Trojaner-Board - Habe auch Probleme mit "Failed to save all the components for the file System32\\00... " Win7

Trojaner-Board (https://www.trojaner-board.de/)

- Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)

- - Habe auch Probleme mit "Failed to save all the components for the file System32\\00... " Win7 (https://www.trojaner-board.de/105647-habe-probleme-failed-to-save-all-the-components-for-the-file-system32-00-win7.html)

Habe auch Probleme mit "Failed to save all the components for the file System32\\00... " Win7

Hallo, könnt ihr mir bitte helfen?
Auch bei mir öffnen sich etliche Fenster, in denen "Failed to save all the components for the file System32. The file is corrupted or unreadable. This Error maybe caused by a Pc hardware Problem." steht. Desktop-Symbole, Ordner und auch Programme sind weg, so auch der Firefox und der IE.
In einem ähnlichen Thread steht, man soll einen eigenen Thread eröffnen und dann evtl. auf angepasste Scripts warten. Das mache ich dann hiermit mal und hoffe wirklich auf Hilfe.

klappt das im abgesicherten modus mit netzwerk, da kommst du hin wenn du f8 bei system start drückst:
Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

Starte bitte die
OTL.exe
.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Kopiere nun den Inhalt in die http://larusso.trojaner-board.de/Images/otlfix.jpg
Textbox.

Code:

activex

netsvcs

msconfig

%SYSTEMDRIVE%\*.

%PROGRAMFILES%\*.exe

%LOCALAPPDATA%\*.exe

%systemroot%\*. /mp /s

/md5start

userinit.exe

eventlog.dll

scecli.dll

netlogon.dll

cngaudit.dll

ws2ifsl.sys

sceclt.dll

ntelogon.dll

winlogon.exe

logevent.dll

user32.DLL

explorer.exe

iaStor.sys

nvstor.sys

atapi.sys

IdeChnDr.sys

viasraid.sys

AGP440.sys

vaxscsi.sys

nvatabus.sys

viamraid.sys

nvata.sys

nvgts.sys

iastorv.sys

ViPrt.sys

eNetHook.dll

ahcix86.sys

KR10N.sys

nvstor32.sys

ahcix86s.sys

/md5stop

%systemroot%\system32\drivers\*.sys /lockedfiles

%systemroot%\System32\config\*.sav

%systemroot%\system32\*.dll /lockedfiles

%USERPROFILE%\*.*

%USERPROFILE%\Local Settings\Temp\*.exe

%USERPROFILE%\Local Settings\Temp\*.dll

%USERPROFILE%\Application Data\*.exe

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs

CREATERESTOREPOINT

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Kopiere
nun den Inhalt aus OTL.txt und Extra.txt hier in Deinen Thread

fals das nicht geht, nutze erst mal unhide im abges.modus
http://filepony.de/download-unhide/
doppelklicken, dateien werden sichtbar

nein, auch im abgesicherten modus klappt internet nicht, muss jetzt mit stick arbeiten. und sorry, wenns länger dauert, ich bin nicht wirklich fit in solchen sachen.OTL Logfile:

Code:

OTL logfile created on: 01.12.2011 16:32:36 - Run 1

OTL by OldTimer - Version 3.2.31.0     Folder = C:\Users\Angela\Desktop

64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

3,91 Gb Total Physical Memory | 2,91 Gb Available Physical Memory | 74,24% Memory free

7,82 Gb Paging File | 6,83 Gb Available in Paging File | 87,28% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 657,54 Gb Total Space | 617,81 Gb Free Space | 93,96% Space Free | Partition Type: NTFS

Drive D: | 37,99 Gb Total Space | 13,84 Gb Free Space | 36,43% Space Free | Partition Type: NTFS

Drive E: | 116,44 Gb Total Space | 39,42 Gb Free Space | 33,86% Space Free | Partition Type: NTFS

Drive F: | 104,73 Gb Total Space | 66,17 Gb Free Space | 63,19% Space Free | Partition Type: NTFS

Drive H: | 1,88 Gb Total Space | 0,27 Gb Free Space | 14,21% Space Free | Partition Type: FAT

 

Computer Name: LÄPPI | User Name: Angela | Logged in as Administrator.

Boot Mode: SafeMode with Networking | Scan Mode: Current user | Include 64bit Scans

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2011.12.01 15:56:40 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Angela\Desktop\OTL.exe

 

 
 ========== Modules (No Company Name) ==========

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV:64bit: - [2011.05.02 22:27:50 | 001,517,328 | ---- | M] (Intel(R) Corporation) [Auto | Stopped] -- C:\Program Files\Intel\WiFi\bin\EvtEng.exe -- (EvtEng)

SRV:64bit: - [2011.05.02 22:13:54 | 000,340,240 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe -- (MyWiFiDHCPDNS)

SRV:64bit: - [2011.05.02 22:10:26 | 000,844,560 | ---- | M] (Intel(R) Corporation) [Auto | Stopped] -- C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe -- (RegSrvc)

SRV:64bit: - [2011.04.21 17:34:16 | 001,136,640 | ---- | M] (Intel Corporation) [Auto | Stopped] -- C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe -- (AMPPALR3)

SRV:64bit: - [2011.04.21 16:42:50 | 000,134,928 | ---- | M] (Intel(R) Corporation) [Auto | Stopped] -- C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe -- (BTHSSecurityMgr)

SRV:64bit: - [2010.12.17 15:46:34 | 000,198,784 | ---- | M] (Conexant Systems Inc.) [Auto | Stopped] -- C:\Windows\SysNative\CxAudMsg64.exe -- (CxAudMsg)

SRV:64bit: - [2010.09.23 02:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)

SRV:64bit: - [2009.07.14 02:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend)

SRV - [2011.09.05 09:04:54 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) [Auto | Stopped] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)

SRV - [2011.07.21 11:08:02 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Stopped] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)

SRV - [2011.04.30 08:32:54 | 000,013,592 | ---- | M] (Intel Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc) Intel(R)

SRV - [2011.04.21 06:52:51 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Stopped] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)

SRV - [2011.02.22 21:20:21 | 002,656,280 | ---- | M] (Intel Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS) Intel(R)

SRV - [2011.02.22 21:20:17 | 000,326,168 | ---- | M] (Intel Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS) Intel(R)

SRV - [2011.02.11 20:40:00 | 000,997,712 | ---- | M] (Intel Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe -- (Bluetooth OBEX Service)

SRV - [2011.02.11 20:39:58 | 001,304,912 | ---- | M] (Intel Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe -- (Bluetooth Media Service)

SRV - [2011.02.11 20:39:54 | 000,907,600 | ---- | M] (Intel Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe -- (Bluetooth Device Monitor)

SRV - [2010.11.03 18:31:44 | 000,558,592 | ---- | M] (Hauppauge Computer Works) [Auto | Stopped] -- C:\PROGRA~2\WinTV\TVServer\HAUPPA~1.EXE -- (HauppaugeTVServer)

SRV - [2010.10.07 01:46:42 | 000,159,752 | R--- | M] () [Auto | Stopped] -- C:\Program Files (x86)\PHotkey\GFNEXSrv.exe -- (GFNEXSrv)

SRV - [2010.03.18 21:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)

SRV - [2010.03.10 13:26:48 | 000,189,728 | ---- | M] (Protexis Inc.) [Auto | Stopped] -- c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe -- (PSI_SVC_2)

SRV - [2009.12.18 23:40:48 | 000,104,968 | R--- | M] () [Auto | Stopped] -- C:\Program Files (x86)\PHotkey\ASLDRSrv.exe -- (ASLDRService)

SRV - [2009.06.10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV:64bit: - [2011.08.01 14:59:06 | 000,045,416 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\point64.sys -- (Point64)

DRV:64bit: - [2011.07.21 11:11:10 | 000,123,784 | ---- | M] (Avira GmbH) [Kernel | System | Stopped] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)

DRV:64bit: - [2011.07.21 11:11:09 | 000,088,288 | ---- | M] (Avira GmbH) [File_System | Auto | Stopped] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)

DRV:64bit: - [2011.05.17 17:27:52 | 000,025,496 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\iwdbus.sys -- (iwdbus)

DRV:64bit: - [2011.05.17 17:27:50 | 000,034,200 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\intelaud.sys -- (intaud_WaveExtensible)

DRV:64bit: - [2011.05.01 22:33:06 | 008,593,920 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NETwNs64.sys -- (NETwNs64) ___ Intel(R)

DRV:64bit: - [2011.04.26 19:07:36 | 000,557,848 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)

DRV:64bit: - [2011.04.21 17:09:26 | 000,294,912 | ---- | M] (Windows (R) Win 7 DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\AmpPal.sys -- (AMPPALP) Intel(R) Centrino(R)

DRV:64bit: - [2011.04.21 17:09:26 | 000,294,912 | ---- | M] (Windows (R) Win 7 DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\AmpPal.sys -- (AMPPAL) Intel(R) Centrino(R)

DRV:64bit: - [2011.04.15 10:08:26 | 012,228,128 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)

DRV:64bit: - [2011.04.15 00:16:08 | 000,031,088 | ---- | M] (CyberLink Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\clwvd.sys -- (clwvd)

DRV:64bit: - [2011.04.13 17:30:54 | 000,207,872 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nusb3xhc.sys -- (nusb3xhc)

DRV:64bit: - [2011.04.13 17:30:50 | 000,087,552 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nusb3hub.sys -- (nusb3hub)

DRV:64bit: - [2011.03.11 07:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)

DRV:64bit: - [2011.03.11 07:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)

DRV:64bit: - [2011.03.10 16:01:40 | 001,581,184 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\CHDRT64.sys -- (CnxtHdAudService)

DRV:64bit: - [2011.01.24 10:24:52 | 000,058,128 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btmaux.sys -- (btmaux)

DRV:64bit: - [2011.01.24 10:22:48 | 000,059,904 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\iBtFltCoex.sys -- (iBtFltCoex)

DRV:64bit: - [2011.01.24 09:56:06 | 000,274,944 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btmhsf.sys -- (btmhsf)

DRV:64bit: - [2010.11.21 04:24:33 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)

DRV:64bit: - [2010.11.21 04:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)

DRV:64bit: - [2010.11.21 04:23:47 | 000,031,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD)

DRV:64bit: - [2010.10.20 01:34:26 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (MEIx64) Intel(R)

DRV:64bit: - [2010.10.15 00:28:16 | 000,317,440 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\IntcDAud.sys -- (IntcDAud) Intel(R)

DRV:64bit: - [2010.09.27 10:32:28 | 000,632,704 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw10bda.sys -- (hcw10bda)

DRV:64bit: - [2010.09.23 21:03:06 | 000,129,008 | ---- | M] (CyberLink) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\wsvd.sys -- (wsvd)

DRV:64bit: - [2010.08.24 17:55:44 | 000,076,912 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\L1C62x64.sys -- (L1C)

DRV:64bit: - [2010.05.10 08:29:16 | 000,046,080 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | Auto | Stopped] -- C:\Windows\SysNative\drivers\hcw10cir.sys -- (hcw10cir)

DRV:64bit: - [2010.01.27 03:09:02 | 000,047,632 | ---- | M] (CACE Technologies, Inc.) [Kernel | Auto | Stopped] -- C:\Windows\SysNative\drivers\npf.sys -- (npf)

DRV:64bit: - [2010.01.22 10:26:50 | 000,305,200 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP)

DRV:64bit: - [2009.10.23 16:26:14 | 000,046,592 | ---- | M] (Alcor Micro, Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\AmUStor.sys -- (AmUStor)

DRV:64bit: - [2009.07.14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)

DRV:64bit: - [2009.07.14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)

DRV:64bit: - [2009.07.14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)

DRV:64bit: - [2009.06.10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)

DRV:64bit: - [2009.06.10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)

DRV:64bit: - [2009.06.10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)

DRV:64bit: - [2009.06.10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)

DRV - [2011.09.03 10:43:36 | 000,001,722 | ---- | M] () [Kernel | System | Running] -- C:\Windows\SysWow64\NULL -- (Null)

