASSES_ROOT\CLSID\{855156F0-2A0F-11DE-8C30-0800200C9A66}]

2010-11-09 22:16        2238976        ----a-w-        c:\program files (x86)\Hewlett-Packard\HP CloudDrive\ShellExt64.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-11-29 167960]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-11-29 391704]

"Persistence"="c:\windows\system32\igfxpers.exe" [2010-11-29 417304]

"SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2010-12-13 524800]

"HPWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\DelayedAppStarter.exe" [2010-07-21 8192]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

"LoadAppInit_DLLs"=0x0

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = hxxp://start.icq.com/sm

uLocal Page = c:\windows\system32\blank.htm

mLocal Page = c:\windows\SysWOW64\blank.htm

IE: Free YouTube to MP3 Converter - c:\users\H.-C.Rittershauß\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm

IE: {{7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - c:\program files (x86)\ICQ7.5\ICQ.exe

TCP: DhcpNameServer = 192.168.2.1

FF - ProfilePath - c:\users\H.-C.Rittershauß\AppData\Roaming\Mozilla\Firefox\Profiles\pn47jxqx.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.2.9&q=

FF - prefs.js: browser.search.selectedEngine - ICQ Search

FF - prefs.js: browser.startup.homepage - hxxp://start.icq.com/

FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.3.6&q=

FF - user.js: yahoo.ytff.general.dontshowhpoffer - true

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)

HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe

AddRemove-EasyBits Magic Desktop - c:\windows\system32\ezMDUninstall.exe

AddRemove-{CA43FE4F-9FF2-4AD7-88F0-CC3BAC17B226} - c:\program files (x86)\InstallShield Installation Information\{CA43FE4F-9FF2-4AD7-88F0-CC3BAC17B226}\setup.exe

.

.

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10o_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10o_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10o.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.10"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10o.ocx, 1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10o.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10o.ocx, 1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

------------------------ Weitere laufende Prozesse ------------------------

.

c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe

c:\windows\SysWOW64\ezSharedSvcHost.exe

c:\program files (x86)\Common Files\LightScribe\LSSrvc.exe

c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

c:\program files (x86)\Microsoft\BingBar\SeaPort.EXE

c:\program files (x86)\OpenOffice.org 3\program\soffice.exe

c:\program files (x86)\OpenOffice.org 3\program\soffice.bin

c:\program files (x86)\CyberLink\YouCam\YCMMirage.exe

c:\program files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe

c:\program files (x86)\Windows Live\Contacts\wlcomm.exe

.

**************************************************************************

.

Zeit der Fertigstellung: 2011-11-07  18:00:43 - PC wurde neu gestartet

ComboFix-quarantined-files.txt  2011-11-07 17:00

.

Vor Suchlauf: 14 Verzeichnis(se), 347.870.932.992 Bytes frei

Nach Suchlauf: 15 Verzeichnis(se), 347.713.519.616 Bytes frei

.

- - End Of File - - 7A81BF4997010C8A591C8F6D611375EA

--- --- ---

Mondstein

bitte deinstaliere spybot, es ist nicht mehr zeitgemäß und kann die reinigung stören, neustart nach deinstall

start suchen, tippe
editor
enter
kopiere rein:
killall::
rootkit::
folder::
c:\programdata\{D3B41B92-9BC2-43EB-916A-4FA9E8191837}

datei speichern unter, typ, alle dateien, ort, dort wo sich combofix.exe befindet.
datei name:
cfscript.txt
deaktiviere im systray, neben der urh, avira, mit rechtsklick, deaktivieren.
mache das mit allen laufenden programmen, entweder abschalten oder deaktivieren.
dann ziehe cfscript auf combofix, poste log wenn fertig

Hallo

Also bis zum Speichern der Datei bin gekommen,

aber jetzt verstehe ich nur noch Bahnhof, kannst du mir vielleicht erklären was z.B. systray ist?

Sorry, aber ich bin nicht so fit in diesen Dingen.

