Trojaner-Board - www.searchnu.com/406 wird bei jedem neuen Tab geöffnet

Trojaner-Board (https://www.trojaner-board.de/)

- Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)

- - www.searchnu.com/406 wird bei jedem neuen Tab geöffnet (https://www.trojaner-board.de/130972-www-searchnu-com-406-neuen-tab-geoeffnet.html)

Sorry wegen der Doppelposts. Grad hat sich auch noch Windows geupdatet, der Neustart hat eine Ewigkeit gedauert. Aber ich hoffe dass gut Ding eben Weile haben möchte, hier die (endlich die richtige) Logdatei.

Zitat:

All processes killed
========== OTL ==========
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_Dlls:C:\PROGRA~2\Wincert\WIN32C~1.DLL deleted successfully.
C:\ProgramData\Wincert\win32cert.dll moved successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_Dlls:C:\PROGRA~1\SEARCH~1\Datamngr\datamngr.dll deleted successfully.
File C:\Programme\Search Results Toolbar\Datamngr\datamngr.dll not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_Dlls:C:\PROGRA~1\SEARCH~1\Datamngr\IEBHO.dll deleted successfully.
C:\Programme\Search Results Toolbar\Datamngr\IEBHO.dll moved successfully.
========== FILES ==========
========== COMMANDS ==========

[EMPTYTEMP]

User: Alex
->Temp folder emptied: 49616 bytes
->Temporary Internet Files folder emptied: 442812 bytes
->Java cache emptied: 17577503 bytes
->FireFox cache emptied: 80272181 bytes
->Google Chrome cache emptied: 20573200 bytes
->Flash cache emptied: 506 bytes

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Flash cache emptied: 56468 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 113,00 mb

OTL by OldTimer - Version 3.2.69.0 log created on 02132013_205239

Files\Folders moved on Reboot...

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

Ja, wir kommen schon weiter.
lade den CCleaner standard:
CCleaner - Download - Filepony
falls der CCleaner
bereits instaliert, überspringen.
öffnen, Tools (extras),uninstall Llist, als txt speichern. öffnen.
hinter, jedes von dir benötigte programm, schreibe notwendig.
hinter, jedes, von dir nicht benötigte, unnötig.
hinter, dir unbekannte, unbekannt.
liste posten.

Adobe AIR Adobe Systems Incorporated 26.11.2012 30,1MB 2.7.1.19610 - unbekannt
Adobe Flash Player 10 ActiveX Adobe Systems Incorporated 22.09.2009 10.0.32.18 - notwendig
Adobe Flash Player 11 Plugin Adobe Systems Incorporated 09.02.2013 11.5.502.149 - notwendig
Adobe Reader X (10.1.5) - Deutsch Adobe Systems Incorporated 18.01.2013 165MB 10.1.5 - notwendig
Agere Systems HDA Modem Agere Systems 09.02.2008 - unbekannt
Amazon MP3-Downloader 1.0.17 Amazon Services LLC 01.11.2012 - 2,55MB 1.0.17 - notwendig
Browser Guard 4.0 PC Tools 11.02.2013 27,6MB 4.0.0.1884 - unbekannt
calibre Kovid Goyal 01.01.2013 137MB 0.9.12 - unnötig
CCleaner Piriform 23.01.2013 5,12MB 3.27 - unnötig
Compatibility Pack for the 2007 Office system Microsoft Corporation 11.05.2012 110MB 12.0.6612.1000 - notwendig
DHTML Editing Component Microsoft Corporation 09.10.2010 462KB 6.02.0001 - ubekannt
Diablo II 20.07.2011 1,75GB - notwendig
Driver Detective 09.02.2008 - unbekannt
ElsterFormular für Privatanwender Landesfinanzdirektion Thüringen 07.04.2012 143MB 13.1.1.8531p - notwendig
FreePDF (Remove only) 26.04.2012 3,58MB - unnötig
Garmin ANT Agent Garmin Ltd or its subsidiaries 27.04.2012 16,9MB 2.3.3 - notwendig
Garmin Communicator Plugin Garmin Ltd or its subsidiaries 24.12.2011 14,7MB 3.0.1 - notwendig
Garmin USB Drivers Garmin Ltd or its subsidiaries 27.04.2012 124KB 2.3.0.0 - notwendig
Google Chrome Google Inc. 22.01.2011 149MB 24.0.1312.57 - notwendig
Google Drive Google, Inc. 19.01.2013 16,0MB 1.7.4018.3496 - notwendig
Google Earth Plug-in Google 18.11.2011 40,9MB 6.1.0.5001 - notwendig
GPL Ghostscript Artifex Software Inc. 26.04.2012 31,5MB 9.04 - notwendig
Java 7 Update 13 Oracle 06.02.2013 129MB 7.0.130 - unbekannt
Java(TM) 6 Update 35 Oracle 01.07.2012 95,6MB 6.0.350 - unbekannt
Java(TM) 6 Update 6 Sun Microsystems, Inc. 14.06.2008 136MB 1.6.0.60 - unbekannt
Java(TM) 6 Update 7 Sun Microsystems, Inc. 15.10.2008 136MB 1.6.0.70 - unbekannt
Kalender-Excel-8.7 MSDatec 17.01.2011 2,73MB 8.7 - unbekannt
Kobo Kobo Inc. 18.08.2012 122MB 3.0.1 - notwendig
Logitech Harmony Remote Software 7 Logitech 24.11.2012 88,2MB 7.7.0.0 - notwendig
Magic Workstation 0.94f Magic Technology 15.07.2012 26,1MB -unötig
Malwarebytes Anti-Malware Version 1.70.0.1100 Malwarebytes Corporation 11.02.2013 12,2MB 1.70.0.1100 - notwendig
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU Microsoft Corporation 23.08.2009 36,9MB - unbekannt
Microsoft .NET Framework 3.5 SP1 Microsoft Corporation 16.08.2009 36,9MB - unbekannt
Microsoft .NET Framework 4 Client Profile Microsoft Corporation 25.06.2010 120MB 4.0.30319 - unbekannt
Microsoft .NET Framework 4 Client Profile DEU Language Pack Microsoft Corporation 25.06.2010 24,5MB 4.0.30319 - unbekannt
Microsoft Office Live Add-in 1.5 Microsoft Corporation 14.05.2012 506KB 2.0.4024.1 - unbekannt
Microsoft Office XP Professional mit FrontPage Microsoft Corporation 15.06.2011 393MB 10.0.6626.0 - notwendig
Microsoft Silverlight Microsoft Corporation 16.05.2012 40,2MB 4.1.10329.0 - unbekannt
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 Microsoft Corporation 26.09.2009 251KB 8.0.50727.4053 - unbekannt
Microsoft Visual C++ 2005 Redistributable Microsoft Corporation 15.06.2011 294KB 8.0.59193 - unbekannt
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 Microsoft Corporation 16.05.2010 199KB 9.0.30729.4148 - unbekannt
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 Microsoft Corporation 18.05.2011 592KB 9.0.30729.5570 - unbekannt
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Corporation 15.03.2010 590KB 9.0.30729 - unbekannt
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Microsoft Corporation 04.11.2010 589KB 9.0.30729.4148 - unbekannt
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Microsoft Corporation 15.06.2011 594KB 9.0.30729.6161 - unbekannt
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 Microsoft Corporation 15.10.2011 16,5MB 10.0.40219 - unbekannt
Mozilla Firefox 18.0.2 (x86 de) Mozilla 09.02.2013 43,8MB 18.0.2 - benötigt
Mozilla Maintenance Service Mozilla 09.02.2013 216KB 18.0.2 - benötigt
MSXML 4.0 SP2 (KB936181) Microsoft Corporation 08.06.2008 1,26MB 4.20.9848.0 - unbekannt
MSXML 4.0 SP2 (KB941833) Microsoft Corporation 10.06.2008 1,26MB 4.20.9849.0 - unbekannt
MSXML 4.0 SP2 (KB954430) Microsoft Corporation 13.11.2008 1,27MB 4.20.9870.0 - unbekannt
MSXML 4.0 SP2 (KB973688) Microsoft Corporation 17.12.2009 1,33MB 4.20.9876.0 - unbekannt
myphotobook.de myphotobook GmbH 26.11.2012 37,2MB 1.4.10.953 - unnötig
PC Tools Spyware Doctor 9.1 PC Tools 11.02.2013 552MB 9.1 - unbekannt
PDFTK Builder 3.5.3 13.02.2011 3,47MB - unbekannt
RedMon - Redirection Port Monitor 26.04.2012 - unbekannt
Remote Control USB Driver 24.11.2012 3,61MB 2.3.2.317 - unbekannt
RTPatch Update PocketSoft 03.03.2010 944KB - unbekannt
SAMSUNG Mobile Composite Device Software 14.05.2012 - benötigt
SAMSUNG Mobile Modem Driver Set 14.05.2012 - benötigt
Samsung Mobile phone USB driver Software 14.05.2012 - benötigt
SAMSUNG Mobile USB Modem 1.0 Software 14.05.2012 - benötigt
SAMSUNG Mobile USB Modem Software 14.05.2012 - benötigt
Samsung PC Studio 3 Samsung Electronics Co., Ltd. 14.05.2012 140MB 3.2.3.90605 - benötigt
Skype™ 6.1 Skype Technologies S.A. 28.01.2013 21,1MB 6.1.129 - benötigt
Spelling Dictionaries Support For Adobe Reader 8 Adobe Systems 10.11.2009 32,5MB 8.0.0 - unbekannt
Tuner Driver LITEON 21.04.2008 23,5MB 1.0.0.1207 - unbekannt
Unity Web Player Unity Technologies ApS 09.11.2010 208KB - unbekannt
VideoLAN VLC media player 0.8.6c VideoLAN Team 03.02.2010 32,3MB 0.8.6c - unbekannt
VirtualCloneDrive Elaborate Bytes 10.06.2012 2,35MB - benötigt
Winamp Nullsoft, Inc 04.12.2011 37,7MB 5.622 - benötigt
Winamp Erkennungs-Plug-in Nullsoft, Inc 04.12.2011 132KB 1.0.0.1 - unbekannt
Windows Driver Package - Dynastream Innovations (libusb0) - unbekannt LibUsbDevices (07/07/2009 1.12.2) Dynastream Innovations 27.04.2012 07/07/2009 1.12.2 - unbekannt
Windows Driver Package - Garmin (grmnusb) GARMIN Devices (06/03/2009 2.3.0.0) Garmin 27.04.2012 06/03/2009 2.3.0.0 - benötigt
Windows Mobile-Gerätecenter Microsoft Corporation 07.06.2010 27,5MB 6.1.6965.0 - unbekannt
Windows-Treiberpaket - LITEON (Ltn_stk7700pc) Media (11/28/2006 3.0.0.7) LITEON 21.04.2008 11/28/2006 3.0.0.7 - unbekannt
WinRAR 01.06.2010 3,78MB - benötigt
WinZip 11.1 WinZip Computing, S.L. 22.02.2008 11,2MB 11.1.7466g - benötigt