DRV - [2009.09.11 22:11:46 | 000,014,344 | R--- | M] (PEGATRON) [Kernel | Auto | Stopped] -- C:\Program Files (x86)\PHotkey\PEGAGFN.sys -- (PEGAGFN)

DRV - [2009.07.14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.aldi.com

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = https://www.bwin.com/de/sportsbook.aspx

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 
 ========== FireFox ==========

 

FF - prefs.js..browser.search.defaultengine: "Ask.com"

FF - prefs.js..browser.search.defaultenginename: "Ask.com"

FF - prefs.js..browser.search.order.1: "Ask.com"

FF - prefs.js..browser.search.selectedEngine: "Google"

FF - prefs.js..browser.search.useDBForOrder: true

FF - prefs.js..browser.startup.homepage: "hxxp://my.ebay.de/ws/eBayISAPI.dll?MyEbayBeta&CurrentPage=MyeBayNextSelling&ssPageName=STRK:ME:LNLK:MESEX"

FF - prefs.js..keyword.URL: "hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q="

 

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_1_102.dll File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()

FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.0.60310.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\virtualKeyboard@kaspersky.ru: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\FFExt\virtualKeyboard@kaspersky.ru

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\KavAntiBanner@Kaspersky.ru: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\FFExt\KavAntiBanner@kaspersky.ru

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\linkfilter@kaspersky.ru: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\FFExt\linkfilter@kaspersky.ru

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011.11.09 17:11:31 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011.09.28 05:39:50 | 000,000,000 | ---D | M]

 

[2011.09.02 05:46:24 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\Angela\AppData\Roaming\mozilla\Extensions

[2011.12.01 15:37:12 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\Angela\AppData\Roaming\mozilla\Firefox\Profiles\xhtjj79a.default\extensions

[2011.12.01 15:37:12 | 000,000,000 | -H-D | M] (BitDefender QuickScan) -- C:\Users\Angela\AppData\Roaming\mozilla\Firefox\Profiles\xhtjj79a.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}

[2011.11.03 11:27:59 | 000,000,933 | -H-- | M] () -- C:\Users\Angela\AppData\Roaming\Mozilla\Firefox\Profiles\xhtjj79a.default\searchplugins\11-suche.xml

[2011.10.30 10:37:20 | 000,002,399 | -H-- | M] () -- C:\Users\Angela\AppData\Roaming\Mozilla\Firefox\Profiles\xhtjj79a.default\searchplugins\askcom.xml

[2011.11.03 11:27:59 | 000,002,419 | -H-- | M] () -- C:\Users\Angela\AppData\Roaming\Mozilla\Firefox\Profiles\xhtjj79a.default\searchplugins\englische-ergebnisse.xml

[2011.09.02 18:07:03 | 000,010,525 | -H-- | M] () -- C:\Users\Angela\AppData\Roaming\Mozilla\Firefox\Profiles\xhtjj79a.default\searchplugins\gmx-suche.xml

[2011.11.03 11:27:59 | 000,002,457 | -H-- | M] () -- C:\Users\Angela\AppData\Roaming\Mozilla\Firefox\Profiles\xhtjj79a.default\searchplugins\lastminute.xml

[2011.11.03 11:27:59 | 000,005,508 | -H-- | M] () -- C:\Users\Angela\AppData\Roaming\Mozilla\Firefox\Profiles\xhtjj79a.default\searchplugins\webde-suche.xml

[2011.11.09 17:11:34 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions

[2011.09.27 21:37:29 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA}

() (No name found) -- C:\USERS\ANGELA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\XHTJJ79A.DEFAULT\EXTENSIONS\TOOLBAR@GMX.NET.XPI

[2011.11.09 17:11:30 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll

[2011.07.19 04:05:25 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll

[2010.03.08 11:24:04 | 000,103,168 | ---- | M] (Midasplayer Ltd) -- C:\Program Files (x86)\mozilla firefox\plugins\npmidas.dll

[2011.09.10 08:20:16 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml

[2011.09.10 08:20:16 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml

[2011.09.10 08:20:16 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml

[2011.09.10 08:20:16 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml

[2011.09.10 08:20:16 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml

[2011.09.10 08:20:16 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml

 

O1 HOSTS File: ([2009.06.10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts

O2:64bit: - BHO: (GMX Toolbar BHO) - {BF42D4A8-016E-4fcd-B1EB-837659FD77C6} - C:\Program Files\GMX Toolbar\IE\uitb.dll (1und1 Mail und Media GmbH)

O2 - BHO: (GMX Toolbar BHO) - {BF42D4A8-016E-4fcd-B1EB-837659FD77C6} - C:\Program Files (x86)\GMX Toolbar\IE\uitb.dll (1und1 Mail und Media GmbH)

O3:64bit: - HKLM\..\Toolbar: (GMX Toolbar BETA 1) - {C424171E-592A-415a-9EB1-DFD6D95D3530} - C:\Program Files\GMX Toolbar\IE\uitb.dll (1und1 Mail und Media GmbH)

O3 - HKLM\..\Toolbar: (GMX Toolbar BETA 1) - {C424171E-592A-415a-9EB1-DFD6D95D3530} - C:\Program Files (x86)\GMX Toolbar\IE\uitb.dll (1und1 Mail und Media GmbH)

O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.

O3:64bit: - HKCU\..\Toolbar\WebBrowser: (GMX Toolbar BETA 1) - {C424171E-592A-415A-9EB1-DFD6D95D3530} - C:\Program Files\GMX Toolbar\IE\uitb.dll (1und1 Mail und Media GmbH)

O3 - HKCU\..\Toolbar\WebBrowser: (GMX Toolbar BETA 1) - {C424171E-592A-415A-9EB1-DFD6D95D3530} - C:\Program Files (x86)\GMX Toolbar\IE\uitb.dll (1und1 Mail und Media GmbH)

O4:64bit: - HKLM..\Run: [IntelliPoint] c:\Program Files\Microsoft IntelliPoint\ipoint.exe (Microsoft Corporation)

O4:64bit: - HKLM..\Run: [IntelPAN] C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe (Intel(R) Corporation)

O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)

O4 - HKCU..\Run: [NfWOkoyrvDaoRQH.exe] C:\ProgramData\NfWOkoyrvDaoRQH.exe ()

O4 - Startup: C:\Users\Angela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\A Note.lnk = C:\Program Files (x86)\A Note\A Note.exe (A Note)

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O8:64bit: - Extra context menu item: Google Sidewiki... - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html File not found

O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html File not found

O9:64bit: - Extra Button: eBay - Der weltweite Online-Marktplatz - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4 File not found

O9:64bit: - Extra 'Tools' menuitem : eBay - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4 File not found

O9 - Extra Button: eBay - Der weltweite Online-Marktplatz - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4 File not found

O9 - Extra 'Tools' menuitem : eBay - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4 File not found

O1364bit: - gopher Prefix: missing

O13 - gopher Prefix: missing

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25)

O16 - DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Java Plug-in 1.6.0_27)

O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)

O16 - DPF: {CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Java Plug-in 1.6.0_27)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Java Plug-in 1.6.0_27)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{8068FE7C-7296-400B-9019-82B7F3A7BDB2}: DhcpNameServer = 192.168.0.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F1AEB345-498B-4D3D-A2B8-DB5469020C02}: DhcpNameServer = 192.168.0.1

O18:64bit: - Protocol\Handler\gmx {8FAF0273-9CA8-4efc-9536-1E35E254D5CD} - C:\Program Files\GMX Toolbar\IE\uitb.dll (1und1 Mail und Media GmbH)

O18:64bit: - Protocol\Handler\livecall - No CLSID value found

O18:64bit: - Protocol\Handler\msnim - No CLSID value found

O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found

O18:64bit: - Protocol\Handler\wlpg - No CLSID value found

O18 - Protocol\Handler\gmx {8FAF0273-9CA8-4efc-9536-1E35E254D5CD} - C:\Program Files (x86)\GMX Toolbar\IE\uitb.dll (1und1 Mail und Media GmbH)

O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (userinit.exe) -C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found

O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)

O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - E:\autoexec.bat -- [ NTFS ]

O34 - HKLM BootExecute: (autocheck autochk *)

O35:64bit: - HKLM\..comfile [open] -- "%1" %*

O35:64bit: - HKLM\..exefile [open] -- "%1" %*

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*

O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2011.12.01 16:30:24 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\Angela\Desktop\OTL.exe

[2011.12.01 15:37:28 | 000,000,000 | -H-D | C] -- C:\Users\Angela\AppData\Roaming\QuickScan

[2011.12.01 15:13:19 | 000,000,000 | -H-D | C] -- C:\Users\Angela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Fix

[2011.11.19 17:54:26 | 000,000,000 | -H-D | C] -- C:\Users\Angela\Desktop\Dichtung-einbauen-Dateien

[2011.11.19 10:35:43 | 000,000,000 | -H-D | C] -- C:\Users\Angela\Desktop\fensterdichtung-t22388-Dateien

[2011.11.17 18:49:12 | 000,000,000 | -H-D | C] -- C:\Users\Angela\Desktop\DisplayProductInformation-SearchDetail-Dateien

[2011.11.16 14:14:01 | 000,000,000 | -H-D | C] -- C:\Users\Angela\Desktop\Schokokekse mit Karamell _ Pi mal Butter-Dateien

[2011.11.12 10:32:00 | 000,000,000 | -H-D | C] -- C:\Users\Angela\Desktop\111112_wolfsabend-Dateien

[2011.11.12 09:27:43 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\Macromed

[2011.11.10 10:18:42 | 000,000,000 | -H-D | C] -- C:\Users\Angela\Desktop\Fotos November

[2011.11.10 08:55:45 | 000,000,000 | -H-D | C] -- C:\Users\Angela\Desktop\150678567191-Dateien

[2011.11.04 19:29:11 | 000,000,000 | -H-D | C] -- C:\Users\Angela\Desktop\13234098-Rueschenschal-in-schwarz-Dateien

[2011.11.01 19:02:40 | 000,000,000 | -H-D | C] -- C:\Users\Angela\Desktop\Steuerkram

[2011.11.01 19:02:30 | 000,000,000 | -H-D | C] -- C:\Users\Angela\Desktop\Mietkram

[2011.10.30 10:33:45 | 003,623,592 | ---- | C] (Ask) -- C:\Program Files (x86)\Common Files\ApnToolbarInstaller.exe

[2011.10.30 10:33:45 | 000,143,240 | ---- | C] (Ask.com) -- C:\Program Files (x86)\Common Files\ApnStub.exe

[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

 
 ========== Files - Modified Within 30 Days ==========

 

[2011.12.01 16:28:54 | 000,067,584 | -H-- | M] () -- C:\Windows\bootstat.dat

[2011.12.01 16:28:52 | 3151,327,232 | -HS- | M] () -- C:\hiberfil.sys

[2011.12.01 15:56:40 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Angela\Desktop\OTL.exe

[2011.12.01 15:50:29 | 000,016,752 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2011.12.01 15:50:29 | 000,016,752 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2011.12.01 15:49:16 | 001,498,506 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI

[2011.12.01 15:49:16 | 000,654,166 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat

[2011.12.01 15:49:16 | 000,616,008 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat

[2011.12.01 15:49:16 | 000,130,006 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat

[2011.12.01 15:49:16 | 000,106,388 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat

[2011.12.01 15:18:18 | 000,000,456 | -H-- | M] () -- C:\ProgramData\jTsDdw9NssHWjx

[2011.12.01 15:16:41 | 000,000,312 | -H-- | M] () -- C:\ProgramData\~jTsDdw9NssHWjx

[2011.12.01 15:16:41 | 000,000,216 | -H-- | M] () -- C:\ProgramData\~jTsDdw9NssHWjxr

[2011.12.01 15:13:19 | 000,000,653 | -H-- | M] () -- C:\Users\Angela\Desktop\System Fix.lnk

[2011.12.01 15:12:32 | 000,370,688 | -H-- | M] () -- C:\ProgramData\jTsDdw9NssHWjx.exe

[2011.12.01 15:05:47 | 000,464,896 | -H-- | M] () -- C:\ProgramData\NfWOkoyrvDaoRQH.exe