Mondstein

ich sag ja, der bereich in dem sich die uhr befindet, den nennt man so, oder auch infobereich.
dort ist ja zb auch das avira symbol, der regenschirm zu sehen

Ok, hier das neue Ergebnis:

Combofix Logfile:

Code:

ComboFix 11-11-07.03 - H.-C.Rittershauß 07.11.2011  19:41:31.3.4 - x64

Microsoft Windows 7 Home Premium   6.1.7600.0.1252.49.1031.18.3894.2389 [GMT 1:00]

ausgeführt von:: c:\users\H.-C.Rittershau¯\Downloads\ComboFix.exe

Benutzte Befehlsschalter :: c:\users\H.-C.Rittershau¯\Downloads\cfscript.txt

AV: AntiVir Desktop *Disabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}

SP: AntiVir Desktop *Disabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

(((((((((((((((((((((((   Dateien erstellt von 2011-10-07 bis 2011-11-07  ))))))))))))))))))))))))))))))

.

.

2011-11-07 18:59 . 2011-11-07 18:59        69000        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{07785155-F253-4FAA-9F48-4E28CCA38D1C}\offreg.dll

2011-11-07 18:54 . 2011-11-07 18:54        --------        d-----w-        c:\users\Default\AppData\Local\temp

2011-11-07 18:54 . 2011-11-07 18:54        --------        d-----w-        c:\users\Administrator\AppData\Local\temp

2011-11-07 15:43 . 2011-10-07 04:16        8570192        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{07785155-F253-4FAA-9F48-4E28CCA38D1C}\mpengine.dll

2011-10-25 17:56 . 2011-08-15 05:08        6144        ----a-w-        c:\program files\Internet Explorer\iecompat.dll

2011-10-25 17:56 . 2011-08-15 04:25        6144        ----a-w-        c:\program files (x86)\Internet Explorer\iecompat.dll

2011-10-12 00:23 . 2011-10-12 00:23        --------        d-----w-        c:\programdata\{D3B41B92-9BC2-43EB-916A-4FA9E8191837}

2011-10-11 22:22 . 2011-09-06 03:07        3134976        ----a-w-        c:\windows\system32\win32k.sys

2011-10-11 22:22 . 2011-08-20 05:40        1013248        ----a-w-        c:\program files\Internet Explorer\iedvtool.dll

2011-10-11 22:22 . 2011-08-20 05:45        1197568        ----a-w-        c:\windows\system32\wininet.dll

2011-10-11 22:22 . 2011-08-20 04:34        860672        ----a-w-        c:\program files (x86)\Internet Explorer\iedvtool.dll

2011-10-11 22:22 . 2011-08-20 04:38        981504        ----a-w-        c:\windows\SysWow64\wininet.dll

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

.

(((((((((((((((((((((((((((((   SnapShot@2011-11-07_16.52.39   )))))))))))))))))))))))))))))))))))))))))

.

- 2009-07-14 04:54 . 2011-11-07 16:52        16384              c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat

+ 2009-07-14 04:54 . 2011-11-07 18:55        16384              c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat

- 2009-07-14 04:54 . 2011-11-07 16:52        32768              c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat

+ 2009-07-14 04:54 . 2011-11-07 18:55        32768              c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat

+ 2009-07-14 04:54 . 2011-11-07 18:55        16384              c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat

- 2009-07-14 04:54 . 2011-11-07 16:52        16384              c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat

- 2009-07-14 05:10 . 2011-11-07 16:21        40032              c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin

+ 2009-07-14 05:10 . 2011-11-07 18:57        40032              c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin

+ 2011-03-22 21:19 . 2011-11-07 18:57        11274              c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3880097196-1087461709-2136809990-1000_UserData.bin

- 2011-03-22 16:57 . 2011-11-07 16:54        16384              c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat

+ 2011-03-22 16:57 . 2011-11-07 18:57        16384              c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat

- 2011-03-22 16:57 . 2011-11-07 16:54        32768              c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat

+ 2011-03-22 16:57 . 2011-11-07 18:57        32768              c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat

+ 2011-03-22 16:57 . 2011-11-07 18:57        16384              c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat

- 2011-03-22 16:57 . 2011-11-07 16:54        16384              c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat

+ 2011-03-22 14:36 . 2011-11-07 18:57        16384              c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat

- 2011-03-22 14:36 . 2011-11-07 16:54        16384              c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat

- 2011-03-22 14:36 . 2011-11-07 16:54        16384              c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat

+ 2011-03-22 14:36 . 2011-11-07 18:57        16384              c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat

- 2011-03-23 12:41 . 2011-11-07 16:18        5548              c:\windows\system32\wdi\ERCQueuedResolutions.dat

+ 2011-03-23 12:41 . 2011-11-07 18:55        5548              c:\windows\system32\wdi\ERCQueuedResolutions.dat

+ 2011-11-07 18:55 . 2011-11-07 18:55        2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat

- 2011-11-07 16:52 . 2011-11-07 16:52        2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat

- 2011-11-07 16:52 . 2011-11-07 16:52        2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat

+ 2011-11-07 18:55 . 2011-11-07 18:55        2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat

- 2009-07-14 05:01 . 2011-11-07 16:51        278632              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat

+ 2009-07-14 05:01 . 2011-11-07 18:55        278632              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat

+ 2009-07-14 02:34 . 2011-11-07 17:09        9961472              c:\windows\system32\SMI\Store\Machine\schema.dat

- 2009-07-14 02:34 . 2011-11-07 16:35        9961472              c:\windows\system32\SMI\Store\Machine\schema.dat

- 2011-02-20 00:58 . 2011-11-07 13:19        1978496              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat

+ 2011-02-20 00:58 . 2011-11-07 18:55        1978496              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat

- 2011-03-22 17:35 . 2011-11-07 16:51        14115120              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-3880097196-1087461709-2136809990-1000-8192.dat

+ 2011-03-22 17:35 . 2011-11-07 18:55        14115120              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-3880097196-1087461709-2136809990-1000-8192.dat

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]

2011-05-17 11:29        1490312        ----a-w-        c:\program files (x86)\Ask.com\GenericAskToolbar.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]

"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files (x86)\Ask.com\GenericAskToolbar.dll" [2011-05-17 1490312]

.

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]

[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]

[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]

[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"msnmsgr"="c:\program files (x86)\Windows Live\Messenger\msnmsgr.exe" [2010-11-10 4240760]

"Steam"="c:\program files (x86)\Steam\Steam.exe" [2011-08-02 1242448]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1475072]

"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2011-07-21 17357448]

"DriverScanner"="c:\program files (x86)\Uniblue\DriverScanner\launcher.exe" [2011-05-16 338296]

"ICQ"="c:\program files (x86)\ICQ7.4\ICQ.exe" [2011-03-23 119608]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-12-17 336384]

"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2011-01-12 283160]

"IMSS"="c:\program files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe" [2010-07-23 111640]

"Microsoft Default Manager"="c:\program files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2010-05-10 439568]

"HP Quick Launch"="c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe" [2010-11-09 586296]

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]

"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]

"Easybits Recovery"="c:\program files (x86)\EasyBits For Kids\ezRecover.exe" [2010-12-13 61112]

"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2011-03-04 281768]

"ApnUpdater"="c:\program files (x86)\Ask.com\Updater\Updater.exe" [2011-05-17 395144]

"HPOSD"="c:\program files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe" [2011-01-27 318520]

"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]

.

c:\users\H.-C.Rittershauß\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

OpenOffice.org 3.3.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

Snapfish PictureMover.lnk - c:\program files (x86)\PictureMover\Bin\PictureMover.exe [2010-11-18 1040952]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

"HideFastUserSwitching"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]

"EnableShellExecuteHooks"= 1 (0x1)

.

[hkey_local_machine\software\Wow6432Node\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

Security Packages        REG_MULTI_SZ           kerberos msv1_0 schannel wdigest tspkg pku2u livessp

.