deinstaliere:
Adobe AIR
Adobe Flash Player alle
Adobe - Adobe Flash Player installieren
neueste version laden, instalieren.
adobe reader:
Adobe - Adobe Reader herunterladen - Alle Versionen
haken bei mcafee security scan raus nehmen

bitte auch mal den adobe reader wie folgt konfigurieren:
adobe reader öffnen, bearbeiten, voreinstellungen.
allgemein:
nur zertifizierte zusatz module verwenden, anhaken.
internet:
hier sollte alles deaktiviert werden, es ist sehr unsicher pdfs automatisch zu öffnen, zu downloaden etc.
es ist immer besser diese direkt abzuspeichern da man nur so die kontrolle hat was auf dem pc vor geht.
bei javascript den haken bei java script verwenden raus nehmen
bei updater, automatisch instalieren wählen.
übernehmen /ok

deinstaliere:
Browser Guard
calibre
Driver Detective
FreePDF
Java(TM) 6 : alle
Kalender
Magic
myphotobook
PC Tools
PDFTK
Spelling
Unity
VideoLAN
falls du den vlc player nutzt, update hohlen
VideoLAN - Official page for VLC media player, the Open Source video framework!

Öffne CCleaner, analysieren, starten, PC neustarten
Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Neustarten, testen, wie PC + Programme wie Browser laufen

Hallo,

es schaut schon gut aus. :) Hier der Log:AdwCleaner Logfile:

Code:

# AdwCleaner v2.112 - Datei am 14/02/2013 um 17:14:47 erstellt

# Aktualisiert am 10/02/2013 von Xplode

# Betriebssystem : Windows Vista (TM) Home Premium Service Pack 2 (32 bits)

# Benutzer : Alex - ALEX-PC

# Bootmodus : Normal

# Ausgeführt unter : C:\Users\Alex\Desktop\adwcleaner0.exe

# Option [Löschen]
 
 

**** [Dienste] ****
 
 

***** [Dateien / Ordner] *****
 

Gelöscht mit Neustart : C:\Users\Alex\AppData\Roaming\Mozilla\Firefox\Profiles\3osy0i74.default\extensions\{1fd91a9c-410c-4090-bbcc-55d3450ef433}

Ordner Gelöscht : C:\Program Files\search results toolbar
 

***** [Registrierungsdatenbank] *****
 

Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Conduit

Schlüssel Gelöscht : HKCU\Software\AVG Secure Search

Schlüssel Gelöscht : HKCU\Software\DataMngr

Schlüssel Gelöscht : HKCU\Software\DataMngr_Toolbar

Schlüssel Gelöscht : HKCU\Software\IGearSettings

Schlüssel Gelöscht : HKCU\Software\ilivid

Schlüssel Gelöscht : HKCU\Software\IM

Schlüssel Gelöscht : HKCU\Software\ImInstaller

Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{CFF4DB9B-135F-47C0-9269-B4C6572FD61A}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

Schlüssel Gelöscht : HKLM\Software\AVG Secure Search

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{D97A8234-F2A2-4AD4-91D5-FECDB2C553AF}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\BrowserConnection.dll

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Applications\ilividsetupv1.exe

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{9FF9AE6F-4553-41A7-B645-B0E88850EABF}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CE4DB5A3-58E6-41F1-8761-47238DF4F468}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iLividIEHelper.DNSGuard

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iLividIEHelper.DNSGuard.1

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{75E8DA27-44AF-40AE-927C-F2EEC99D65B1}

Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\DATAMNGR

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

Schlüssel Gelöscht : HKLM\Software\Web Assistant

Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{855F3B16-6D32-4FE6-8A56-BBB695989046}]

Wert Gelöscht : HKLM\SOFTWARE\Mozilla\Firefox\extensions [{336D0C35-8A85-403a-B9D2-65C292C39087}]
 

***** [Internet Browser] *****
 

-\\ Internet Explorer v9.0.8112.16457
 

Ersetzt : [HKCU\Software\Microsoft\Internet Explorer\Main - ICQ Search] = hxxp://www.icq.com/search/results.php?q={searchTerms}&ch_id=osd --> hxxp://www.google.com
 

-\\ Mozilla Firefox v18.0.2 (de)
 

Datei : C:\Users\Alex\AppData\Roaming\Mozilla\Firefox\Profiles\3osy0i74.default\prefs.js
 

C:\Users\Alex\AppData\Roaming\Mozilla\Firefox\Profiles\3osy0i74.default\user.js ... Gelöscht !
 

Gelöscht : user_pref("browser.search.defaultengine", "Ask.com");

Gelöscht : user_pref("browser.search.defaultenginename", "Search Results");

Gelöscht : user_pref("browser.search.defaulturl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&Sea[...]