[2011.11.30 22:13:24 | 000,033,923 | -H-- | M] () -- C:\Users\Angela\Desktop\monatl. Überweisungen.odt

[2011.11.25 19:30:03 | 000,020,676 | -H-- | M] () -- C:\Users\Angela\Desktop\komplette liste erstellen.odt

[2011.11.20 18:39:39 | 000,010,635 | -H-- | M] () -- C:\Users\Angela\Desktop\zinn.odt

[2011.11.19 17:54:26 | 000,009,275 | -H-- | M] () -- C:\Users\Angela\Desktop\Dichtung-einbauen.html

[2011.11.19 10:35:43 | 000,072,045 | -H-- | M] () -- C:\Users\Angela\Desktop\fensterdichtung-t22388.html

[2011.11.17 18:49:12 | 000,260,637 | -H-- | M] () -- C:\Users\Angela\Desktop\DisplayProductInformation-SearchDetail.htm

[2011.11.16 14:14:02 | 000,071,086 | -H-- | M] () -- C:\Users\Angela\Desktop\Schokokekse mit Karamell _ Pi mal Butter.htm

[2011.11.12 10:32:01 | 000,039,398 | -H-- | M] () -- C:\Users\Angela\Desktop\111112_wolfsabend.html

[2011.11.12 09:27:46 | 000,414,368 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl

[2011.11.11 18:11:50 | 000,030,040 | -H-- | M] () -- C:\Users\Angela\Desktop\November.odt

[2011.11.10 08:55:46 | 000,109,425 | -H-- | M] () -- C:\Users\Angela\Desktop\150678567191.htm

[2011.11.09 07:44:12 | 000,406,312 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT

[2011.11.07 16:48:53 | 000,019,031 | -H-- | M] () -- C:\Users\Angela\Desktop\Bücherliste.odt

[2011.11.07 07:53:26 | 000,849,359 | -H-- | M] () -- C:\Users\Angela\Desktop\maxx.jpg

[2011.11.06 15:24:38 | 000,026,373 | -H-- | M] () -- C:\Users\Angela\Desktop\ordnungsamt.odt

[2011.11.04 19:29:11 | 000,128,519 | -H-- | M] () -- C:\Users\Angela\Desktop\13234098-Rueschenschal-in-schwarz.htm

[2011.11.04 17:42:02 | 000,016,818 | -H-- | M] () -- C:\Users\Angela\Desktop\komplette liste erstellen - Rest.odt

[2011.11.04 17:17:45 | 280,909,672 | -H-- | M] () -- C:\Users\Angela\Desktop\Standard_20111104_171645.zip

[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

 
 ========== Files Created - No Company Name ==========

 

[2011.12.01 15:13:20 | 000,000,216 | -H-- | C] () -- C:\ProgramData\~jTsDdw9NssHWjxr

[2011.12.01 15:13:19 | 000,000,653 | -H-- | C] () -- C:\Users\Angela\Desktop\System Fix.lnk

[2011.12.01 15:13:19 | 000,000,312 | -H-- | C] () -- C:\ProgramData\~jTsDdw9NssHWjx

[2011.12.01 15:13:12 | 000,000,456 | -H-- | C] () -- C:\ProgramData\jTsDdw9NssHWjx

[2011.12.01 15:12:32 | 000,370,688 | -H-- | C] () -- C:\ProgramData\jTsDdw9NssHWjx.exe

[2011.12.01 15:09:22 | 000,464,896 | -H-- | C] () -- C:\ProgramData\NfWOkoyrvDaoRQH.exe

[2011.11.20 18:39:35 | 000,010,635 | -H-- | C] () -- C:\Users\Angela\Desktop\zinn.odt

[2011.11.19 17:54:26 | 000,009,275 | -H-- | C] () -- C:\Users\Angela\Desktop\Dichtung-einbauen.html

[2011.11.19 10:35:43 | 000,072,045 | -H-- | C] () -- C:\Users\Angela\Desktop\fensterdichtung-t22388.html

[2011.11.17 18:49:11 | 000,260,637 | -H-- | C] () -- C:\Users\Angela\Desktop\DisplayProductInformation-SearchDetail.htm

[2011.11.16 14:14:01 | 000,071,086 | -H-- | C] () -- C:\Users\Angela\Desktop\Schokokekse mit Karamell _ Pi mal Butter.htm

[2011.11.12 10:32:00 | 000,039,398 | -H-- | C] () -- C:\Users\Angela\Desktop\111112_wolfsabend.html

[2011.11.10 08:55:44 | 000,109,425 | -H-- | C] () -- C:\Users\Angela\Desktop\150678567191.htm

[2011.11.07 07:53:26 | 000,849,359 | -H-- | C] () -- C:\Users\Angela\Desktop\maxx.jpg

[2011.11.06 11:54:27 | 000,026,373 | -H-- | C] () -- C:\Users\Angela\Desktop\ordnungsamt.odt

[2011.11.05 09:27:02 | 000,019,031 | -H-- | C] () -- C:\Users\Angela\Desktop\Bücherliste.odt

[2011.11.04 19:29:10 | 000,128,519 | -H-- | C] () -- C:\Users\Angela\Desktop\13234098-Rueschenschal-in-schwarz.htm

[2011.11.04 17:17:08 | 280,909,672 | -H-- | C] () -- C:\Users\Angela\Desktop\Standard_20111104_171645.zip

[2011.11.01 19:10:56 | 000,030,040 | -H-- | C] () -- C:\Users\Angela\Desktop\November.odt

[2011.10.30 10:33:46 | 000,444,283 | ---- | C] () -- C:\Program Files (x86)\Common Files\WinPcapNmap.exe

[2011.09.27 17:43:41 | 000,000,209 | ---- | C] () -- C:\Windows\ODBCINST.INI

[2011.09.27 17:43:41 | 000,000,135 | ---- | C] () -- C:\Windows\ODBC.INI

[2011.09.27 17:43:25 | 000,037,574 | ---- | C] () -- C:\Windows\Irremote.ini

[2011.09.27 17:43:14 | 000,142,337 | ---- | C] () -- C:\Windows\SysWow64\Wait.exe

[2011.09.27 17:42:34 | 000,005,110 | ---- | C] () -- C:\Windows\HCWPNP.INI

[2011.09.02 19:23:54 | 000,000,038 | ---- | C] () -- C:\Windows\avisplitter.ini

[2011.09.02 19:23:53 | 000,650,752 | ---- | C] () -- C:\Windows\SysWow64\xvidcore.dll

[2011.09.02 19:23:53 | 000,243,200 | ---- | C] () -- C:\Windows\SysWow64\xvidvfw.dll

[2011.09.02 19:23:52 | 000,074,752 | ---- | C] () -- C:\Windows\SysWow64\ff_vfw.dll

[2011.09.02 17:16:39 | 000,032,608 | ---- | C] () -- C:\Windows\king-uninstall.exe

[2011.06.08 20:34:59 | 013,359,616 | ---- | C] () -- C:\Windows\SysWow64\ig4icd32.dll

[2011.06.08 20:34:59 | 000,056,832 | ---- | C] () -- C:\Windows\SysWow64\igdde32.dll

[2011.05.27 02:14:01 | 000,963,116 | ---- | C] () -- C:\Windows\SysWow64\igkrng600.bin

[2011.05.27 02:14:00 | 000,218,304 | ---- | C] () -- C:\Windows\SysWow64\igfcg600m.bin

[2011.05.27 02:14:00 | 000,145,804 | ---- | C] () -- C:\Windows\SysWow64\igcompkrng600.bin

[2010.01.27 03:09:02 | 000,053,299 | ---- | C] () -- C:\Windows\SysWow64\pthreadVC.dll

[2009.07.14 06:38:36 | 000,067,584 | -H-- | C] () -- C:\Windows\bootstat.dat

[2009.07.14 03:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT

[2009.07.14 03:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat

[2009.07.14 01:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin

[2009.07.14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll

[2009.07.13 22:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll

[2009.06.10 22:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat
 

< End of report >

--- --- ---

sorry, hab das mit dem unhide erst hinterher gesehen, mache ich gerade. soll ich im abgesicherten modus bleiben?

hi

wir arbeiten hier nicht auf geschwindigkeit, nimm dir die zeit die du benötigst.
den fix kannst du erst mal im abgesicherten modus machen, danach kannst du dann wieder in den normalen modus starten
achtung!
dieses script sowie evtl. folgende scripts sind nur für den jeweiligen user.
wenn ihr probleme habt, eröffnet eigene topics und wartet auf, für euch angepasste scripts.

• Starte bitte die OTL.exe
• Kopiere nun das Folgende in die Textbox.

Code:

:OTL

FF - prefs.js..browser.search.defaultengine: "Ask.com"

FF - prefs.js..browser.search.defaultenginename: "Ask.com"

FF - prefs.js..browser.search.order.1: "Ask.com"

[2011.10.30 10:37:20 | 000,002,399 | -H-- | M] () -- C:\Users\Angela\AppData\Roaming\Mozilla\Firefox\Profiles\xhtjj79a.default\searchplugins\askcom.xml

O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found

O4 - HKCU..\Run: [NfWOkoyrvDaoRQH.exe] C:\ProgramData\NfWOkoyrvDaoRQH.exe ()

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1

O8:64bit: - Extra context menu item: Google Sidewiki... - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html

File not found

O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html

File not found

O9:64bit: - Extra Button: eBay - Der weltweite Online-Marktplatz - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4

File not found

O9:64bit: - Extra 'Tools' menuitem : eBay - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4 File not found

O9 - Extra Button: eBay - Der weltweite Online-Marktplatz - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4

File not found

O9 - Extra 'Tools' menuitem : eBay - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4 File not found

O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

[2011.12.01 15:13:19 | 000,000,000 | -H-D | C] -- C:\Users\Angela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Fix

[2011.12.01 15:18:18 | 000,000,456 | -H-- | M] () -- C:\ProgramData\jTsDdw9NssHWjx

[2011.12.01 15:16:41 | 000,000,312 | -H-- | M] () -- C:\ProgramData\~jTsDdw9NssHWjx

[2011.12.01 15:16:41 | 000,000,216 | -H-- | M] () -- C:\ProgramData\~jTsDdw9NssHWjxr

[2011.12.01 15:13:19 | 000,000,653 | -H-- | M] () -- C:\Users\Angela\Desktop\System Fix.lnk

[2011.12.01 15:12:32 | 000,370,688 | -H-- | M] () -- C:\ProgramData\jTsDdw9NssHWjx.exe

[2011.12.01 15:05:47 | 000,464,896 | -H-- | M] () -- C:\ProgramData\NfWOkoyrvDaoRQH.exe

[2011.12.01 15:12:32 | 000,370,688 | -H-- | C] () -- C:\ProgramData\jTsDdw9NssHWjx.exe

:Files

C:\ProgramData\NfWOkoyrvDaoRQH.exe

:Commands

[purity]

[EMPTYFLASH] 

[emptytemp]

[Reboot]

• Schliesse bitte nun alle Programme.
• Klicke nun bitte auf den Fix Button.
• OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
• Nach dem Neustart findest Du ein Textdokument, dessen inhalt in deiner nächsten antwort hier reinkopieren.
neustart in den normalen modus sollte funktionieren.
rechtsklick auf den desktop, eigenschaften, bild aussuchen.
lade unhide:
http://filepony.de/download-unhide/
doppelklicken, dateien werden sichtbar

öffne computer, öffne C: dann _OTL
dort rechtsklick auf moved files
wähle zu moved files.rar oder zip hinzufügen.
folge dem link, und lade das archiv im upload channel hoch
http://www.trojaner-board.de/54791-a...ner-board.html