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R2 HP Support Assistant Service;HP Support Assistant Service;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [2011-06-21 85560]

R2 HP Wireless Assistant Service;HP Wireless Assistant Service;c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe [2010-07-21 103992]

R3 BBSvc;Bing Bar Update Service;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-02-28 183560]

R3 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072]

R3 netw5v64;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;c:\windows\system32\DRIVERS\netw5v64.sys [x]

R3 RSPCIESTOR;Realtek PCIE CardReader Driver;c:\windows\system32\DRIVERS\RtsPStor.sys [x]

R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS [x]

R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS [x]

R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS [x]

R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys [x]

R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]

S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]

S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]

S2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2011-04-28 136360]

S2 HPAuto;HP Auto;c:\program files\Hewlett-Packard\HP Auto\HPAuto.exe [2010-08-05 681528]

S2 HPClientSvc;HP Client Services;c:\program files\Hewlett-Packard\HP Client Services\HPClientServices.exe [2010-08-05 291896]

S2 HPDrvMntSvc.exe;HP Quick Synchronization Service;c:\program files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2011-07-05 227384]

S2 HPWMISVC;HPWMISVC;c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [2010-11-09 26680]

S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2011-01-12 13336]

S2 ICQ Service;ICQ Service;c:\program files (x86)\ICQ6Toolbar\ICQ Service.exe [2010-11-21 247608]

S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2010-07-23 2320920]

S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x]

S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]

S3 clwvd;CyberLink WebCam Virtual Driver;c:\windows\system32\DRIVERS\clwvd.sys [x]

S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [x]

S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [x]

S3 IntcDAud;Intel(R) Display-Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [x]

S3 intelkmd;intelkmd;c:\windows\system32\DRIVERS\igdpmd64.sys [x]

S3 netr28x;Ralink 802.11n Extensible Wireless Driver;c:\windows\system32\DRIVERS\netr28x.sys [x]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]

.

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]

2010-11-22 13:18        451872        ----a-w-        c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe

.

Inhalt des "geplante Tasks" Ordners

.

2011-11-07 c:\windows\Tasks\DriverScanner.job

- c:\program files (x86)\Uniblue\DriverScanner\dsmonitor.exe [2011-08-06 09:22]

.

2011-11-03 c:\windows\Tasks\HPCeeScheduleForH-CRITTERSHAUß$.job

- c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-13 21:15]

.

2011-11-03 c:\windows\Tasks\HPCeeScheduleForH.-C.Rittershauß.job

- c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-13 21:15]

.

.

--------- x86-64 -----------

.

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00Zecter]

@="{D25B32FE-CB96-491A-98FF-AD59DA382D69}"

[HKEY_CLASSES_ROOT\CLSID\{D25B32FE-CB96-491A-98FF-AD59DA382D69}]

2010-11-09 22:16        2238976        ----a-w-        c:\program files (x86)\Hewlett-Packard\HP CloudDrive\ShellExt64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\01Zecter]

@="{EB24CA6D-F315-4A81-AC1A-C79CFD77F3F5}"

[HKEY_CLASSES_ROOT\CLSID\{EB24CA6D-F315-4A81-AC1A-C79CFD77F3F5}]

2010-11-09 22:16        2238976        ----a-w-        c:\program files (x86)\Hewlett-Packard\HP CloudDrive\ShellExt64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\02Zecter]

@="{B3C78E40-6B64-47C3-AE34-60B770881EB8}"

[HKEY_CLASSES_ROOT\CLSID\{B3C78E40-6B64-47C3-AE34-60B770881EB8}]

2010-11-09 22:16        2238976        ----a-w-        c:\program files (x86)\Hewlett-Packard\HP CloudDrive\ShellExt64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\03Zecter]

@="{622AFE52-33F6-4D9F-9966-E0BC52D7D69D}"

[HKEY_CLASSES_ROOT\CLSID\{622AFE52-33F6-4D9F-9966-E0BC52D7D69D}]

2010-11-09 22:16        2238976        ----a-w-        c:\program files (x86)\Hewlett-Packard\HP CloudDrive\ShellExt64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\04Zecter]