Gelöscht : user_pref("browser.search.order.1", "Search Results");

Gelöscht : user_pref("extensions.incredibar_i.aflt", "orgnl");

Gelöscht : user_pref("extensions.incredibar_i.dfltLng", "");

Gelöscht : user_pref("extensions.incredibar_i.did", "10646");

Gelöscht : user_pref("extensions.incredibar_i.excTlbr", false);

Gelöscht : user_pref("extensions.incredibar_i.id", "cca26c2c000000000000001b9e428c03");

Gelöscht : user_pref("extensions.incredibar_i.installerproductid", "26");

Gelöscht : user_pref("extensions.incredibar_i.instlDay", "15493");

Gelöscht : user_pref("extensions.incredibar_i.instlRef", "");

Gelöscht : user_pref("extensions.incredibar_i.ms_url_id", "");

Gelöscht : user_pref("extensions.incredibar_i.newTab", false);

Gelöscht : user_pref("extensions.incredibar_i.ppd", "");

Gelöscht : user_pref("extensions.incredibar_i.prdct", "incredibar");

Gelöscht : user_pref("extensions.incredibar_i.productid", "26");

Gelöscht : user_pref("extensions.incredibar_i.prtnrId", "Incredibar");

Gelöscht : user_pref("extensions.incredibar_i.smplGrp", "none");

Gelöscht : user_pref("extensions.incredibar_i.tlbrId", "base");

Gelöscht : user_pref("extensions.incredibar_i.tlbrSrchUrl", "hxxp://mystart.Incredibar.com/?a=6R8uKLa6Qm&loc=IB[...]

Gelöscht : user_pref("extensions.incredibar_i.upn2", "6R8uKLa6Qm");

Gelöscht : user_pref("extensions.incredibar_i.upn2n", "92824464636505638");

Gelöscht : user_pref("extensions.incredibar_i.vrsn", "1.5.11.14");

Gelöscht : user_pref("extensions.incredibar_i.vrsnTs", "1.5.11.148:51:54");

Gelöscht : user_pref("extensions.incredibar_i.vrsni", "1.5.11.14");

Gelöscht : user_pref("extensions.snipit.askTbInstalled", true);
 

-\\ Google Chrome v24.0.1312.57
 

Datei : C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Preferences
 

[OK] Die Datei ist sauber.
 

*************************
 

AdwCleaner[R5].txt - [6283 octets] - [14/02/2013 17:13:37]

AdwCleaner[S6].txt - [5873 octets] - [14/02/2013 17:14:47]
 

########## EOF - C:\AdwCleaner[S6].txt - [5933 octets] ##########

--- --- ---

hi
lade bitte Hitmanpro:
HitmanPro - Download - Filepony
Doppelklick, auf Lizenz gehen, Testlizenz aktivieren.
Dann auf Scan, nichts löschen, auf weiter, Log als XML exportieren, Inhalt hier reinkopieren oder Log packen und anhängen.

Hier der Log.

Code:

HitmanPro 3.7.2.188

www.hitmanpro.com
 

   Computer name . . . . : ALEX-PC

   Windows . . . . . . . : 6.0.2.6002.X86/2

   User name . . . . . . : Alex-PC\Alex

   UAC . . . . . . . . . : Enabled

   License . . . . . . . : Trial (30 days left)
 

   Scan date . . . . . . : 2013-02-14 18:01:13

   Scan mode . . . . . . : Normal

   Scan duration . . . . : 3m 11s

   Disk access mode  . . : Direct disk access (SRB)

   Cloud . . . . . . . . : Internet

   Reboot  . . . . . . . : No
 

   Threats . . . . . . . : 0

   Traces  . . . . . . . : 2
 

   Objects scanned . . . : 1.760.202

   Files scanned . . . . : 11.823

   Remnants scanned  . . : 371.952 files / 1.376.427 keys
 

Potential Unwanted Programs _________________________________________________
 

   C:\Users\Alex\AppData\LocalLow\DataMngr\ (SearchQU) -> Deleted

   C:\Users\Alex\AppData\LocalLow\DataMngr\{7CA1F051-A4FB-4143-B263-02B41E571EED} (SearchQU) -> Deleted

hi,
zur Sicherheit noch ein neues OTL log.

Hui ist die lang. Was sagt der Experte?OTL Logfile:

Code:

OTL logfile created on: 14.02.2013 18:20:10 - Run 2

OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Alex\Desktop

Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

1,75 Gb Total Physical Memory | 0,93 Gb Available Physical Memory | 52,96% Memory free

3,73 Gb Paging File | 2,93 Gb Available in Paging File | 78,45% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 39,06 Gb Total Space | 7,74 Gb Free Space | 19,81% Space Free | Partition Type: NTFS

Drive D: | 35,47 Gb Total Space | 15,45 Gb Free Space | 43,55% Space Free | Partition Type: NTFS

 

Computer Name: ALEX-PC | User Name: Alex | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2013.02.11 21:14:50 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Alex\Desktop\OTL.exe

PRC - [2013.02.06 19:25:19 | 000,213,384 | ---- | M] (Google Inc.) -- C:\Programme\Google\Update\1.3.21.135\GoogleCrashHandler.exe

PRC - [2012.12.14 16:49:28 | 000,682,344 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe

PRC - [2012.12.14 16:49:28 | 000,512,360 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe

PRC - [2012.12.14 16:49:28 | 000,398,184 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamscheduler.exe

PRC - [2012.10.23 17:40:06 | 000,580,728 | ---- | M] (Threat Expert Ltd.) -- C:\Programme\PC Tools\PC Tools Security\BDT\BDTUpdateService.exe

PRC - [2011.03.07 14:33:08 | 000,089,456 | ---- | M] (Elaborate Bytes AG) -- D:\d2\VirtualCloneDrive\VCDDaemon.exe

PRC - [2009.04.11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe

PRC - [2006.10.05 17:10:12 | 000,009,216 | ---- | M] (Agere Systems) -- C:\Windows\System32\agrsmsvc.exe

 

 
 ========== Modules (No Company Name) ==========

 

MOD - [2007.01.18 23:54:48 | 000,159,744 | ---- | M] () -- C:\Windows\System32\atitmmxx.dll

 

 
 ========== Services (SafeList) ==========

 

SRV - [2013.02.14 18:17:53 | 000,251,248 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)

SRV - [2013.02.09 14:29:53 | 000,115,608 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)

SRV - [2013.01.08 12:55:20 | 000,161,536 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Programme\Skype\Updater\Updater.exe -- (SkypeUpdate)

SRV - [2012.12.14 16:49:28 | 000,682,344 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)

SRV - [2012.12.14 16:49:28 | 000,398,184 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Programme\Malwarebytes' Anti-Malware\mbamscheduler.exe -- (MBAMScheduler)

SRV - [2012.11.01 15:34:30 | 001,162,360 | ---- | M] (PC Tools) [On_Demand | Stopped] -- C:\Programme\PC Tools\PC Tools Security\pctsSvc.exe -- (sdCoreService)

SRV - [2012.10.31 09:19:52 | 000,403,416 | ---- | M] (PC Tools) [On_Demand | Stopped] -- C:\Programme\PC Tools\PC Tools Security\pctsAuxs.exe -- (sdAuxService)

SRV - [2012.10.23 17:40:06 | 000,580,728 | ---- | M] (Threat Expert Ltd.) [Auto | Running] -- C:\Programme\PC Tools\PC Tools Security\BDT\BDTUpdateService.exe -- (Browser Defender Update Service)

SRV - [2012.07.27 21:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) [Auto | Stopped] -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)

SRV - [2008.01.19 08:38:24 | 000,272,952 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)

SRV - [2008.01.19 08:33:39 | 000,896,512 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)

SRV - [2007.05.31 15:21:24 | 000,379,784 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\wcescomm.dll -- (WcesComm)

SRV - [2007.05.31 15:21:18 | 000,183,688 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\rapimgr.dll -- (RapiMgr)

SRV - [2006.10.05 17:10:12 | 000,009,216 | ---- | M] (Agere Systems) [Auto | Running] -- C:\Windows\System32\agrsmsvc.exe -- (AgereModemAudio)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp)