All processes killed
========== OTL ==========
Prefs.js: "Ask.com" removed from browser.search.defaultengine
Prefs.js: "Ask.com" removed from browser.search.defaultenginename
Prefs.js: "Ask.com" removed from browser.search.order.1
C:\Users\Angela\AppData\Roaming\Mozilla\Firefox\Profiles\xhtjj79a.default\searchplugins\askcom.xml moved successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\NfWOkoyrvDaoRQH.exe deleted successfully.
C:\ProgramData\NfWOkoyrvDaoRQH.exe moved successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktop deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktopChanges not found.
64bit-Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Google Sidewiki...\ deleted successfully.
File res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html not found.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Google Sidewiki...\ not found.
File res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{0B65DCC9-1740-43dc-B19C-4F309FB6A6CA}\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0B65DCC9-1740-43dc-B19C-4F309FB6A6CA}\ not found.
File hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4 not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{0B65DCC9-1740-43dc-B19C-4F309FB6A6CA}\ not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0B65DCC9-1740-43dc-B19C-4F309FB6A6CA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{0B65DCC9-1740-43dc-B19C-4F309FB6A6CA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0B65DCC9-1740-43dc-B19C-4F309FB6A6CA}\ not found.
File hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4 not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{0B65DCC9-1740-43dc-B19C-4F309FB6A6CA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0B65DCC9-1740-43dc-B19C-4F309FB6A6CA}\ not found.
64bit-Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.
C:\Users\Angela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Fix folder moved successfully.
C:\ProgramData\jTsDdw9NssHWjx moved successfully.
C:\ProgramData\~jTsDdw9NssHWjx moved successfully.
C:\ProgramData\~jTsDdw9NssHWjxr moved successfully.
C:\Users\Angela\Desktop\System Fix.lnk moved successfully.
C:\ProgramData\jTsDdw9NssHWjx.exe moved successfully.
File C:\ProgramData\NfWOkoyrvDaoRQH.exe not found.
File C:\ProgramData\jTsDdw9NssHWjx.exe not found.
========== FILES ==========
File\Folder C:\ProgramData\NfWOkoyrvDaoRQH.exe not found.
========== COMMANDS ==========

[EMPTYFLASH]

User: All Users

User: Angela
->Flash cache emptied: 79646 bytes

User: Default
->Flash cache emptied: 56468 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: Public

Total Flash Files Cleaned = 0,00 mb

[EMPTYTEMP]

User: All Users

User: Angela
->Temp folder emptied: 45578940 bytes
->Temporary Internet Files folder emptied: 223377287 bytes
->Java cache emptied: 38772 bytes
->FireFox cache emptied: 47078996 bytes
->Flash cache emptied: 0 bytes

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 99053919 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 50434 bytes
RecycleBin emptied: 1122965844 bytes

Total Files Cleaned = 1.467,00 mb

OTL by OldTimer - Version 3.2.31.0 log created on 12012011_170328

Files\Folders moved on Reboot...
C:\Users\Angela\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

Registry entries deleted on Reboot...

bei den moved files komme ich nicht weiter, wenn ich rechtsklicke, finde ich nix mit zip oder rar hinzufügen

ok
http://filepony.de/download-7-zip/
lade dir mal 7zip, instaliere es.
dann bitte rechtsklick auf moved files, 7zip menü aufklappen, hinzufügen zu movedfiles.7zip wählen und dann das archiv wie beschrieben hochladen

och, ich krieg das nich hin. 7zip installiert, aber ich kann bei 7zip nix öffnen, weil zugriff verweigert.

du kannst keinen rechtsklick in _otl auf moved files machen und zum archiv hinzufügen wählen?
versuchs mal nach neustart

nein, gibt nix mit hinzufügen. hätte ich nach7zip-installation erst neustarten sollen?

versuchs mal.
um genau zu sein, rechtsklick, 7zip menü auswählen, aufklappen, hinzu fügen zu au moved files..." auswählen

nein, bei rechtsklick kommt nix und wenn ich in 7zip die datei suchen will, heisst es Zugriff verweigert.

ok dann anders.
lade winrar
zieller ...

Ergebnisdetails
WinRAR Download und Support Deutschland | winrar.de - offizieller WinRAR-Distributor
instalieren, evtl. neustarten und dann über rechtsklick zu moved files.rar hinzufügen

mit rar hats geklappt, habs hochgeladen.

man dankt :-)

Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich
ziehen und eine Bereinigung der Infektion noch erschweren.

Bitte downloade dir Combofix.exe und speichere es unbedingt auf deinem Desktop.

Besuche folgende Seite für Downloadlinks und Anweisungen für dieses
Tool

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
Hinweis:
Gehe sicher das all deine Anti Virus und Anti Malware Programme abgeschalten sind, damit diese Combofix nicht bei der Arbeit stören.
Poste bitte die C:\Combofix.txt in deiner nächsten Antwort.

ich danke dir :-)

aber ohoh, combofix ist fertig (hat zwischendrin einen neustart gemacht, von dem nix im tutorial steht), aber ich kann nix mehr öffnen.

meldung:
es wurde versucht, einen registrierungsschlüssel einem unzulässigen vorgang zu unterziehen, der zum löschen markiert wurde.

so, mit einfach rüberziehen ging es

Combofix Logfile:

Code:

ComboFix 11-12-01.01 - Angela 01.12.2011  18:30:12.1.4 - x64

Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.4007.2750 [GMT 1:00]

ausgeführt von:: c:\users\Angela\Desktop\ComboFix.exe

AV: AntiVir Desktop *Disabled/Outdated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}

SP: AntiVir Desktop *Disabled/Outdated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\programdata\Amazon.ico

c:\programdata\MercadoLivre.ico

c:\programdata\Roaming

c:\users\Angela\AppData\Roaming\.#

c:\users\Angela\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\System Fix.lnk

c:\windows\system32\ICON.ico

c:\windows\SysWow64\Packet.dll

c:\windows\SysWow64\pthreadVC.dll

c:\windows\SysWow64\wpcap.dll

.

.

(((((((((((((((((((((((((((((((((((((((   Treiber/Dienste   )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

-------\Legacy_NPF

-------\Service_npf

.

.

(((((((((((((((((((((((   Dateien erstellt von 2011-11-01 bis 2011-12-01  ))))))))))))))))))))))))))))))

.

.

2011-12-01 17:34 . 2011-12-01 17:34        --------        d-----w-        c:\users\Default\AppData\Local\temp

2011-12-01 16:24 . 2011-12-01 16:24        --------        d-----w-        c:\program files (x86)\7-Zip

2011-12-01 16:03 . 2011-12-01 17:02        --------        d-----w-        C:\_OTL

2011-12-01 14:37 . 2011-12-01 14:37        --------        d-----w-        c:\users\Angela\AppData\Roaming\QuickScan

2011-11-12 08:27 . 2011-11-12 08:27        --------        d-----w-        c:\windows\system32\Macromed

2011-11-09 06:36 . 2011-09-29 16:29        1923952        ----a-w-        c:\windows\system32\drivers\tcpip.sys

2011-11-09 06:35 . 2011-10-01 05:45        886784        ----a-w-        c:\program files\Common Files\System\wab32.dll

2011-11-09 06:35 . 2011-10-01 04:37        708608        ----a-w-        c:\program files (x86)\Common Files\System\wab32.dll

2011-11-09 06:35 . 2011-09-29 04:03        3144704        ----a-w-        c:\windows\system32\win32k.sys

2011-11-02 12:52 . 2011-11-05 20:02        --------        d-----w-        c:\users\Public\auszüge

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-11-12 08:27 . 2011-05-14 18:10        414368        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2011-09-16 14:12 . 2011-10-30 09:33        3623592        ----a-w-        c:\program files (x86)\Common Files\ApnToolbarInstaller.exe

2011-09-16 14:12 . 2011-10-30 09:33        143240        ----a-w-        c:\program files (x86)\Common Files\ApnStub.exe

2010-01-26 10:11 . 2011-10-30 09:33        444283        ----a-w-        c:\program files (x86)\Common Files\WinPcapNmap.exe

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{BF42D4A8-016E-4fcd-B1EB-837659FD77C6}]

2011-08-12 10:13        1578496        ----a-w-        c:\program files (x86)\GMX Toolbar\IE\uitb.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]

"{C424171E-592A-415a-9EB1-DFD6D95D3530}"= "c:\program files (x86)\GMX Toolbar\IE\uitb.dll" [2011-08-12 1578496]

.

[HKEY_CLASSES_ROOT\clsid\{c424171e-592a-415a-9eb1-dfd6d95d3530}]

[HKEY_CLASSES_ROOT\uitb.Toolbar.1]

[HKEY_CLASSES_ROOT\TypeLib\{99F77431-0658-476F-99CE-A05F35CDC7BA}]

[HKEY_CLASSES_ROOT\uitb.Toolbar]

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-21 1475584]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2011-04-21 281768]

.

c:\users\Angela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

A Note.lnk - c:\program files (x86)\A Note\A Note.exe [2011-9-2 826368]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

Security Packages        REG_MULTI_SZ           kerberos msv1_0 schannel wdigest tspkg pku2u livessp

.

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R2 hcw10cir;Hauppauge CIR Receiver;c:\windows\system32\drivers\hcw10cir.sys [x]

R3 AMPPALP;Intel(R) Centrino(R) Bluetooth 3.0 + High Speed Protocol;c:\windows\system32\DRIVERS\amppal.sys [x]

R3 AmUStor;AM USB Stroage Driver;c:\windows\system32\drivers\AmUStor.SYS [x]

R3 Bluetooth Media Service;Bluetooth Media Service;c:\program files (x86)\Intel\Bluetooth\mediasrv.exe [2011-02-11 1304912]

R3 hcw10bda;Hauppauge Cx2310x WinTV Capture;c:\windows\system32\drivers\hcw10bda.sys [x]

R3 intaud_WaveExtensible;Intel WiDi Audio Device;c:\windows\system32\drivers\intelaud.sys [x]

R3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe [2011-05-02 340240]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]

R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [x]

R3 wsvd;wsvd;c:\windows\system32\DRIVERS\wsvd.sys [x]

R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-23 57184]

S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]

S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-09-05 64952]

S2 AMPPALR3;Intel® Centrino® Bluetooth 3.0 + High Speed Service;c:\program files\Intel\BluetoothHS\BTHSAmpPalService.exe [2011-04-21 1136640]

S2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2011-04-21 136360]

S2 Bluetooth Device Monitor;Bluetooth Device Monitor;c:\program files (x86)\Intel\Bluetooth\devmonsrv.exe [2011-02-11 907600]

S2 Bluetooth OBEX Service;Bluetooth OBEX Service;c:\program files (x86)\Intel\Bluetooth\obexsrv.exe [2011-02-11 997712]

S2 BTHSSecurityMgr;Intel(R) Centrino(R) Wireless Bluetooth(R) 3.0 + High Speed Security Service;c:\program files\Intel\BluetoothHS\BTHSSecurityMgr.exe [2011-04-21 134928]

S2 CxAudMsg;Conexant Audio Message Service;c:\windows\system32\CxAudMsg64.exe [x]

S2 GFNEXSrv;GFNEX Service;c:\program files (x86)\PHotkey\GFNEXSrv.exe [2010-10-07 159752]

S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2011-04-30 13592]

S2 PEGAGFN;PEGAGFN;c:\program files (x86)\PHotkey\PEGAGFN.sys [2009-09-11 14344]

S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2011-02-22 2656280]

S3 AMPPAL;Intel(R) Centrino(R) Bluetooth 3.0 + High Speed Virtual Adapter;c:\windows\system32\DRIVERS\AMPPAL.sys [x]

S3 btmaux;Intel Bluetooth Auxiliary Service;c:\windows\system32\DRIVERS\btmaux.sys [x]

S3 btmhsf;btmhsf;c:\windows\system32\DRIVERS\btmhsf.sys [x]

S3 clwvd;CyberLink WebCam Virtual Driver;c:\windows\system32\DRIVERS\clwvd.sys [x]

S3 iBtFltCoex;iBtFltCoex;c:\windows\system32\DRIVERS\iBtFltCoex.sys [x]

S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [x]

S3 iwdbus;IWD Bus Enumerator;c:\windows\system32\drivers\iwdbus.sys [x]

S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys [x]

S3 MEIx64;Intel(R) Management Engine Interface;c:\windows\system32\drivers\HECIx64.sys [x]

S3 NETwNs64;___ Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;c:\windows\system32\DRIVERS\NETwNs64.sys [x]

S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\drivers\nusb3hub.sys [x]

S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\drivers\nusb3xhc.sys [x]

S3 Point64;Microsoft IntelliPoint Filter Driver;c:\windows\system32\DRIVERS\point64.sys [x]

S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]

.

