Beiträge von heihaclau

heihaclau

Vielen Dank für eure Mühe

heihaclau

Hab die Bank informiert, das Onlinebanking wurde vorerst deaktiviert. Die Gefahr sei jedoch in meinem Falle nicht so gross, da ich mit HBCI und nicht mit Pins und Tans arbeite, so die Info.

heihaclau

Malwarebytes hab ich auf eure Anweisung laufen lassen. Das war leider bevor du deine Anweisungen gegeben hast.
Der Rechner gehört mir und nicht meinen Eltern, bin 62 Jahre alt und durfte ihn auch ohne Erlaubnis meiner Eltern kaufen.
Mit dem Rechner habe ich biser auch Homebanking ausgeführt und habe das jetzt eingestellt bis alles geklärt ist.
Im Forum kann ich nur lesen und schreiben wenn ich online bin, dazwischen schalte ich aus.

heihaclau

Die beiden Datein wurden von Malwarebytes entfernt

heihaclau

Das war vor dem OTL-Log

heihaclau

Hier das Ergebnis von Malwarebytes:
Malwarebytes' Anti-Malware 1.51.1.1800
http://www.malwarebytes.org

Datenbank Version: 7424

Windows 6.0.6002 Service Pack 2
Internet Explorer 9.0.8112.16421

10.08.2011 10:49:39
mbam-log-2011-08-10 (10-49-09).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Durchsuchte Objekte: 325640
Laufzeit: 2 Stunde(n), 26 Minute(n), 15 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 1
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 2
Infizierte Dateien: 3

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{72558D48-6DC0-5E4E-9F81-81EF86D8A8BF} (Trojan.ZbotR.Gen) -> Value: {72558D48-6DC0-5E4E-9F81-81EF86D8A8BF} -> No action taken.

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
c:\extensions.exe (Spyware.SpyEyes) -> No action taken.
c:\yusedehxxx.exe (Trojan.SpyEyes.Gen) -> No action taken.

Infizierte Dateien:
c:\$RECYCLE.BIN\s-1-5-21-2002189524-2703132424-193401257-1000\$R74PROF.exe (PUP.PSWFinder) -> No action taken.
c:\extensions.exe\config.bin (Spyware.SpyEyes) -> No action taken.
c:\yusedehxxx.exe\config.bin (Trojan.SpyEyes.Gen) -> No action taken.

heihaclau

Soll ich die host-Datei unter windwos-system32-drivers-ect-host gesamt löschen. Die Löschung im Editor geht nicht, da sich nach der Löschung nicht speichern lässt, Fehlermeldung Dateipfad nicht gefunden

heihaclau

Habe aber inzwischen mal ne Systemwiederherstellung von einem früheren SWH-Punkt versucht.

heihaclau

Das Programm ConduitEngine ist in der Systemsteuerung/Programme nicht aufgeführt.
Es wurde alles mit diesem Rechner unter gleicher Anmeldung gemacht.

heihaclau

Bin wahrscheinlich zu blöd, weiß immer noch nicht wies geht. Muß ich die Datei Olt.Txt kopieren und bei code einfügen oder was muß ich tun?

heihaclau

wie geht das denn?

heihaclau

Code

Logbuch OLT:
OTL logfile created on: 10.08.2011 07:27:33 - Run 1
OTL by OldTimer - Version 3.2.26.1     Folder = C:\Users\Bergwacht\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,96 Gb Total Physical Memory | 1,10 Gb Available Physical Memory | 37,14% Memory free
6,13 Gb Paging File | 4,51 Gb Available in Paging File | 73,62% Paging File free
Paging file location(s): C:\pagefile.sys 0 0 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 235,82 Gb Total Space | 65,82 Gb Free Space | 27,91% Space Free | Partition Type: NTFS
Drive D: | 465,76 Gb Total Space | 150,41 Gb Free Space | 32,29% Space Free | Partition Type: NTFS
Drive F: | 228,48 Gb Total Space | 213,37 Gb Free Space | 93,39% Space Free | Partition Type: NTFS
 