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Users\Alex\AppData\Local\Temp\catchme.sys -- (catchme)

DRV - File not found [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\blbdrive.sys -- (blbdrive)

DRV - [2012.12.14 16:49:28 | 000,021,104 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector)

DRV - [2012.11.01 15:35:20 | 000,068,272 | ---- | M] (PC Tools) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\pctplsm.sys -- (pctplsm)

DRV - [2012.11.01 15:35:18 | 000,071,752 | ---- | M] (PC Tools) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\pctplsg.sys -- (pctplsg)

DRV - [2012.11.01 15:35:14 | 000,202,280 | ---- | M] (PC Tools) [Kernel | System | Running] -- C:\Windows\System32\drivers\PCTSD.sys -- (PCTSD)

DRV - [2012.10.31 14:21:28 | 000,260,760 | ---- | M] (PC Tools) [Kernel | System | Running] -- C:\Windows\System32\drivers\pctgntdi.sys -- (pctgntdi)

DRV - [2012.10.23 17:40:32 | 000,062,688 | ---- | M] (PC Tools) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\PCTBD.sys -- (PCTBD)

DRV - [2012.10.22 16:38:28 | 000,368,616 | ---- | M] (PC Tools) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\PCTCore.sys -- (PCTCore)

DRV - [2012.02.28 11:43:06 | 000,909,728 | ---- | M] (PC Tools) [File_System | Boot | Running] -- C:\Windows\System32\drivers\pctEFA.sys -- (pctEFA)

DRV - [2012.02.28 11:43:00 | 000,342,168 | ---- | M] (PC Tools) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\pctDS.sys -- (pctDS)

DRV - [2011.05.17 15:44:44 | 000,035,776 | ---- | M] (libusb-Win32) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\libusb0.sys -- (libusb0)

DRV - [2009.12.17 15:02:20 | 001,203,712 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr)

DRV - [2009.04.11 05:42:52 | 000,031,616 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (winusb)

DRV - [2008.02.22 14:33:02 | 000,114,304 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\sscdmdm.sys -- (sscdmdm)

DRV - [2008.02.22 14:33:02 | 000,014,976 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\sscdmdfl.sys -- (sscdmdfl)

DRV - [2008.02.22 14:33:00 | 000,087,936 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\sscdbus.sys -- (sscdbus)

DRV - [2007.01.19 00:03:24 | 002,314,752 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (R300)

DRV - [2007.01.18 13:28:02 | 000,005,275 | ---- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\CVirtA.sys -- (CVirtA)

DRV - [2006.11.28 20:11:00 | 001,161,888 | ---- | M] (Agere Systems) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\AGRSM.sys -- (AgereSoftModem)

DRV - [2006.11.28 10:30:10 | 000,341,632 | ---- | M] (Liteon) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\Ltn_stk7700pc.sys -- (Ltn_stk7700pc)

DRV - [2006.07.24 15:05:00 | 000,005,632 | ---- | M] () [File_System | System | Running] -- C:\Windows\System32\drivers\StarOpen.sys -- (StarOpen)

DRV - [2005.12.07 10:45:00 | 000,031,232 | ---- | M] (LITE-ON) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\usbdtv.sys -- (usbdtv)

DRV - [2005.12.07 10:13:00 | 000,022,016 | ---- | M] (LITE-ON) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\dtvfw.sys -- (DTVFW)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Yahoo! Deutschland

IE - HKLM\..\SearchScopes,DefaultScope = 

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 2

IE - HKCU\..\URLSearchHook:  - No CLSID value found

IE - HKCU\..\URLSearchHook: {472734EA-242A-422b-ADF8-83D1E48CC825} - C:\Programme\PC Tools\PC Tools Security\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)

IE - HKCU\..\SearchScopes,DefaultScope = 

IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC

IE - HKCU\..\SearchScopes\{440CF5EA-8546-4F9F-AC64-64313173BB5A}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=ORJ&o=&src=kw&q={searchTerms}&locale=&apn_ptnrs=&apn_dtid=OSJ000&apn_uid=05DFAD36-9F5F-4168-AF00-71A255E82C0A&apn_sauid=32751371-0662-4686-BCC8-96017E7D7992

IE - HKCU\..\SearchScopes\{67C121FA-F5C8-4CC4-AA38-87BD6FC467B9}: "URL" = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7

IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKCU\..\SearchScopes\{BE9654C9-9D79-42ec-B55A-3CAEB12DBF58}: "URL" = hxxp://www.icq.com/search/results.php?q={searchTerms}&ch_id=osd

IE - HKCU\..\SearchScopes\{DECA3892-BA8F-44b8-A993-A466AD694AE4}: "URL" = hxxp://de.search.yahoo.com/search?p={searchTerms}

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 
 ========== FireFox ==========

 

FF - prefs.js..browser.search.defaultthis.engineName: "Search"

FF - prefs.js..browser.search.useDBForOrder: true

FF - prefs.js..browser.startup.homepage: "about:home"

FF - prefs.js..extensions.enabledAddons: %7BCAFEEFAC-0016-0000-0033-ABCDEFFEDCBA%7D:6.0.33

FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:18.0.2

FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.6

FF - prefs.js..extensions.enabledItems: {fd048119-78ee-487f-8fb1-1668d3a6859b}:2.6.1

FF - prefs.js..extensions.enabledItems: {9d1f059c-cada-4111-9696-41a62d64e3ba}:0.6

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22

FF - prefs.js..extensions.enabledItems: {7E77F5DF-8022-40e3-9122-F03DEBEFC43B}:1.0.25

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24

FF - prefs.js..extensions.foxtrick.prefs.module.YouthSkillHideUnknown.HideMaximalKeyWord.enabled: true

FF - user.js - File not found

 

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_6_602_168.dll ()

FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Content Upload Plugin,version=1.0.0: C:\Program Files\DivX\DivX Content Uploader\npUpload.dll (DivX,Inc.)

FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0:  File not found

FF - HKLM\Software\MozillaPlugins\@garmin.com/GpsControl: C:\Program Files\Garmin GPS Plugin\npGarmin.dll (GARMIN Corp.)

FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)

FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.13.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKCU\Software\MozillaPlugins\amazon.com/AmazonMP3DownloaderPlugin: D:\Programme\npAmazonMP3DownloaderPlugin101753.dll (Amazon.com, Inc.)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{3112ca9c-de6d-4884-a869-9855de68056c}: C:\ProgramData\Mozilla\Firefox Extensions\{3112ca9c-de6d-4884-a869-9855de68056c} [2008.02.09 15:53:51 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{cb84136f-9c44-433a-9048-c5cd9df1dc16}: C:\Program Files\PC Tools\PC Tools Security\BDT\Firefox\ [2013.02.14 17:33:41 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 18.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013.02.09 14:29:54 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 18.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013.02.14 17:53:38 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.0.1\extensions\\Components: D:\Programme\Mozilla Firefox\components

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.0.1\extensions\\Plugins: D:\Programme\Mozilla Firefox\plugins [2013.02.14 17:53:38 | 000,000,000 | ---D | M]

FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 18.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013.02.09 14:29:54 | 000,000,000 | ---D | M]

FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 18.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013.02.14 17:53:38 | 000,000,000 | ---D | M]

 

[2013.02.09 14:12:52 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Alex\AppData\Roaming\mozilla\Extensions

[2013.02.14 17:20:28 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Alex\AppData\Roaming\mozilla\Firefox\Profiles\3osy0i74.default\extensions

[2012.11.18 16:06:26 | 000,000,000 | ---D | M] (Garmin Communicator) -- C:\Users\Alex\AppData\Roaming\mozilla\Firefox\Profiles\3osy0i74.default\extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E}

[2013.01.12 12:14:41 | 000,000,000 | ---D | M] (FoxTrick) -- C:\Users\Alex\AppData\Roaming\mozilla\Firefox\Profiles\3osy0i74.default\extensions\{9d1f059c-cada-4111-9696-41a62d64e3ba}