.

.

--------- x86-64 -----------

.

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BF42D4A8-016E-4fcd-B1EB-837659FD77C6}]

2011-08-12 10:11        1971712        ----a-w-        c:\program files\GMX Toolbar\IE\uitb.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{C424171E-592A-415a-9EB1-DFD6D95D3530}"= "c:\program files\GMX Toolbar\IE\uitb.dll" [2011-08-12 1971712]

.

[HKEY_CLASSES_ROOT\CLSID\{C424171E-592A-415a-9EB1-DFD6D95D3530}]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IntelPAN"="c:\program files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" [2011-05-02 1935120]

"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2011-08-01 2417032]

"combofix"="c:\combofix\CF3279.3XE" [2010-11-21 345088]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

"LoadAppInit_DLLs"=0x0

.

------- Zusätzlicher Suchlauf -------

.

uLocal Page = c:\windows\system32\blank.htm

uStart Page = https://www.bwin.com/de/sportsbook.aspx

mLocal Page = c:\windows\SysWOW64\blank.htm

TCP: DhcpNameServer = 192.168.0.1

Handler: gmx - {8FAF0273-9CA8-4efc-9536-1E35E254D5CD} - c:\program files (x86)\GMX Toolbar\IE\uitb.dll

FF - ProfilePath - c:\users\Angela\AppData\Roaming\Mozilla\Firefox\Profiles\xhtjj79a.default\

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - hxxp://my.ebay.de/ws/eBayISAPI.dll?MyEbayBeta&CurrentPage=MyeBayNextSelling&ssPageName=STRK:ME:LNLK:MESEX

FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe

AddRemove-_{5A10CFDA-FA2B-453C-B561-AE864E62EAC8} - c:\users\Public\Documents\Corel\CorelDRAW Essentials X5\Setup\SetupARP.exe

.

.

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ChromeHTML"

.

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ChromeHTML"

.

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ChromeHTML"

.

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ChromeHTML"

.

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ChromeHTML"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10q_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10q_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10q.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.10"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10q.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10q.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10q.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

------------------------ Weitere laufende Prozesse ------------------------

.

c:\program files (x86)\PHotkey\ASLDRSrv.exe

c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe

c:\progra~2\WinTV\TVServer\HAUPPA~1.EXE

c:\program files (x86)\Common Files\Protexis\License Service\PsiService_2.exe

c:\program files (x86)\CyberLink\Shared files\RichVideo.exe

c:\program files (x86)\PHotkey\PHotkey.exe

c:\program files (x86)\PHotkey\MsgTranAgt.exe

c:\program files (x86)\PHotkey\POSD.exe

c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

.

**************************************************************************

.

Zeit der Fertigstellung: 2011-12-01  18:40:10 - PC wurde neu gestartet

ComboFix-quarantined-files.txt  2011-12-01 17:40

.

Vor Suchlauf: 8 Verzeichnis(se), 664.181.358.592 Bytes frei

Nach Suchlauf: 11 Verzeichnis(se), 663.368.998.912 Bytes frei

.

- - End Of File - - 9230D3306CCEFE16FC2CF826FC01BA33

--- --- ---

hi, mach mal nen neustart dann gehts wieder

malwarebytes:
Downloade Dir bitte Malwarebytes

Installiere
das Programm in den vorgegebenen Pfad.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Starte Malwarebytes, klicke auf Aktualisierung --> Suche
nach Aktualisierung
Wenn das Update beendet wurde, aktiviere vollständiger Scan durchführen und drücke auf Scannen.
Wenn der Scan beendet
ist, klicke auf Ergebnisse anzeigen.
Versichere Dich, dass alle Funde markiert sind und drücke Entferne Auswahl.
Poste
das Logfile, welches sich in Notepad öffnet, hier in den Thread.
Nachträglich kannst du den Bericht unter "Log Dateien" finden.

das war aber ein langer scan, hat aberwohl nix gefunden

Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Datenbank Version: 8286

Windows 6.1.7601 Service Pack 1
Internet Explorer 9.0.8112.16421

01.12.2011 20:10:35
mbam-log-2011-12-01 (20-10-35).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|F:\|)
Durchsuchte Objekte: 461701
Laufzeit: 1 Stunde(n), 4 Minute(n), 54 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

eine stunde, ist bei den meisten so.
lade den CCleaner standard:
CCleaner Download - CCleaner 3.13.1600
falls der CCleaner
bereits instaliert, überspringen.
instalieren, öffnen, extras, liste der instalierten programme, als txt speichern. öffnen.
hinter, jedes von dir benötigte programm, schreibe notwendig.
hinter, jedes, von dir nicht benötigte, unnötig.
hinter, dir unbekannte, unbekannt.
liste posten.

nich so einfach, bei einigen hab ich mehr geraten, z.b. bei den windows und microsoft programmen.

7-Zip 9.20 30.11.2011 unnötig
A Note 4.2.3 A Note, sourceforge 01.09.2011 2,00MB notwendig
Adobe AIR Adobe Systems Incorporated 01.09.2011 2.7.1.19610 notwendig
Adobe Flash Player 10 ActiveX Adobe Systems Incorporated 01.09.2011 6,00MB 10.3.181.14 notwendig
Adobe Flash Player 11 Plugin 64-bit Adobe Systems Incorporated 11.11.2011 6,00MB 11.1.102.55 notwendig
Adobe Reader X (10.1.1) MUI Adobe Systems Incorporated 15.09.2011 478MB 10.1.1 notwendig
Adobe Shockwave Player 11.6 Adobe Systems, Inc. 10.11.2011 11.6.3.633 notwendig
Alcor Micro USB Card Reader Alcor Micro Corp. 25.05.2011 2,88MB 1.8.1217.36096 notwendig
AMI VR-pulse OS Switcher American Megatrends Inc. 25.05.2011 0,36MB 1.1 unbekannt
Ashampoo Burning Studio Ashampoo GmbH & Co. KG 07.06.2011 135,1MB 10.0.10 unnötig
Ashampoo Photo Commander Ashampoo GmbH & Co. KG 07.06.2011 154,9MB 9.2.0 unnötig
Ashampoo Photo Optimizer Ashampoo GmbH & Co. KG 07.06.2011 57,6MB 4.0.0 unnötig
Ashampoo Snap Ashampoo GmbH & Co. KG 07.06.2011 24,8MB 4.3.0 unnötig
Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver Atheros Communications Inc. 25.05.2011 1.0.0.35 notwendig
Avira AntiVir Personal - Free Antivirus Avira GmbH 12.10.2011 90,4MB 10.2.0.704 notwendig
CCleaner Piriform 30.11.2011 3.13 notwendig
Conexant HD Audio Conexant 26.05.2011 8.54.4.51 unbekannt
Control ActiveX de Windows Live Mesh para conexiones remotas Microsoft Corporation 13.05.2011 5,57MB 15.4.5722.2 unbekannt
Controlo ActiveX do Windows Live Mesh para Ligações Remotas Microsoft Corporation 13.05.2011 5,58MB 15.4.5722.2 unbekannt
Contrôle ActiveX Windows Live Mesh pour connexions à distance Microsoft Corporation 13.05.2011 5,57MB 15.4.5722.2 unbekannt
Corel Graphics - Windows Shell Extension Corel Corporation 31.08.2011 2,93MB 15.1.0.588 unnötig
CorelDRAW Essentials X5 Corel Corporation 31.08.2011 3.655MB 15.1.0.588 unnötig
CorelDRAW Essentials X5 - Extra Content Corel Corporation 31.08.2011 unnötig
CyberLink LabelPrint CyberLink Corp. 25.05.2011 57,4MB 2.5.3624 notwendig
CyberLink MediaEspresso CyberLink Corp. 25.05.2011 159,0MB 6.5.1508_36229 notwendig
CyberLink MediaShow CyberLink Corp. 25.05.2011 390MB 5.1.2414 notwendig
CyberLink PhotoNow CyberLink Corp. 25.05.2011 21,8MB 1.1.0.6904 notwendig
CyberLink Power2Go CyberLink Corp. 25.05.2011 233MB 7.0.0.1327 notwendig
CyberLink PowerDirector CyberLink Corp. 25.05.2011 358MB 8.0.4020 notwendig
CyberLink PowerDVD 10 CyberLink Corp. 25.05.2011 186,6MB 10.0.2731.02 notwendig
CyberLink PowerDVD Copy CyberLink Corp. 25.05.2011 31,0MB 1.5.1306 notwendig
CyberLink PowerProducer CyberLink Corp. 25.05.2011 183,9MB 5.0.2.3503 notwendig
CyberLink PowerRecover CyberLink Corp. 25.05.2011 246MB 5.5.3726 notwendig
CyberLink YouCam CyberLink Corp. 25.05.2011 135,8MB 3.1.4013 notwendig
DHTML Editing Component Microsoft Corporation 02.09.2011 0,54MB 6.02.0001 unbekannt
Dolby Home Theater v4 Dolby Laboratories Inc 26.05.2011 28,1MB 7.2.7000.4 notwendig
GMX Softwareaktualisierung 1&1 Mail & Media GmbH 02.08.2011 2.0.1.9 unnötig
GMX Toolbar für Internet Explorer 1&1 Mail & Media GmbH 01.09.2011 1.6.6.1 unnötig
Hauppauge WinTV 7 Hauppauge Computer Works 26.09.2011 v7.0.28307 unnötig
Intel(R) Management Engine Components Intel Corporation 14.05.2011 7.0.0.1144 notwendig
Intel(R) Processor Graphics Intel Corporation 08.06.2011 8.15.10.2372 notwendig
Intel(R) PROSet/Wireless for Bluetooth(R) 3.0 + High Speed Intel Corporation 25.05.2011 5,82MB 1.1.0.0157 notwendig
Intel(R) PROSet/Wireless Software for Bluetooth(R) Technology Intel Corporation 25.05.2011 88,7MB 1.0.2.0518 notwendig
Intel(R) PROSet/Wireless WiFi Software Intel Corporation 25.05.2011 130,6MB 14.01.1000 notwendig
Intel(R) Rapid Storage Technology Intel Corporation 14.05.2011 10.5.0.1026 notwendig
Intel(R) WiDi Intel Corporation 25.05.2011 139,9MB 2.1.39.0 notwendig
IrfanView (remove only) Irfan Skiljan 01.09.2011 1,50MB 4.30 notwendig
Java(TM) 6 Update 22 Oracle 01.09.2011 97,1MB 6.0.220 notwendig
Java(TM) 6 Update 25 (64-bit) Oracle 13.05.2011 91,4MB 6.0.250 unnötig
Java(TM) 6 Update 27 Oracle 13.05.2011 96,9MB 6.0.270 unnötig
K-Lite Codec Pack 7.6.0 (Full) 01.09.2011 47,8MB 7.6.0 notwendig
king.com (remove only) Midasplayer Ltd (king.com) 01.09.2011 notwendig
Malwarebytes' Anti-Malware Version 1.51.2.1300 Malwarebytes Corporation 30.11.2011 13,8MB 1.51.2.1300 notwendig
Medion Home Cinema CyberLink Corp. 25.05.2011 36,7MB 8.0.2608 notwendig
Microsoft .NET Framework 4 Client Profile Microsoft Corporation 30.04.2011 38,8MB 4.0.30319 notwendig
Microsoft IntelliPoint 8.2 Microsoft Corporation 06.09.2011 8.20.468.0 notwendig
Microsoft Mathematics (64-Bit) Microsoft Corporation 31.08.2011 20,2MB 4.0 notwendig
Microsoft Silverlight Microsoft Corporation 01.05.2011 60,3MB 4.0.60310.0 notwendig
Microsoft SQL Server 2005 Compact Edition [ENU] Microsoft Corporation 13.05.2011 1,70MB 3.1.0000 notwendig
Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 Microsoft Corporation 30.04.2011 0,25MB 8.0.50727.4053 notwendig
Microsoft Visual C++ 2005 Redistributable Microsoft Corporation 25.05.2011 2,70MB 8.0.59193 notwendig
Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175 Microsoft Corporation 25.05.2011 0,57MB 8.0.51011 notwendig
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570 Microsoft Corporation 25.05.2011 0,77MB 9.0.30729.5570 notwendig
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 Microsoft Corporation 25.05.2011 0,77MB 9.0.30729 notwendig
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 Microsoft Corporation 01.09.2011 0,23MB 9.0.30729.4148 notwendig
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Corporation 25.05.2011 0,58MB 9.0.30729 notwendig
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Microsoft Corporation 01.09.2011 0,58MB 9.0.30729.4148 notwendig
Mozilla Firefox 8.0 (x86 de) Mozilla 08.11.2011 35,7MB 8.0 notwendig
MSXML 4.0 SP2 (KB973688) Microsoft Corporation 30.04.2011 1,34MB 4.20.9876.0 unbekannt
OpenOffice.org 3.3 OpenOffice.org 01.09.2011 415MB 3.3.9567 notwendig
PHotkey Pegatron Corporation 25.05.2011 1.00.0032 unbekannt
PlayReady PC Runtime amd64 Microsoft Corporation 31.08.2011 2,06MB 1.3.0 unbekannt
Renesas Electronics USB 3.0 Host Controller Driver Renesas Electronics Corporation 25.05.2011 1,22MB 2.1.16.0 notwendig
Spelling Dictionaries Support For Adobe Reader X Adobe Systems Incorporated 13.05.2011 85,7MB 10.0.0 unnötig
Synaptics Pointing Device Driver Synaptics Incorporated 13.05.2011 15.0.4.0 notwendig
T-Online 6.0 02.09.2011 notwendig
VDownloader 3.6.943 Vitzo Limited 29.10.2011 41,3MB notwendig
VR-pulse Installer American Megatrends Inc. 08.06.2011 0,85MB 1.5.2.0 notwendig
Windows Live Essentials Microsoft Corporation 14.05.2011 15.4.3508.1109 unbekannt
Windows Live Mesh - ActiveX-besturingselement voor externe verbindingen Microsoft Corporation 13.05.2011 5,57MB 15.4.5722.2 unbekannt
Windows Live Mesh ActiveX control for remote connections Microsoft Corporation 13.05.2011 5,58MB 15.4.5722.2 unbekannt
Windows Live Mesh ActiveX Control for Remote Connections Microsoft Corporation 13.05.2011 5,38MB 15.4.5722.2 unbekannt
Windows Live Mesh ActiveX-objekt til fjernforbindelser Microsoft Corporation 13.05.2011 5,57MB 15.4.5722.2 unbekannt
Windows Live Mesh ActiveX-vezérlő távoli kapcsolatokhoz Microsoft Corporation 13.05.2011 5,58MB 15.4.5722.2 unbekannt
Windows Media Encoder 9 Series 25.05.2011 notwendig
WinPcap 4.1.1 CACE Technologies 29.10.2011 4.1.0.1753 unbekannt
WinRAR 4.01 (64-Bit) win.rar GmbH 30.11.2011 4.01.0 notwendig