Computer Name: BERGWACHT-PC | User Name: Bergwacht | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
[color=#E56717]========== Processes (SafeList) ==========[/color]
 
PRC - C:\Users\Bergwacht\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Software4u\iPhone Explorer\Software4u.IPELauncher.exe (Marx Softwareentwicklung - http://www.software4u.de)
PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Programme\Lavasoft\Ad-Aware\AAWTray.exe (Lavasoft Limited)
PRC - C:\Programme\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft Limited)
PRC - C:\Programme\PDF24\pdf24.exe (Geek Software GmbH)
PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Programme\Netzmanager\netzmanager.exe (Deutsche Telekom AG)
PRC - C:\Programme\Netzmanager\NMInfraIS2\Netzmanager_Service.exe (Deutsche Telekom AG)
PRC - C:\Windows\System32\sdclt.exe (Microsoft Corporation)
PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Programme\Alwil Software\Avast5\AvastUI.exe (AVAST Software)
PRC - C:\Programme\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
PRC - C:\Programme\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation)
PRC - C:\Programme\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Windows\System32\audiodg.exe (Microsoft Corporation)
PRC - C:\Programme\Toshiba\ConfigFree\CFSvcs.exe (TOSHIBA CORPORATION)
PRC - C:\Programme\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe (TOSHIBA Corporation)
PRC - C:\Programme\Toshiba\Power Saver\TosCoSrv.exe (TOSHIBA Corporation)
PRC - C:\Programme\Microsoft Office\Office12\GrooveMonitor.exe (Microsoft Corporation)
PRC - c:\Programme\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe (TOSHIBA CORPORATION)
PRC - C:\Programme\Toshiba\SmartFaceV\SmartFaceVWatchSrv.exe (Toshiba)
PRC - C:\Programme\FreePDF_XP\fpassist.exe (shbox.de)
PRC - C:\Programme\Toshiba\SMARTLogService\TosIPCSrv.exe (TOSHIBA Corporation)
PRC - C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)
PRC - C:\Programme\Windows Defender\MSASCui.exe (Microsoft Corporation)
PRC - C:\Windows\System32\TODDSrv.exe (TOSHIBA Corporation)
PRC - C:\Programme\O2Micro Flash Memory Card Driver\o2flash.exe (O2Micro International)
PRC - C:\Windows\System32\PSIService.exe ()
PRC - C:\Programme\Apoint2K\hidfind.exe (Alps Electric Co., Ltd.)
PRC - C:\Windows\System32\StkASv2K.exe (Syntek America Inc.)
 
 
[color=#E56717]========== Modules (SafeList) ==========[/color]
 
MOD - C:\Users\Bergwacht\Downloads\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll (Microsoft Corporation)
 
 
[color=#E56717]========== Win32 Services (SafeList) ==========[/color]
 
SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (Lavasoft Ad-Aware Service) -- C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft Limited)
SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (Sony Ericsson PCCompanion) -- C:\Program Files\Sony Ericsson\Sony Ericsson PC Companion\PCCService.exe (Avanquest Software)
SRV - (Netzmanager Service) -- C:\Program Files\Netzmanager\NMInfraIS2\Netzmanager_Service.exe (Deutsche Telekom AG)
SRV - (avast! Web Scanner) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
SRV - (avast! Mail Scanner) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
SRV - (avast! Antivirus) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
SRV - (TemproMonitoringService) Notebook Performance Tuning Service (TEMPRO) -- C:\Program Files\Toshiba TEMPRO\TemproSvc.exe (Toshiba Europe GmbH)
SRV - (ConfigFree Service) -- C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe (TOSHIBA CORPORATION)
SRV - (TNaviSrv) -- C:\Programme\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe (TOSHIBA Corporation)
SRV - (TosCoSrv) -- C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe (TOSHIBA Corporation)
SRV - (TOSHIBA Bluetooth Service) -- c:\Programme\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe (TOSHIBA CORPORATION)
SRV - (SmartFaceVWatchSrv) -- C:\Program Files\Toshiba\SmartFaceV\SmartFaceVWatchSrv.exe (Toshiba)
SRV - (TOSHIBA SMART Log Service) -- C:\Program Files\TOSHIBA\SMARTLogService\TosIPCSrv.exe (TOSHIBA Corporation)
SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (TODDSrv) -- C:\Windows\System32\TODDSrv.exe (TOSHIBA Corporation)
SRV - (o2flash) -- C:\Program Files\O2Micro Flash Memory Card Driver\o2flash.exe (O2Micro International)
SRV - (ProtexisLicensing) -- C:\Windows\System32\PSIService.exe ()
SRV - (StkASSrv) -- C:\Windows\System32\StkASv2K.exe (Syntek America Inc.)
 