[2012.12.09 21:30:50 | 000,804,627 | ---- | M] () (No name found) -- C:\Users\Alex\AppData\Roaming\mozilla\firefox\profiles\3osy0i74.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi

[2008.08.22 07:56:25 | 000,000,950 | ---- | M] () -- C:\Users\Alex\AppData\Roaming\mozilla\firefox\profiles\3osy0i74.default\searchplugins\icqplugin-13.xml

[2008.08.22 08:21:29 | 000,000,950 | ---- | M] () -- C:\Users\Alex\AppData\Roaming\mozilla\firefox\profiles\3osy0i74.default\searchplugins\icqplugin-14.xml

[2008.08.22 10:17:23 | 000,000,950 | ---- | M] () -- C:\Users\Alex\AppData\Roaming\mozilla\firefox\profiles\3osy0i74.default\searchplugins\icqplugin-15.xml

[2008.08.22 19:53:53 | 000,000,950 | ---- | M] () -- C:\Users\Alex\AppData\Roaming\mozilla\firefox\profiles\3osy0i74.default\searchplugins\icqplugin-16.xml

[2008.03.04 23:50:27 | 000,000,950 | ---- | M] () -- C:\Users\Alex\AppData\Roaming\mozilla\firefox\profiles\3osy0i74.default\searchplugins\icqplugin-4.xml

[2008.03.06 11:37:26 | 000,000,950 | ---- | M] () -- C:\Users\Alex\AppData\Roaming\mozilla\firefox\profiles\3osy0i74.default\searchplugins\icqplugin-5.xml

[2008.03.22 05:52:10 | 000,000,950 | ---- | M] () -- C:\Users\Alex\AppData\Roaming\mozilla\firefox\profiles\3osy0i74.default\searchplugins\icqplugin-6.xml

[2008.03.27 10:17:32 | 000,000,950 | ---- | M] () -- C:\Users\Alex\AppData\Roaming\mozilla\firefox\profiles\3osy0i74.default\searchplugins\icqplugin-7.xml

[2008.06.05 08:34:01 | 000,000,950 | ---- | M] () -- C:\Users\Alex\AppData\Roaming\mozilla\firefox\profiles\3osy0i74.default\searchplugins\icqplugin-8.xml

[2008.06.19 13:32:31 | 000,000,950 | ---- | M] () -- C:\Users\Alex\AppData\Roaming\mozilla\firefox\profiles\3osy0i74.default\searchplugins\icqplugin-9.xml

[2013.02.14 16:47:00 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions

[2013.02.09 14:29:39 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Programme\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}

[2013.02.09 14:29:39 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}

[2013.02.09 14:29:39 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}

[2013.02.09 14:29:54 | 000,262,552 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll

[2011.10.26 19:49:56 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files\mozilla firefox\plugins\npwachk.dll

[2012.02.14 19:48:14 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml

[2012.09.01 19:11:23 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml

[2012.02.14 19:48:14 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml

[2012.02.14 19:48:14 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml

[2012.02.14 19:48:14 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml

[2012.02.14 19:48:14 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml

 
 ========== Chrome  ==========

 

CHR - homepage: Google

CHR - default_search_provider: Google (Enabled)

CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}

CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}&sugkey={google:suggestAPIKeyParameter},

CHR - homepage: Google

CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\24.0.1312.57\PepperFlash\pepflashplayer.dll

CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer

CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\24.0.1312.57\ppGoogleNaClPluginChrome.dll

CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\24.0.1312.57\pdf.dll

CHR - plugin: Free Studio (Enabled) = C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp\1.0.1.1_0\np_dvs_plugin.dll

CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll

CHR - plugin: Winamp Application Detector (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npwachk.dll

CHR - plugin: DivX\u00AE Content Upload Plugin (Enabled) = C:\Program Files\DivX\DivX Content Uploader\npUpload.dll

CHR - plugin: Garmin Communicator Plug-In (Enabled) = C:\Program Files\Garmin GPS Plugin\npGarmin.dll

CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll

CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll

CHR - plugin: Java(TM) Platform SE 7 U9 (Enabled) = C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll

CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll

CHR - plugin: Microsoft Office Live Plug-in for Firefox (Enabled) = C:\Program Files\Microsoft\Office Live\npOLW.dll

CHR - plugin: Unity Player (Enabled) = C:\Users\Alex\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll

CHR - plugin: Windows Presentation Foundation (Enabled) = C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll

CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32_11_5_502_146.dll

CHR - plugin: Java Deployment Toolkit 7.0.90.5 (Enabled) = C:\Windows\system32\npDeployJava1.dll

CHR - plugin: AmazonMP3DownloaderPlugin (Enabled) = D:\Programme\npAmazonMP3DownloaderPlugin101753.dll

CHR - Extension: Google Drive = C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\

CHR - Extension: YouTube = C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\

CHR - Extension: Google-Suche = C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\

CHR - Extension: Super Monkey Ball = C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\hjpneodhhegapgagpdeeahiomeiagidi\3_0\

CHR - Extension: Google Mail = C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\

 

O1 HOSTS File: ([2013.02.13 20:36:50 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1       localhost

O2 - BHO: (PC Tools Browser Guard BHO) - {2A0F3D1B-0909-4FF4-B272-609CCE6054E7} - C:\Programme\PC Tools\PC Tools Security\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)

O2 - BHO: (no name) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - No CLSID value found.

O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll File not found

O3 - HKLM\..\Toolbar: (PC Tools Browser Guard) - {472734EA-242A-422B-ADF8-83D1E48CC825} - C:\Programme\PC Tools\PC Tools Security\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)

O4 - HKLM..\Run: [VirtualCloneDrive] D:\d2\VirtualCloneDrive\VCDDaemon.exe (Elaborate Bytes AG)

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O8 - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~1\MICROS~2\Office14\ONBttnIE.dll/105 File not found

O8 - Extra context menu item: Nach Microsoft &Excel exportieren - C:\Programme\Microsoft Office\Office10\EXCEL.EXE (Microsoft Corporation)

O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~1\MICROS~2\Office14\EXCEL.EXE/3000 File not found

O9 - Extra Button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)

O16 - DPF: {CAFEEFAC-0017-0000-0013-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_13-windows-i586.cab (Reg Error: Key error.)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{01535634-6163-473B-98D3-142D47E20654}: DhcpNameServer = 192.168.0.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{7A0C9220-4183-4B3B-85A1-F4F6CF7D76BA}: DhcpNameServer = 192.168.0.1

O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Common Files\microsoft shared\Web Components\10\OWC10.DLL (Microsoft Corporation)

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)

O24 - Desktop WallPaper: C:\Users\Alex\AppData\Roaming\Mozilla\Firefox\Desktop-Hintergrund.bmp

O24 - Desktop BackupWallPaper: C:\Users\Alex\AppData\Roaming\Mozilla\Firefox\Desktop-Hintergrund.bmp

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

O34 - HKLM BootExecute: (autocheck autochk *)

O34 - HKLM BootExecute: (bootdelete)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = ComFile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2013.02.14 18:17:53 | 000,691,568 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe

[2013.02.14 18:17:53 | 000,071,024 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl

[2013.02.14 18:05:48 | 000,012,872 | ---- | C] (SurfRight B.V.) -- C:\Windows\System32\bootdelete.exe

[2013.02.14 17:53:08 | 000,000,000 | ---D | C] -- C:\Program Files\Adobe

[2013.02.14 17:48:56 | 000,000,000 | ---D | C] -- C:\Program Files\HitmanPro

[2013.02.14 17:46:54 | 000,000,000 | ---D | C] -- C:\ProgramData\HitmanPro

[2013.02.14 17:46:03 | 008,984,048 | ---- | C] (SurfRight B.V.) -- C:\Users\Alex\Desktop\HitmanPro.exe