@="{855156F0-2A0F-11DE-8C30-0800200C9A66}"

[HKEY_CLASSES_ROOT\CLSID\{855156F0-2A0F-11DE-8C30-0800200C9A66}]

2010-11-09 22:16        2238976        ----a-w-        c:\program files (x86)\Hewlett-Packard\HP CloudDrive\ShellExt64.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-11-29 167960]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-11-29 391704]

"Persistence"="c:\windows\system32\igfxpers.exe" [2010-11-29 417304]

"SynTPEnh"="c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe" [BU]

"SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2010-12-13 524800]

"HPWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\DelayedAppStarter.exe" [2010-07-21 8192]

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = hxxp://start.icq.com/sm

uLocal Page = c:\windows\system32\blank.htm

mLocal Page = c:\windows\SysWOW64\blank.htm

IE: Free YouTube to MP3 Converter - c:\users\H.-C.Rittershauß\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm

IE: {{7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - c:\program files (x86)\ICQ7.5\ICQ.exe

TCP: DhcpNameServer = 192.168.2.1

FF - ProfilePath - c:\users\H.-C.Rittershauß\AppData\Roaming\Mozilla\Firefox\Profiles\pn47jxqx.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.2.9&q=

FF - prefs.js: browser.search.selectedEngine - ICQ Search

FF - prefs.js: browser.startup.homepage - hxxp://start.icq.com/

FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.3.6&q=

FF - user.js: yahoo.ytff.general.dontshowhpoffer - true

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)

.

.

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10o_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10o_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10o.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.10"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10o.ocx, 1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10o.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10o.ocx, 1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

------------------------ Weitere laufende Prozesse ------------------------

.

c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe

c:\windows\SysWOW64\ezSharedSvcHost.exe

c:\program files (x86)\Common Files\LightScribe\LSSrvc.exe

c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

c:\program files (x86)\Microsoft\BingBar\SeaPort.EXE

c:\program files (x86)\OpenOffice.org 3\program\soffice.exe

c:\program files (x86)\OpenOffice.org 3\program\soffice.bin

c:\program files (x86)\CyberLink\YouCam\YCMMirage.exe

c:\program files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe

.

**************************************************************************

.

Zeit der Fertigstellung: 2011-11-07  20:30:13 - PC wurde neu gestartet

ComboFix-quarantined-files.txt  2011-11-07 19:30

ComboFix2.txt  2011-11-07 17:00

.

Vor Suchlauf: 14 Verzeichnis(se), 347.616.714.752 Bytes frei

Nach Suchlauf: 15 Verzeichnis(se), 347.558.125.568 Bytes frei

.

- - End Of File - - 59726924AA38EB0B5F6578C866F557CE

--- --- ---

Mondstein

sehr gut.
malwarebytes:
Downloade Dir bitte Malwarebytes

Installiere
das Programm in den vorgegebenen Pfad.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Starte Malwarebytes, klicke auf Aktualisierung --> Suche
nach Aktualisierung
Wenn das Update beendet wurde, aktiviere vollständiger Scan durchführen und drücke auf Scannen.
Wenn der Scan beendet
ist, klicke auf Ergebnisse anzeigen.
Versichere Dich, dass alle Funde markiert sind und drücke Entferne Auswahl.
Poste
das Logfile, welches sich in Notepad öffnet, hier in den Thread.
Nachträglich kannst du den Bericht unter "Log Dateien" finden.

Hallo

Hier das Ergebnis:

Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Datenbank Version: 8109

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

07.11.2011 21:52:38
mbam-log-2011-11-07 (21-52-38).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|F:\|)
Durchsuchte Objekte: 377080
Laufzeit: 37 Minute(n), 14 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 1

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Ein Fund wurde angezeigt und hoffe mal behoben.

Mondstein

ja und warum postest du den nicht?

Sorry.....

gefunden wurde:

Trojan.Agent

Mondstein

Hallo

Ich wollte nur nochmals vielen Dank sagen :dankeschoen:

Gruß
Mondstein