 
[color=#E56717]========== Driver Services (SafeList) ==========[/color]
 
DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH)
DRV - (Lavasoft Kernexplorer) -- C:\Programme\Lavasoft\Ad-Aware\kernexplorer.sys ()
DRV - (sptd) -- C:\Windows\System32\Drivers\sptd.sys ()
DRV - (TelekomNM3) -- C:\Programme\Netzmanager\NMInfraIS2\Driver\TelekomNM3.sys (Deutsche Telekom AG AG, Marmiko IT-Solutions GmbH)
DRV - (aswTdi) -- C:\Windows\System32\drivers\aswTdi.sys (AVAST Software)
DRV - (aswSP) -- C:\Windows\System32\drivers\aswSP.sys (AVAST Software)
DRV - (aswRdr) -- C:\Windows\System32\drivers\aswRdr.sys (AVAST Software)
DRV - (aswMonFlt) -- C:\Windows\System32\drivers\aswMonFlt.sys (AVAST Software)
DRV - (aswFsBlk) -- C:\Windows\System32\drivers\aswFsBlk.sys (AVAST Software)
DRV - (Lbd) -- C:\Windows\system32\DRIVERS\Lbd.sys (Lavasoft AB)
DRV - (mchInjDrv) -- C:\Windows\System32\drivers\mchInjDrv.sys ()
DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (GigasetGenericUSB) -- C:\Windows\System32\drivers\GigasetGenericUSB.sys (Siemens Home and Office Communication Devices GmbH & Co. KG)
DRV - (avgio) -- C:\Programme\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)
DRV - (CnxtHdAudService) -- C:\Windows\System32\drivers\CHDRT32.sys (Conexant Systems Inc.)
DRV - (atikmdag) -- C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (Point32) -- C:\Windows\System32\drivers\point32k.sys (Microsoft Corporation)
DRV - (NETw5v32) Intel(R) -- C:\Windows\System32\drivers\NETw5v32.sys (Intel Corporation)
DRV - (tos_sps32) -- C:\Windows\system32\DRIVERS\tos_sps32.sys (TOSHIBA Corporation)
DRV - (Tosrfusb) -- C:\Windows\System32\drivers\tosrfusb.sys (TOSHIBA CORPORATION)
DRV - (TosRfSnd) -- C:\Windows\System32\drivers\TosRfSnd.sys (TOSHIBA Corporation)
DRV - (Tosrfhid) -- C:\Windows\System32\drivers\Tosrfhid.sys (TOSHIBA Corporation.)
DRV - (Tosrfcom) -- C:\Windows\System32\drivers\tosrfcom.sys (TOSHIBA Corporation)
DRV - (tosrfbd) -- C:\Windows\System32\drivers\tosrfbd.sys (TOSHIBA CORPORATION)
DRV - (UVCFTR) -- C:\Windows\System32\drivers\UVCFTR_S.SYS (Chicony Electronics Co., Ltd.)
DRV - (s0016unic) Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (WDM) -- C:\Windows\System32\drivers\s0016unic.sys (MCCI Corporation)
DRV - (s0016nd5) Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (NDIS) -- C:\Windows\System32\drivers\s0016nd5.sys (MCCI Corporation)
DRV - (s0016mdfl) -- C:\Windows\System32\drivers\s0016mdfl.sys (MCCI Corporation)
DRV - (s0016mdm) -- C:\Windows\System32\drivers\s0016mdm.sys (MCCI Corporation)
DRV - (s0016mgmt) Sony Ericsson Device 0016 USB WMC Device Management Drivers (WDM) -- C:\Windows\System32\drivers\s0016mgmt.sys (MCCI Corporation)
DRV - (s0016obex) -- C:\Windows\System32\drivers\s0016obex.sys (MCCI Corporation)
DRV - (s0016bus) Sony Ericsson Device 0016 driver (WDM) -- C:\Windows\System32\drivers\s0016bus.sys (MCCI Corporation)
DRV - (O2MDRDR) -- C:\Windows\System32\drivers\o2media.sys (O2Micro )
DRV - (tosporte) -- C:\Windows\System32\drivers\tosporte.sys (TOSHIBA Corporation)
DRV - (seehcri) -- C:\Windows\System32\drivers\seehcri.sys (Sony Ericsson Mobile Communications)
DRV - (tdcmdpst) -- C:\Windows\System32\drivers\tdcmdpst.sys (TOSHIBA Corporation.)
DRV - (tosrfbnp) -- C:\Windows\System32\drivers\tosrfbnp.sys (TOSHIBA Corporation)
DRV - (ApfiltrService) -- C:\Windows\System32\drivers\Apfiltr.sys (Alps Electric Co., Ltd.)
DRV - (TVALZ) -- C:\Windows\system32\DRIVERS\TVALZ_O.SYS (TOSHIBA Corporation)
DRV - (XAudio) -- C:\Windows\System32\drivers\XAudio.sys (Conexant Systems, Inc.)
DRV - (QIOMem) -- C:\Windows\System32\drivers\QIOMem.sys (TOSHIBA)
DRV - (tosrfec) -- C:\Windows\System32\drivers\tosrfec.sys (TOSHIBA Corporation)
DRV - (StkAMini) -- C:\Windows\System32\drivers\StkAMini.sys (Syntek America Inc.)
DRV - (StkScan) -- C:\Windows\System32\drivers\StkScan.sys (Syntek America Inc.)
DRV - (tosrfnds) -- C:\Windows\System32\drivers\tosrfnds.sys (TOSHIBA Corporation.)
 