[2013.02.14 17:33:40 | 000,062,688 | ---- | C] (PC Tools) -- C:\Windows\System32\drivers\PCTBD.sys

[2013.02.14 17:33:39 | 002,280,568 | ---- | C] (Threat Expert Ltd.) -- C:\Windows\PCTBDCore.dll

[2013.02.14 17:33:39 | 001,690,744 | ---- | C] (Threat Expert Ltd.) -- C:\Windows\PCTBDRes.dll

[2013.02.14 17:33:39 | 000,150,648 | ---- | C] (PC Tools) -- C:\Windows\SGDetectionTool.dll

[2013.02.14 17:30:00 | 000,260,760 | ---- | C] (PC Tools) -- C:\Windows\System32\drivers\pctgntdi.sys

[2013.02.14 17:30:00 | 000,178,584 | ---- | C] (PC Tools) -- C:\Windows\System32\drivers\pctwfpfilter.sys

[2013.02.14 17:29:52 | 000,019,464 | ---- | C] (PC Tools) -- C:\Windows\System32\drivers\pctBTFix.sys

[2013.02.14 17:29:52 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PC Tools Security

[2013.02.14 17:29:48 | 000,071,752 | ---- | C] (PC Tools) -- C:\Windows\System32\drivers\pctplsg.sys

[2013.02.14 17:29:48 | 000,068,272 | ---- | C] (PC Tools) -- C:\Windows\System32\drivers\pctplsm.sys

[2013.02.14 17:20:48 | 000,909,728 | ---- | C] (PC Tools) -- C:\Windows\System32\drivers\pctEFA.sys

[2013.02.14 17:20:48 | 000,342,168 | ---- | C] (PC Tools) -- C:\Windows\System32\drivers\pctDS.sys

[2013.02.14 17:20:46 | 000,368,616 | ---- | C] (PC Tools) -- C:\Windows\System32\drivers\PCTCore.sys

[2013.02.14 17:20:46 | 000,163,288 | ---- | C] (PC Tools) -- C:\Windows\System32\drivers\PCTAppEvent.sys

[2013.02.13 22:23:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner

[2013.02.13 22:23:02 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner

[2013.02.13 22:21:48 | 004,189,792 | ---- | C] (Piriform Ltd) -- C:\Users\Alex\Desktop\ccsetup327.exe

[2013.02.13 21:09:37 | 002,048,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys

[2013.02.13 21:08:08 | 001,314,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\quartz.dll

[2013.02.13 21:07:58 | 003,602,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntkrnlpa.exe

[2013.02.13 21:07:58 | 003,550,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntoskrnl.exe

[2013.02.13 20:52:39 | 000,000,000 | ---D | C] -- C:\_OTL

[2013.02.13 20:39:29 | 000,000,000 | ---D | C] -- C:\Windows\temp

[2013.02.13 20:39:29 | 000,000,000 | ---D | C] -- C:\Users\Alex\AppData\Local\temp

[2013.02.13 20:27:44 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe

[2013.02.13 20:27:44 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe

[2013.02.13 20:27:44 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe

[2013.02.13 20:27:11 | 000,000,000 | ---D | C] -- C:\Qoobox

[2013.02.13 19:55:22 | 000,000,000 | ---D | C] -- C:\Windows\erdnt

[2013.02.13 19:53:15 | 005,032,105 | R--- | C] (Swearware) -- C:\Users\Alex\Desktop\ComboFix.exe

[2013.02.13 18:49:58 | 002,237,968 | ---- | C] (Kaspersky Lab ZAO) -- C:\Users\Alex\Desktop\tdsskiller.exe

[2013.02.11 21:14:49 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Alex\Desktop\OTL.exe

[2013.02.11 21:00:18 | 000,000,000 | ---D | C] -- C:\Users\Alex\AppData\Roaming\Malwarebytes

[2013.02.11 20:59:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2013.02.11 20:59:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2013.02.11 20:59:53 | 000,021,104 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys

[2013.02.11 20:59:53 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware

[2013.02.11 20:59:08 | 010,156,344 | ---- | C] (Malwarebytes Corporation                                    ) -- C:\Users\Alex\Desktop\mbam-setup-1.70.0.1100.exe

[2013.02.11 19:05:49 | 000,000,000 | ---D | C] -- C:\Program Files\PC Tools

[2013.02.11 18:58:32 | 000,202,280 | ---- | C] (PC Tools) -- C:\Windows\System32\drivers\PCTSD.sys

[2013.02.11 18:58:32 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\PC Tools

[2013.02.11 18:57:52 | 000,000,000 | ---D | C] -- C:\ProgramData\TEMP

[2013.02.11 18:57:49 | 000,000,000 | ---D | C] -- C:\ProgramData\PC Tools

[2013.02.11 18:57:48 | 000,000,000 | ---D | C] -- C:\Users\Alex\AppData\Roaming\TestApp

[2013.02.11 18:57:25 | 004,125,336 | ---- | C] (PC Tools) -- C:\Users\Alex\Desktop\PCTools_Safe_Install_SD.exe

[2013.02.09 14:29:38 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox

[2013.02.09 14:12:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Wincert

[2013.01.28 18:45:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype

[2013.01.28 18:45:24 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Skype

[2013.01.28 18:45:23 | 000,000,000 | R--D | C] -- C:\Program Files\Skype

[2013.01.18 17:33:04 | 000,000,000 | ---D | C] -- C:\Users\Alex\Desktop\UNS

[2010.03.12 03:28:59 | 001,100,664 | ---- | C] (Microsoft Corporation) -- C:\Users\Alex\setup.exe

 
 ========== Files - Modified Within 30 Days ==========

 

[2013.02.14 18:17:57 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job

[2013.02.14 18:17:53 | 000,691,568 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe

[2013.02.14 18:17:53 | 000,071,024 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl

[2013.02.14 18:05:48 | 000,012,872 | ---- | M] (SurfRight B.V.) -- C:\Windows\System32\bootdelete.exe

[2013.02.14 18:05:48 | 000,000,234 | ---- | M] () -- C:\Windows\System32\bootdelete.lst

[2013.02.14 17:53:39 | 000,001,892 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader X.lnk

[2013.02.14 17:48:06 | 008,984,048 | ---- | M] (SurfRight B.V.) -- C:\Users\Alex\Desktop\HitmanPro.exe

[2013.02.14 17:30:10 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

[2013.02.14 17:29:53 | 000,001,949 | ---- | M] () -- C:\Users\Public\Desktop\PC Tools Spyware Doctor.lnk

[2013.02.14 17:22:27 | 002,524,031 | ---- | M] () -- C:\Windows\System32\drivers\Cat.DB

[2013.02.14 17:18:03 | 000,001,090 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job

[2013.02.14 17:18:02 | 000,003,664 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0

[2013.02.14 17:18:02 | 000,003,664 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0

[2013.02.14 17:17:54 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2013.02.14 17:15:51 | 000,000,957 | ---- | M] () -- C:\Windows\DeleteOnReboot.bat

[2013.02.13 22:23:03 | 000,000,804 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk

[2013.02.13 22:21:50 | 004,189,792 | ---- | M] (Piriform Ltd) -- C:\Users\Alex\Desktop\ccsetup327.exe

[2013.02.13 21:29:26 | 000,390,472 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT

[2013.02.13 21:16:41 | 000,628,746 | ---- | M] () -- C:\Windows\System32\perfh007.dat

[2013.02.13 21:16:41 | 000,596,000 | ---- | M] () -- C:\Windows\System32\perfh009.dat

[2013.02.13 21:16:41 | 000,104,074 | ---- | M] () -- C:\Windows\System32\perfc009.dat

[2013.02.13 21:16:40 | 000,126,264 | ---- | M] () -- C:\Windows\System32\perfc007.dat

[2013.02.13 20:36:50 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts

[2013.02.13 19:53:39 | 005,032,105 | R--- | M] (Swearware) -- C:\Users\Alex\Desktop\ComboFix.exe