Adobe Flash Player beide

neueste hier:
Adobe - Andere Version des Adobe Flash Player installieren
bitte auch mal den adobe reader wie folgt konfigurieren:
adobe reader öffnen, bearbeiten, voreinstellungen.
allgemein:
nur zertifizierte zusatz module verwenden, anhaken.
internet:
hier sollte alles deaktiviert werden, es ist sehr unsicher pdfs automatisch zu öffnen, zu downloaden etc.
es ist immer besser diese direkt abzuspeichern da man nur so die kontrolle hat was auf dem pc vor geht.
bei javascript den haken bei java script verwenden raus nehmen
bei updater, automatisch instalieren wählen.
übernehmen /ok

deinstaliere:
AMI
Ashampoo alle
Control ActiveX de
Controlo ActiveX do
Contrôle ActiveX
CorelDRAW alle
GMX beide
Hauppauge
Java alle
Java
Download der kostenlosen Java-Software
downloade java jre
deinstaliere:
PHotkey
Spelling Dictionaries Support
Windows Live Essentials falls du dienste wie windowslive mail nicht nutzt alle weg, bzw auswählen was du behalten willst
WinPcap
bereinige mit dem ccleaner

1x corel will er nicht deinstallieren -system kann die angegebene datei nicht finden

und meinst du mit bereinigen, dass ich nach dem deinstallieren den Cleaner starten soll? wenn ja, mit den gesetzten häkchen und windows und/oder anwendungen?

mit den gesetzten häkchen, und windows.
ok dann entferne den einen eintrag aus ccleaner. müsste dafür nen buton geben

ok, wenn du willst können wir den pc morgen noch absichern

du bist ein schatz und hast einer alten frau wirklich wirklich geholfen. danke schonmal und natürlich wird deiner signatur folge getragen - versprochen!

was war das denn jetzt überhaupt für ein mist?

hi,
das war sogenannte rogue software oder skare ware.
diese will, wie das wort skare schon sagt, dem betroffenen angst einjagen damit er die angeblichen fehler beheben lässt, das kostet natürlich, wie überraschend, geld :-)

Hi, einen von den typen, die sowas verbreiten, würde ich ja schon gerne mal kennenlernen :twak:

Ist das mit der absicherung dringend, bzw. nötig, um das richtig abzuschliessen oder eher prophyllaktisch? weil, meine tochter hat heute mehrere panik-sms geschickt, weil sie sich dieses bundespolizeidingens eingefangen hat und ich mich erstmal darum kümmern soll. wie es immer so ist, muss sie montag eine wichtige arbeit abgeben und hat von sichern natürlich noch nie was gehört :rolleyes:

na das können wir auch später machen.
du kannst ja für sie nen extra thema eröffnen dann schaue ich mir das an.
ja, sichern ist das einfachste, aber leider machts kaum einer

Hi, neues Thema kommt erstmal nicht. Tochter (Geduld ist nicht ihr Freund) begnügt sich vorerst mit der Mogelpackung in Form von Wiederherstellung, wenn das mal gut geht........

jo finde ich auch keine idiale lösung,man weis nie ob nicht noch mehr malware instaliert wurde

Nochmal herzlichen Dank für deine Hilfe.

Hi, oha, ich hab eben nochmal einen Vollscan mit Malwarebytes gemacht und es wurden 2 infizierte Dateien gefunden.

hier der mbam-log

Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Datenbank Version: 8307

Windows 6.1.7601 Service Pack 1
Internet Explorer 9.0.8112.16421

04.12.2011 15:51:39
mbam-log-2011-12-04 (15-51-25).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|F:\|)
Durchsuchte Objekte: 458152
Laufzeit: 1 Stunde(n), 4 Minute(n), 41 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 2

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
c:\_OTL\movedfiles\12012011_170328\c_programdata\jtsddw9nsshwjx.exe (Trojan.FakeAlert.Gen) -> No action taken.
c:\_OTL\movedfiles\12012011_170328\c_programdata\nfwokoyrvdaorqh.exe (Trojan.FakeAlert.Gen) -> No action taken.

und hier der otl-log nach entfernen der 2 DateienOTL Logfile:

Code:

OTL logfile created on: 04.12.2011 16:07:52 - Run 3

OTL by OldTimer - Version 3.2.31.0     Folder = C:\Users\Angela\Desktop

64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

3,91 Gb Total Physical Memory | 2,78 Gb Available Physical Memory | 71,00% Memory free

7,82 Gb Paging File | 6,63 Gb Available in Paging File | 84,70% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 657,54 Gb Total Space | 620,18 Gb Free Space | 94,32% Space Free | Partition Type: NTFS

Drive D: | 37,99 Gb Total Space | 13,84 Gb Free Space | 36,43% Space Free | Partition Type: NTFS

Drive E: | 116,44 Gb Total Space | 41,45 Gb Free Space | 35,60% Space Free | Partition Type: NTFS

Drive F: | 104,73 Gb Total Space | 66,17 Gb Free Space | 63,19% Space Free | Partition Type: NTFS

 

Computer Name: LÄPPI | User Name: Angela | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2011.12.01 15:56:40 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Angela\Desktop\OTL.exe

PRC - [2011.09.05 09:04:54 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

PRC - [2011.08.31 17:00:48 | 000,449,608 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

PRC - [2011.07.21 11:08:02 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

PRC - [2011.04.21 06:52:51 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

PRC - [2011.04.21 06:52:36 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

PRC - [2011.02.11 20:40:00 | 000,997,712 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe

PRC - [2011.02.11 20:39:54 | 000,907,600 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe

PRC - [2010.10.22 13:03:56 | 000,826,368 | ---- | M] (A Note) -- C:\Program Files (x86)\A Note\A Note.exe

 

 
 ========== Modules (No Company Name) ==========

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV:64bit: - [2011.05.02 22:27:50 | 001,517,328 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Program Files\Intel\WiFi\bin\EvtEng.exe -- (EvtEng)

SRV:64bit: - [2011.05.02 22:13:54 | 000,340,240 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe -- (MyWiFiDHCPDNS)

SRV:64bit: - [2011.05.02 22:10:26 | 000,844,560 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe -- (RegSrvc)

SRV:64bit: - [2011.04.21 17:34:16 | 001,136,640 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe -- (AMPPALR3)

SRV:64bit: - [2011.04.21 16:42:50 | 000,134,928 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe -- (BTHSSecurityMgr)

SRV:64bit: - [2010.12.17 15:46:34 | 000,198,784 | ---- | M] (Conexant Systems Inc.) [Auto | Running] -- C:\Windows\SysNative\CxAudMsg64.exe -- (CxAudMsg)

SRV:64bit: - [2009.07.14 02:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend)

SRV - [2011.09.05 09:04:54 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)

SRV - [2011.08.31 17:00:48 | 000,366,152 | ---- | M] (Malwarebytes Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)

SRV - [2011.07.21 11:08:02 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)

SRV - [2011.04.30 08:32:54 | 000,013,592 | ---- | M] (Intel Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc) Intel(R)

SRV - [2011.04.21 06:52:51 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)

SRV - [2011.02.22 21:20:21 | 002,656,280 | ---- | M] (Intel Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS) Intel(R)

SRV - [2011.02.22 21:20:17 | 000,326,168 | ---- | M] (Intel Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS) Intel(R)

SRV - [2011.02.11 20:40:00 | 000,997,712 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe -- (Bluetooth OBEX Service)

SRV - [2011.02.11 20:39:58 | 001,304,912 | ---- | M] (Intel Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe -- (Bluetooth Media Service)

SRV - [2011.02.11 20:39:54 | 000,907,600 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe -- (Bluetooth Device Monitor)

SRV - [2010.03.18 21:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)

SRV - [2009.06.10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV:64bit: - [2011.08.31 17:00:50 | 000,025,416 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)

DRV:64bit: - [2011.08.01 14:59:06 | 000,045,416 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\point64.sys -- (Point64)

DRV:64bit: - [2011.07.21 11:11:10 | 000,123,784 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)

DRV:64bit: - [2011.07.21 11:11:09 | 000,088,288 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)

DRV:64bit: - [2011.05.17 17:27:52 | 000,025,496 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\iwdbus.sys -- (iwdbus)

DRV:64bit: - [2011.05.17 17:27:50 | 000,034,200 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\intelaud.sys -- (intaud_WaveExtensible)

DRV:64bit: - [2011.05.01 22:33:06 | 008,593,920 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NETwNs64.sys -- (NETwNs64) ___ Intel(R)

DRV:64bit: - [2011.04.26 19:07:36 | 000,557,848 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)

DRV:64bit: - [2011.04.21 17:09:26 | 000,294,912 | ---- | M] (Windows (R) Win 7 DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\AmpPal.sys -- (AMPPALP) Intel(R) Centrino(R)

DRV:64bit: - [2011.04.21 17:09:26 | 000,294,912 | ---- | M] (Windows (R) Win 7 DDK provider) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AmpPal.sys -- (AMPPAL) Intel(R) Centrino(R)

DRV:64bit: - [2011.04.15 10:08:26 | 012,228,128 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)

DRV:64bit: - [2011.04.15 00:16:08 | 000,031,088 | ---- | M] (CyberLink Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\clwvd.sys -- (clwvd)