[2013.02.13 18:49:59 | 002,237,968 | ---- | M] (Kaspersky Lab ZAO) -- C:\Users\Alex\Desktop\tdsskiller.exe

[2013.02.13 16:45:38 | 000,587,671 | ---- | M] () -- C:\Users\Alex\Desktop\adwcleaner0.exe

[2013.02.12 20:06:29 | 000,002,623 | ---- | M] () -- C:\Users\Alex\Desktop\Microsoft Word.lnk

[2013.02.11 21:46:39 | 000,365,568 | ---- | M] () -- C:\Users\Alex\Desktop\gmer_2.0.18454.exe

[2013.02.11 21:14:50 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Alex\Desktop\OTL.exe

[2013.02.11 21:14:36 | 000,050,477 | ---- | M] () -- C:\Users\Alex\Desktop\Defogger.exe

[2013.02.11 20:59:56 | 000,000,906 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2013.02.11 20:59:19 | 010,156,344 | ---- | M] (Malwarebytes Corporation                                    ) -- C:\Users\Alex\Desktop\mbam-setup-1.70.0.1100.exe

[2013.02.11 20:36:15 | 000,000,000 | ---- | M] () -- C:\Users\Alex\defogger_reenable

[2013.02.11 18:57:36 | 004,125,336 | ---- | M] (PC Tools) -- C:\Users\Alex\Desktop\PCTools_Safe_Install_SD.exe

[2013.02.06 21:12:21 | 000,861,088 | ---- | M] (Oracle Corporation) -- C:\Windows\System32\npdeployJava1.dll

[2013.02.06 21:12:21 | 000,782,240 | ---- | M] (Oracle Corporation) -- C:\Windows\System32\deployJava1.dll

[2013.01.18 17:34:59 | 000,014,663 | ---- | M] () -- C:\Users\Alex\Desktop\20130118 Stromrechnung.pdf

[2013.01.17 01:28:58 | 000,232,336 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\MpSigStub.exe

 
 ========== Files Created - No Company Name ==========

 

[2013.02.14 18:17:57 | 000,000,884 | ---- | C] () -- C:\Windows\tasks\Adobe Flash Player Updater.job

[2013.02.14 18:05:48 | 000,000,234 | ---- | C] () -- C:\Windows\System32\bootdelete.lst

[2013.02.14 17:53:39 | 000,001,892 | ---- | C] () -- C:\Users\Public\Desktop\Adobe Reader X.lnk

[2013.02.14 17:53:38 | 000,001,804 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk

[2013.02.14 17:33:40 | 000,769,144 | ---- | C] () -- C:\Windows\BDTSupport.dll

[2013.02.14 17:33:40 | 000,000,882 | ---- | C] () -- C:\Windows\RegSDImport.xml

[2013.02.14 17:33:40 | 000,000,879 | ---- | C] () -- C:\Windows\RegISSImport.xml

[2013.02.14 17:33:39 | 000,003,488 | ---- | C] () -- C:\Windows\UDB.zip

[2013.02.14 17:33:39 | 000,000,131 | ---- | C] () -- C:\Windows\IDB.zip

[2013.02.14 17:29:53 | 000,001,949 | ---- | C] () -- C:\Users\Public\Desktop\PC Tools Spyware Doctor.lnk

[2013.02.13 22:23:03 | 000,000,804 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk

[2013.02.13 20:27:44 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe

[2013.02.13 20:27:44 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe

[2013.02.13 20:27:44 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe

[2013.02.13 20:27:44 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe

[2013.02.13 20:27:44 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe

[2013.02.13 16:45:37 | 000,587,671 | ---- | C] () -- C:\Users\Alex\Desktop\adwcleaner0.exe

[2013.02.12 20:25:55 | 000,000,957 | ---- | C] () -- C:\Windows\DeleteOnReboot.bat

[2013.02.11 21:46:38 | 000,365,568 | ---- | C] () -- C:\Users\Alex\Desktop\gmer_2.0.18454.exe

[2013.02.11 21:14:35 | 000,050,477 | ---- | C] () -- C:\Users\Alex\Desktop\Defogger.exe

[2013.02.11 20:59:56 | 000,000,906 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2013.02.11 20:36:15 | 000,000,000 | ---- | C] () -- C:\Users\Alex\defogger_reenable

[2013.02.11 18:58:41 | 002,524,031 | ---- | C] () -- C:\Windows\System32\drivers\Cat.DB

[2013.01.18 17:34:58 | 000,014,663 | ---- | C] () -- C:\Users\Alex\Desktop\20130118 Stromrechnung.pdf

[2012.06.10 14:22:50 | 000,000,041 | -HS- | C] () -- C:\ProgramData\.zreglib

[2012.05.28 16:32:14 | 000,003,861 | ---- | C] () -- C:\Users\Alex\.TransferManager.db

[2012.05.14 21:00:09 | 000,005,632 | ---- | C] () -- C:\Windows\System32\drivers\StarOpen.sys

[2012.04.26 08:29:48 | 000,116,224 | ---- | C] () -- C:\Windows\System32\redmonnt.dll

[2012.04.26 08:29:48 | 000,045,056 | ---- | C] () -- C:\Windows\System32\unredmon.exe

[2012.04.24 12:21:09 | 000,010,639 | ---- | C] () -- C:\Users\Alex\Benjamin_elster_2048.pfx

[2012.04.24 10:47:04 | 000,010,639 | ---- | C] () -- C:\Users\Alex\ReginaPf_elster_2048.pfx

[2012.04.07 16:31:42 | 000,091,930 | ---- | C] () -- C:\Users\Alex\ESt2011_Pfarr_Regina.elfo

[2012.03.16 21:56:36 | 000,047,104 | ---- | C] () -- C:\Windows\System32\AntUsbCIv2.dll

[2011.12.25 18:33:05 | 000,000,040 | ---- | C] () -- C:\Users\Alex\AppData\Roaming\cdr.ini

[2011.07.20 08:52:48 | 000,026,999 | ---- | C] () -- C:\Windows\DIIUnin.dat

[2011.07.06 17:27:53 | 000,097,961 | ---- | C] () -- C:\Users\Alex\ESt2010 Regina Pfarr.elfo

[2011.01.22 15:54:07 | 000,006,447 | -HS- | C] () -- C:\Users\Alex\Folder.jpg

[2011.01.22 15:54:07 | 000,001,928 | -HS- | C] () -- C:\Users\Alex\AlbumArtSmall.jpg

[2010.07.19 18:54:49 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat

[2008.07.12 20:19:26 | 000,000,015 | ---- | C] () -- C:\Users\Alex\ho.dir

[2008.04.21 20:08:41 | 000,007,484 | ---- | C] () -- C:\Users\Alex\AppData\Local\d3d9caps.dat

[2008.02.23 11:39:36 | 000,021,504 | ---- | C] () -- C:\Users\Alex\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

 
 ========== ZeroAccess Check ==========

 

[2006.11.02 13:54:22 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

 

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

 

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

"" = %SystemRoot%\system32\shell32.dll -- [2012.06.08 18:47:00 | 011,586,048 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Apartment

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]

"" = %systemroot%\system32\wbem\fastprox.dll -- [2009.04.11 07:28:19 | 000,614,912 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Free

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

"" = %systemroot%\system32\wbem\wbemess.dll -- [2009.04.11 07:28:25 | 000,347,648 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Both

 
 ========== Alternate Data Streams ==========

 

@Alternate Data Stream - 194 bytes -> C:\ProgramData\TEMP:DFC5A2B2

@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:430C6D84
 

< End of report >

--- --- ---

otl fix

Fixen mit OTL

Starte bitte die OTL.exe.
Kopiere nun den Inhalt aus der Codebox in die Textbox.