DRV:64bit: - [2011.04.13 17:30:54 | 000,207,872 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nusb3xhc.sys -- (nusb3xhc)

DRV:64bit: - [2011.04.13 17:30:50 | 000,087,552 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nusb3hub.sys -- (nusb3hub)

DRV:64bit: - [2011.03.11 07:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)

DRV:64bit: - [2011.03.11 07:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)

DRV:64bit: - [2011.03.10 16:01:40 | 001,581,184 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CHDRT64.sys -- (CnxtHdAudService)

DRV:64bit: - [2011.01.24 10:24:52 | 000,058,128 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btmaux.sys -- (btmaux)

DRV:64bit: - [2011.01.24 10:22:48 | 000,059,904 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\iBtFltCoex.sys -- (iBtFltCoex)

DRV:64bit: - [2011.01.24 09:56:06 | 000,274,944 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btmhsf.sys -- (btmhsf)

DRV:64bit: - [2010.11.21 04:24:33 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)

DRV:64bit: - [2010.11.21 04:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)

DRV:64bit: - [2010.11.21 04:23:47 | 000,031,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD)

DRV:64bit: - [2010.10.20 01:34:26 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (MEIx64) Intel(R)

DRV:64bit: - [2010.10.15 00:28:16 | 000,317,440 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\IntcDAud.sys -- (IntcDAud) Intel(R)

DRV:64bit: - [2010.09.27 10:32:28 | 000,632,704 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw10bda.sys -- (hcw10bda)

DRV:64bit: - [2010.09.23 21:03:06 | 000,129,008 | ---- | M] (CyberLink) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\wsvd.sys -- (wsvd)

DRV:64bit: - [2010.08.24 17:55:44 | 000,076,912 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\L1C62x64.sys -- (L1C)

DRV:64bit: - [2010.05.10 08:29:16 | 000,046,080 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | Auto | Stopped] -- C:\Windows\SysNative\drivers\hcw10cir.sys -- (hcw10cir)

DRV:64bit: - [2010.01.22 10:26:50 | 000,305,200 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP)

DRV:64bit: - [2009.10.23 16:26:14 | 000,046,592 | ---- | M] (Alcor Micro, Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\AmUStor.sys -- (AmUStor)

DRV:64bit: - [2009.07.14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)

DRV:64bit: - [2009.07.14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)

DRV:64bit: - [2009.07.14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)

DRV:64bit: - [2009.06.10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)

DRV:64bit: - [2009.06.10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)

DRV:64bit: - [2009.06.10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)

DRV:64bit: - [2009.06.10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)

DRV - [2011.09.03 10:43:36 | 000,001,722 | ---- | M] () [Kernel | System | Running] -- C:\Windows\SysWow64\NULL -- (Null)

DRV - [2009.07.14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = https://www.bwin.com/de/sportsbook.aspx

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 
 ========== FireFox ==========

 

FF - prefs.js..browser.search.defaultengine: ""

FF - prefs.js..browser.search.defaultenginename: ""

FF - prefs.js..browser.search.order.1: ""

FF - prefs.js..browser.search.selectedEngine: "Google"

FF - prefs.js..browser.search.useDBForOrder: true

FF - prefs.js..browser.startup.homepage: "hxxp://my.ebay.de/ws/eBayISAPI.dll?MyEbayBeta&&CurrentPage=MyeBayNextSelling&ssPageName=STRK%3AME%3ALNLK%3AMESEX&guest=1"

FF - prefs.js..keyword.URL: "hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q="

 

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_1_102.dll File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()

FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.0.60310.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll File not found

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\virtualKeyboard@kaspersky.ru: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\FFExt\virtualKeyboard@kaspersky.ru

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\KavAntiBanner@Kaspersky.ru: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\FFExt\KavAntiBanner@kaspersky.ru

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\linkfilter@kaspersky.ru: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\FFExt\linkfilter@kaspersky.ru

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011.11.09 17:11:31 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011.12.02 07:16:57 | 000,000,000 | ---D | M]

 

[2011.09.02 05:46:24 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Angela\AppData\Roaming\mozilla\Extensions

[2011.12.01 17:48:04 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Angela\AppData\Roaming\mozilla\Firefox\Profiles\xhtjj79a.default\extensions

[2011.11.03 11:27:59 | 000,000,933 | ---- | M] () -- C:\Users\Angela\AppData\Roaming\Mozilla\Firefox\Profiles\xhtjj79a.default\searchplugins\11-suche.xml

[2011.11.03 11:27:59 | 000,002,419 | ---- | M] () -- C:\Users\Angela\AppData\Roaming\Mozilla\Firefox\Profiles\xhtjj79a.default\searchplugins\englische-ergebnisse.xml

[2011.09.02 18:07:03 | 000,010,525 | ---- | M] () -- C:\Users\Angela\AppData\Roaming\Mozilla\Firefox\Profiles\xhtjj79a.default\searchplugins\gmx-suche.xml

[2011.11.03 11:27:59 | 000,002,457 | ---- | M] () -- C:\Users\Angela\AppData\Roaming\Mozilla\Firefox\Profiles\xhtjj79a.default\searchplugins\lastminute.xml

[2011.11.03 11:27:59 | 000,005,508 | ---- | M] () -- C:\Users\Angela\AppData\Roaming\Mozilla\Firefox\Profiles\xhtjj79a.default\searchplugins\webde-suche.xml

[2011.12.01 21:49:30 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions

[2011.12.01 21:49:30 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA}

() (No name found) -- C:\USERS\ANGELA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\XHTJJ79A.DEFAULT\EXTENSIONS\TOOLBAR@GMX.NET.XPI

[2011.11.09 17:11:30 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll

[2011.12.01 21:49:15 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll

[2010.03.08 11:24:04 | 000,103,168 | ---- | M] (Midasplayer Ltd) -- C:\Program Files (x86)\mozilla firefox\plugins\npmidas.dll

[2011.09.10 08:20:16 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml

[2011.09.10 08:20:16 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml

[2011.09.10 08:20:16 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml

[2011.09.10 08:20:16 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml

[2011.09.10 08:20:16 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml

[2011.09.10 08:20:16 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml

 

O1 HOSTS File: ([2011.12.01 18:36:01 | 000,000,027 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts

O1 - Hosts: 127.0.0.1       localhost

O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {C424171E-592A-415A-9EB1-DFD6D95D3530} - No CLSID value found.

O4:64bit: - HKLM..\Run: [IntelliPoint] c:\Program Files\Microsoft IntelliPoint\ipoint.exe (Microsoft Corporation)

O4:64bit: - HKLM..\Run: [IntelPAN] C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe (Intel(R) Corporation)

O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)

O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)

O4 - Startup: C:\Users\Angela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\A Note.lnk = C:\Program Files (x86)\A Note\A Note.exe (A Note)

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)

O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)

O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{8068FE7C-7296-400B-9019-82B7F3A7BDB2}: DhcpNameServer = 192.168.0.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F1AEB345-498B-4D3D-A2B8-DB5469020C02}: DhcpNameServer = 192.168.0.1

O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found

O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - E:\autoexec.bat -- [ NTFS ]

O34 - HKLM BootExecute: (autocheck autochk *)

O35:64bit: - HKLM\..comfile [open] -- "%1" %*

O35:64bit: - HKLM\..exefile [open] -- "%1" %*

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %*

O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*

O37 - HKLM\...com [@ = ComFile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2011.12.04 14:09:49 | 000,000,000 | ---D | C] -- C:\Users\Angela\Desktop\16179-Dateien

[2011.12.03 12:20:44 | 000,000,000 | ---D | C] -- C:\Users\Angela\Desktop\22612429-Grosses-rechteckiges-Vogelhaus-Typ-9-Dateien

[2011.12.02 19:12:33 | 000,000,000 | ---D | C] -- C:\Users\Angela\Desktop\käthe

[2011.12.01 21:50:28 | 000,190,752 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\SysNative\javaws.exe

[2011.12.01 21:50:28 | 000,171,808 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\SysNative\javaw.exe

[2011.12.01 21:50:28 | 000,171,808 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\SysNative\java.exe

[2011.12.01 21:50:18 | 000,000,000 | ---D | C] -- C:\Program Files\Java

[2011.12.01 21:49:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java

[2011.12.01 21:49:29 | 000,157,472 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\javaws.exe

[2011.12.01 21:49:29 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\javaw.exe

[2011.12.01 21:49:29 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\java.exe

[2011.12.01 21:49:12 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Java

[2011.12.01 21:41:10 | 000,414,368 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl

[2011.12.01 21:15:16 | 000,000,000 | ---D | C] -- C:\Users\Angela\AppData\Local\photoOptimizeHistoryDataBase

[2011.12.01 21:15:15 | 000,000,000 | ---D | C] -- C:\Users\Angela\AppData\Local\Ashampoo Photo Optimizer Medion

[2011.12.01 20:19:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner

[2011.12.01 20:19:40 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner

[2011.12.01 19:03:59 | 000,000,000 | ---D | C] -- C:\Users\Angela\AppData\Roaming\Malwarebytes

[2011.12.01 19:03:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2011.12.01 19:03:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2011.12.01 19:03:51 | 000,025,416 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys

[2011.12.01 19:03:51 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware

[2011.12.01 18:36:06 | 000,000,000 | ---D | C] -- C:\$RECYCLE.BIN

[2011.12.01 18:29:00 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe

[2011.12.01 18:29:00 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe

[2011.12.01 18:29:00 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe

[2011.12.01 18:28:56 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT

[2011.12.01 18:28:53 | 000,000,000 | ---D | C] -- C:\Qoobox

[2011.12.01 18:19:46 | 004,323,152 | R--- | C] (Swearware) -- C:\Users\Angela\Desktop\ComboFix.exe

[2011.12.01 18:01:48 | 000,000,000 | ---D | C] -- C:\Users\Angela\AppData\Roaming\WinRAR

[2011.12.01 18:01:48 | 000,000,000 | ---D | C] -- C:\Users\Angela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR

[2011.12.01 18:01:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR

[2011.12.01 18:01:45 | 000,000,000 | ---D | C] -- C:\Program Files\WinRAR

[2011.12.01 17:24:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip

[2011.12.01 17:24:20 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\7-Zip

[2011.12.01 17:03:28 | 000,000,000 | ---D | C] -- C:\_OTL

[2011.12.01 16:30:24 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\Angela\Desktop\OTL.exe

[2011.12.01 15:37:28 | 000,000,000 | ---D | C] -- C:\Users\Angela\AppData\Roaming\QuickScan

[2011.11.19 17:54:26 | 000,000,000 | ---D | C] -- C:\Users\Angela\Desktop\Dichtung-einbauen-Dateien

[2011.11.19 10:35:43 | 000,000,000 | ---D | C] -- C:\Users\Angela\Desktop\fensterdichtung-t22388-Dateien

[2011.11.17 18:49:12 | 000,000,000 | ---D | C] -- C:\Users\Angela\Desktop\DisplayProductInformation-SearchDetail-Dateien

[2011.11.16 14:14:01 | 000,000,000 | ---D | C] -- C:\Users\Angela\Desktop\Schokokekse mit Karamell _ Pi mal Butter-Dateien

[2011.11.12 10:32:00 | 000,000,000 | ---D | C] -- C:\Users\Angela\Desktop\111112_wolfsabend-Dateien

[2011.11.12 09:27:43 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\Macromed

[2011.11.10 10:18:42 | 000,000,000 | ---D | C] -- C:\Users\Angela\Desktop\Fotos November

[2011.11.10 08:55:45 | 000,000,000 | ---D | C] -- C:\Users\Angela\Desktop\150678567191-Dateien

[2011.11.04 19:29:11 | 000,000,000 | ---D | C] -- C:\Users\Angela\Desktop\13234098-Rueschenschal-in-schwarz-Dateien

[2011.10.30 10:33:45 | 003,623,592 | ---- | C] (Ask) -- C:\Program Files (x86)\Common Files\ApnToolbarInstaller.exe

[2011.10.30 10:33:45 | 000,143,240 | ---- | C] (Ask.com) -- C:\Program Files (x86)\Common Files\ApnStub.exe

 
 ========== Files - Modified Within 30 Days ==========

 

[2011.12.04 16:05:50 | 000,067,584 | ---- | M] () -- C:\Windows\bootstat.dat

[2011.12.04 16:05:48 | 3151,327,232 | -HS- | M] () -- C:\hiberfil.sys

[2011.12.04 14:09:49 | 000,021,441 | ---- | M] () -- C:\Users\Angela\Desktop\16179.htm

[2011.12.04 10:10:37 | 000,016,752 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2011.12.04 10:10:37 | 000,016,752 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2011.12.03 18:03:07 | 000,034,008 | ---- | M] () -- C:\Users\Angela\Desktop\monatl. Überweisungen.odt

[2011.12.03 13:41:11 | 000,001,230 | ---- | M] () -- C:\Users\Angela\Desktop\Calculator (2).lnk

[2011.12.03 12:20:45 | 000,143,418 | ---- | M] () -- C:\Users\Angela\Desktop\22612429-Grosses-rechteckiges-Vogelhaus-Typ-9.htm

[2011.12.02 16:43:39 | 001,498,506 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI

[2011.12.02 16:43:39 | 000,654,166 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat

[2011.12.02 16:43:39 | 000,616,008 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat

[2011.12.02 16:43:39 | 000,130,006 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat

[2011.12.02 16:43:39 | 000,106,388 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat

[2011.12.02 07:39:11 | 000,414,368 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl

[2011.12.01 21:50:20 | 000,525,544 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\SysNative\deployJava1.dll

[2011.12.01 21:50:20 | 000,190,752 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\SysNative\javaws.exe

[2011.12.01 21:50:20 | 000,171,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\SysNative\javaw.exe

[2011.12.01 21:50:20 | 000,171,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\SysNative\java.exe

[2011.12.01 21:49:14 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\deployJava1.dll

[2011.12.01 21:49:14 | 000,157,472 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\javaws.exe

[2011.12.01 21:49:14 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\javaw.exe

[2011.12.01 21:49:14 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\java.exe

[2011.12.01 21:23:35 | 000,038,129 | ---- | M] () -- C:\Windows\Irremote.ini

[2011.12.01 20:19:41 | 000,000,826 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk

[2011.12.01 19:03:56 | 000,001,117 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk

[2011.12.01 18:36:01 | 000,000,027 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts

[2011.12.01 18:20:18 | 004,323,152 | R--- | M] (Swearware) -- C:\Users\Angela\Desktop\ComboFix.exe

[2011.12.01 17:23:58 | 001,110,476 | ---- | M] () -- C:\Users\Angela\Desktop\7z920.exe

[2011.12.01 17:07:03 | 000,001,158 | ---- | M] () -- C:\Users\Angela\Desktop\Mozilla Firefox.lnk

[2011.12.01 16:45:26 | 000,684,297 | ---- | M] () -- C:\Users\Angela\Desktop\unhide.exe

[2011.12.01 15:56:40 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Angela\Desktop\OTL.exe

[2011.11.25 19:30:03 | 000,020,676 | ---- | M] () -- C:\Users\Angela\Desktop\komplette liste erstellen.odt

[2011.11.20 18:39:39 | 000,010,635 | ---- | M] () -- C:\Users\Angela\Desktop\zinn.odt

[2011.11.19 17:54:26 | 000,009,275 | ---- | M] () -- C:\Users\Angela\Desktop\Dichtung-einbauen.html

[2011.11.19 10:35:43 | 000,072,045 | ---- | M] () -- C:\Users\Angela\Desktop\fensterdichtung-t22388.html

[2011.11.17 18:49:12 | 000,260,637 | ---- | M] () -- C:\Users\Angela\Desktop\DisplayProductInformation-SearchDetail.htm

[2011.11.16 14:14:02 | 000,071,086 | ---- | M] () -- C:\Users\Angela\Desktop\Schokokekse mit Karamell _ Pi mal Butter.htm

[2011.11.12 10:32:01 | 000,039,398 | ---- | M] () -- C:\Users\Angela\Desktop\111112_wolfsabend.html

[2011.11.11 18:11:50 | 000,030,040 | ---- | M] () -- C:\Users\Angela\Desktop\November.odt

[2011.11.10 08:55:46 | 000,109,425 | ---- | M] () -- C:\Users\Angela\Desktop\150678567191.htm

[2011.11.09 07:44:12 | 000,406,312 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT

[2011.11.07 16:48:53 | 000,019,031 | ---- | M] () -- C:\Users\Angela\Desktop\Bücherliste.odt

[2011.11.07 07:53:26 | 000,849,359 | ---- | M] () -- C:\Users\Angela\Desktop\maxx.jpg

[2011.11.06 15:24:38 | 000,026,373 | ---- | M] () -- C:\Users\Angela\Desktop\ordnungsamt.odt

[2011.11.04 19:29:11 | 000,128,519 | ---- | M] () -- C:\Users\Angela\Desktop\13234098-Rueschenschal-in-schwarz.htm

[2011.11.04 17:42:02 | 000,016,818 | ---- | M] () -- C:\Users\Angela\Desktop\komplette liste erstellen - Rest.odt

[2011.11.04 17:17:45 | 280,909,672 | ---- | M] () -- C:\Users\Angela\Desktop\Standard_20111104_171645.zip

 
 ========== Files Created - No Company Name ==========

 

[2011.12.04 14:09:49 | 000,021,441 | ---- | C] () -- C:\Users\Angela\Desktop\16179.htm

[2011.12.03 13:41:11 | 000,001,230 | ---- | C] () -- C:\Users\Angela\Desktop\Calculator (2).lnk

[2011.12.03 12:20:44 | 000,143,418 | ---- | C] () -- C:\Users\Angela\Desktop\22612429-Grosses-rechteckiges-Vogelhaus-Typ-9.htm

[2011.12.01 20:19:41 | 000,000,826 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk

[2011.12.01 19:03:56 | 000,001,117 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk

[2011.12.01 18:29:00 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe

[2011.12.01 18:29:00 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe

[2011.12.01 18:29:00 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe

[2011.12.01 18:29:00 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe

[2011.12.01 18:29:00 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe

[2011.12.01 17:23:55 | 001,110,476 | ---- | C] () -- C:\Users\Angela\Desktop\7z920.exe

[2011.12.01 17:07:03 | 000,001,158 | ---- | C] () -- C:\Users\Angela\Desktop\Mozilla Firefox.lnk

[2011.12.01 16:57:47 | 000,001,124 | ---- | C] () -- C:\Users\Public\Desktop\OpenOffice.org 3.3.lnk

[2011.12.01 16:57:47 | 000,001,010 | ---- | C] () -- C:\Users\Public\Desktop\IrfanView.lnk

[2011.12.01 16:57:45 | 000,002,448 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk

[2011.12.01 16:57:45 | 000,002,441 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk

[2011.12.01 16:57:45 | 000,002,052 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Intel(R) WiDi.lnk

[2011.12.01 16:57:45 | 000,001,547 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk

[2011.12.01 16:57:45 | 000,001,416 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Control Center.lnk

[2011.12.01 16:57:45 | 000,001,352 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Anytime Upgrade.lnk

[2011.12.01 16:57:45 | 000,001,345 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk

[2011.12.01 16:57:45 | 000,001,330 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sidebar.lnk

[2011.12.01 16:57:45 | 000,001,326 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk

[2011.12.01 16:57:45 | 000,001,246 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XPS Viewer.lnk

[2011.12.01 16:57:45 | 000,001,210 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Fax and Scan.lnk

[2011.12.01 16:57:45 | 000,001,158 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk

[2011.12.01 16:46:27 | 000,684,297 | ---- | C] () -- C:\Users\Angela\Desktop\unhide.exe

[2011.11.20 18:39:35 | 000,010,635 | ---- | C] () -- C:\Users\Angela\Desktop\zinn.odt

[2011.11.19 17:54:26 | 000,009,275 | ---- | C] () -- C:\Users\Angela\Desktop\Dichtung-einbauen.html

[2011.11.19 10:35:43 | 000,072,045 | ---- | C] () -- C:\Users\Angela\Desktop\fensterdichtung-t22388.html

[2011.11.17 18:49:11 | 000,260,637 | ---- | C] () -- C:\Users\Angela\Desktop\DisplayProductInformation-SearchDetail.htm

[2011.11.16 14:14:01 | 000,071,086 | ---- | C] () -- C:\Users\Angela\Desktop\Schokokekse mit Karamell _ Pi mal Butter.htm

[2011.11.12 10:32:00 | 000,039,398 | ---- | C] () -- C:\Users\Angela\Desktop\111112_wolfsabend.html

[2011.11.10 08:55:44 | 000,109,425 | ---- | C] () -- C:\Users\Angela\Desktop\150678567191.htm

[2011.11.07 07:53:26 | 000,849,359 | ---- | C] () -- C:\Users\Angela\Desktop\maxx.jpg

[2011.11.06 11:54:27 | 000,026,373 | ---- | C] () -- C:\Users\Angela\Desktop\ordnungsamt.odt

[2011.11.05 09:27:02 | 000,019,031 | ---- | C] () -- C:\Users\Angela\Desktop\Bücherliste.odt

[2011.11.04 19:29:10 | 000,128,519 | ---- | C] () -- C:\Users\Angela\Desktop\13234098-Rueschenschal-in-schwarz.htm

[2011.11.04 17:17:08 | 280,909,672 | ---- | C] () -- C:\Users\Angela\Desktop\Standard_20111104_171645.zip

[2011.10.30 10:33:46 | 000,444,283 | ---- | C] () -- C:\Program Files (x86)\Common Files\WinPcapNmap.exe

[2011.09.27 17:43:41 | 000,000,209 | ---- | C] () -- C:\Windows\ODBCINST.INI

[2011.09.27 17:43:41 | 000,000,135 | ---- | C] () -- C:\Windows\ODBC.INI

[2011.09.27 17:43:25 | 000,038,129 | ---- | C] () -- C:\Windows\Irremote.ini

[2011.09.27 17:43:14 | 000,142,337 | ---- | C] () -- C:\Windows\SysWow64\Wait.exe

[2011.09.27 17:42:34 | 000,005,110 | ---- | C] () -- C:\Windows\HCWPNP.INI

[2011.09.02 19:23:54 | 000,000,038 | ---- | C] () -- C:\Windows\avisplitter.ini

[2011.09.02 19:23:53 | 000,650,752 | ---- | C] () -- C:\Windows\SysWow64\xvidcore.dll

[2011.09.02 19:23:53 | 000,243,200 | ---- | C] () -- C:\Windows\SysWow64\xvidvfw.dll

[2011.09.02 19:23:52 | 000,074,752 | ---- | C] () -- C:\Windows\SysWow64\ff_vfw.dll

[2011.09.02 17:16:39 | 000,032,608 | ---- | C] () -- C:\Windows\king-uninstall.exe

[2011.06.08 20:34:59 | 013,359,616 | ---- | C] () -- C:\Windows\SysWow64\ig4icd32.dll

[2011.06.08 20:34:59 | 000,056,832 | ---- | C] () -- C:\Windows\SysWow64\igdde32.dll

[2011.05.27 02:14:01 | 000,963,116 | ---- | C] () -- C:\Windows\SysWow64\igkrng600.bin

[2011.05.27 02:14:00 | 000,218,304 | ---- | C] () -- C:\Windows\SysWow64\igfcg600m.bin

[2011.05.27 02:14:00 | 000,145,804 | ---- | C] () -- C:\Windows\SysWow64\igcompkrng600.bin

[2009.07.14 06:38:36 | 000,067,584 | ---- | C] () -- C:\Windows\bootstat.dat

[2009.07.14 03:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT

[2009.07.14 03:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat

[2009.07.14 01:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin

[2009.07.14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll

[2009.07.13 22:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll

[2009.06.10 22:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat
 

< End of report >

--- --- ---

Ist der Mist noch nicht vorbei?

hi lösche mal auf c: den ordner _OTL das ist nur die quarantäne des programms otl also keine sorge