Code:

:OTL

IE - HKCU\..\URLSearchHook:  - No CLSID value found

IE - HKCU\..\SearchScopes\{440CF5EA-8546-4F9F-AC64-64313173BB5A}: "URL" = hxxp://websearch.ask.com/redirect?client=ietb=ORJo=src=kwq={searchTerms}locale=apn_ptnrs=apn_dtid=OSJ000apn_uid=05DFAD36-9F5F-4168-AF00-71A255E82C0Aapn_sauid=32751371-0662-4686-BCC8-96017E7D7992

IE - HKCU\..\SearchScopes\{BE9654C9-9D79-42ec-B55A-3CAEB12DBF58}: "URL" = hxxp://www.icq.com/search/results.php?q={searchTerms}ch_id=osd

FF - prefs.js..browser.search.defaultthis.engineName: "Search"

[2008.08.22 07:56:25 | 000,000,950 | ---- | M] () -- C:\Users\Alex\AppData\Roaming\mozilla\firefox\profiles\3osy0i74.default\searchplugins\icqplugin-13.xml

[2008.08.22 08:21:29 | 000,000,950 | ---- | M] () -- C:\Users\Alex\AppData\Roaming\mozilla\firefox\profiles\3osy0i74.default\searchplugins\icqplugin-14.xml

[2008.08.22 10:17:23 | 000,000,950 | ---- | M] () -- C:\Users\Alex\AppData\Roaming\mozilla\firefox\profiles\3osy0i74.default\searchplugins\icqplugin-15.xml

[2008.08.22 19:53:53 | 000,000,950 | ---- | M] () -- C:\Users\Alex\AppData\Roaming\mozilla\firefox\profiles\3osy0i74.default\searchplugins\icqplugin-16.xml

[2008.03.04 23:50:27 | 000,000,950 | ---- | M] () -- C:\Users\Alex\AppData\Roaming\mozilla\firefox\profiles\3osy0i74.default\searchplugins\icqplugin-4.xml

[2008.03.06 11:37:26 | 000,000,950 | ---- | M] () -- C:\Users\Alex\AppData\Roaming\mozilla\firefox\profiles\3osy0i74.default\searchplugins\icqplugin-5.xml

[2008.03.22 05:52:10 | 000,000,950 | ---- | M] () -- C:\Users\Alex\AppData\Roaming\mozilla\firefox\profiles\3osy0i74.default\searchplugins\icqplugin-6.xml

[2008.03.27 10:17:32 | 000,000,950 | ---- | M] () -- C:\Users\Alex\AppData\Roaming\mozilla\firefox\profiles\3osy0i74.default\searchplugins\icqplugin-7.xml

[2008.06.05 08:34:01 | 000,000,950 | ---- | M] () -- C:\Users\Alex\AppData\Roaming\mozilla\firefox\profiles\3osy0i74.default\searchplugins\icqplugin-8.xml

[2013.02.09 14:29:39 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Programme\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}

CHR - plugin: Unity Player (Enabled) = C:\Users\Alex\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll

O2 - BHO: (no name) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - No CLSID value found

O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll File not found

O8 - Extra context menu item: An OneNote senden - res://C:\PROGRA~1\MICROS~2\Office14\ONBttnIE.dll/105 File not found

O8 - Extra context menu item: Nach Microsoft Excel exportieren - res://C:\PROGRA~1\MICROS~2\Office14\EXCEL.EXE/3000 File not found

[2013.02.09 14:12:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Wincert

:files

:Commands

[emptytemp]

Solltest du deinen Benutzernamen z. B. durch "*****" unkenntlich gemacht haben, so füge an entsprechender Stelle deinen richtigen Benutzernamen ein. Andernfalls wird der Fix nicht funktionieren.
Schließe bitte nun alle Programme.
Klicke nun bitte auf den Fix Button.
OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
Nach dem Neustart findest Du ein Textdokument auf deinem Desktop.
( Auch zu finden unter C:\_OTL\MovedFiles\<Uhrzeit_Datum>.txt)
Kopiere nun den Inhalt hier in Deinen Thread

starte neu, teste, wie PC + Programme laufen, auch den IE mittesten, (auf Umleitungen, ungewollte Toolbars) etc

All processes killed
========== OTL ==========
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{440CF5EA-8546-4F9F-AC64-64313173BB5A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{440CF5EA-8546-4F9F-AC64-64313173BB5A}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{BE9654C9-9D79-42ec-B55A-3CAEB12DBF58}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BE9654C9-9D79-42ec-B55A-3CAEB12DBF58}\ not found.
Prefs.js: "Search" removed from browser.search.defaultthis.engineName
C:\Users\Alex\AppData\Roaming\mozilla\firefox\profiles\3osy0i74.default\searchplugins\icqplugin-13.xml moved successfully.
C:\Users\Alex\AppData\Roaming\mozilla\firefox\profiles\3osy0i74.default\searchplugins\icqplugin-14.xml moved successfully.
C:\Users\Alex\AppData\Roaming\mozilla\firefox\profiles\3osy0i74.default\searchplugins\icqplugin-15.xml moved successfully.
C:\Users\Alex\AppData\Roaming\mozilla\firefox\profiles\3osy0i74.default\searchplugins\icqplugin-16.xml moved successfully.
C:\Users\Alex\AppData\Roaming\mozilla\firefox\profiles\3osy0i74.default\searchplugins\icqplugin-4.xml moved successfully.
C:\Users\Alex\AppData\Roaming\mozilla\firefox\profiles\3osy0i74.default\searchplugins\icqplugin-5.xml moved successfully.
C:\Users\Alex\AppData\Roaming\mozilla\firefox\profiles\3osy0i74.default\searchplugins\icqplugin-6.xml moved successfully.
C:\Users\Alex\AppData\Roaming\mozilla\firefox\profiles\3osy0i74.default\searchplugins\icqplugin-7.xml moved successfully.
C:\Users\Alex\AppData\Roaming\mozilla\firefox\profiles\3osy0i74.default\searchplugins\icqplugin-8.xml moved successfully.
C:\Programme\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\search_engine folder moved successfully.
C:\Programme\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\META-INF folder moved successfully.
C:\Programme\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\defaults\preferences folder moved successfully.
C:\Programme\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\defaults folder moved successfully.
C:\Programme\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\components folder moved successfully.
C:\Programme\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome folder moved successfully.
C:\Programme\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07} folder moved successfully.
File C:\Users\Alex\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DBC80044-A445-435b-BC74-9C25C1C588A9}\ deleted successfully.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\An OneNote senden\ not found.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Nach Microsoft Excel exportieren\ not found.
C:\ProgramData\Wincert folder moved successfully.
========== FILES ==========
========== COMMANDS ==========

[EMPTYTEMP]

User: Alex
->Temp folder emptied: 8376962 bytes
->Temporary Internet Files folder emptied: 803390 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 8662763 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 711 bytes

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 15100437 bytes
RecycleBin emptied: 91710 bytes

Total Files Cleaned = 32,00 mb

OTL by OldTimer - Version 3.2.69.0 log created on 02142013_191728

Files\Folders moved on Reboot...

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

hi
Test bitte nicht vergessen.

Zitat:

Zitat von markusg (Beitrag 1012099)

hi
Test bitte nicht vergessen.

Bin doch dabei gewesen. :)

Es öffnet sich keine ungewollte Seite, die Startseite ist unangetastet und neue Tabs starten blank wie sie sollen. Einzig icq-search ist beim Mozilla neben google bei den Suchmaschinen eingetragen. Das macht mich ein wenig stutzig. Bei Chrome habe ich nichts festestellen können und im IE kenn ich mich nicht wirklich aus, zumindest Tabs öffnen sich normal und es ist auch sonst nichts aufgefallen.

kannst du mal in die Firefox Adressleiste gehen, dort tippe:
about:config
enter.
ich werde Vorsichtig sein, anhaken.
dann in das Suchfeld eingeben:
icq
enter
wenn jetzt ein Eintrag gefunden wird, rechtsklick, kopieren, undhier einfügen
dann weiter suchen.

Achtung, es wird warscheinlich wieder der Erste Eintrag auftauchen, also jetzt 2mal enter.
So lange, bis es keine mehr gibt.