 
[color=#E56717]========== Standard Registry (SafeList) ==========[/color]
 
 
[color=#E56717]========== Internet Explorer ==========[/color]
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com/ig/redirectdomain?brand=TSEA&bmod=TSEA
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/ig/redirectdomain?brand=TSEA&bmod=TSEA
IE - HKLM\..\URLSearchHook: {40c3cc16-7269-4b32-9531-17f2950fb06f} - C:\Programme\Winload\tbWinl.dll (Conduit Ltd.)
IE - HKLM\..\URLSearchHook: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\tbDVDV.dll (Conduit Ltd.)
IE - HKLM\..\URLSearchHook: {8dbb6d8e-e4a6-4e3b-9753-af78b226441c} - C:\Programme\Softonic_Deutsch\tbSof0.dll (Conduit Ltd.)
IE - HKLM\..\URLSearchHook: {e9911ec6-1bcc-40b0-9993-e0eea7f6953f} - C:\Programme\DVDVideoSoft\tbDVDV.dll (Conduit Ltd.)
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com/ig/redirectdomain?brand=TSEA&bmod=TSEA;
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = https://encrypted.google.com/webhp?hl=de#hl=de&cp=1&gs_id=4&xhr=t&q=bild&pf=p&sclient=psy&site=webhp&source=hp&pbx=1&oq=b&aq=0&aqi=g5&aql=&gs_sm=&gs_upl=&bav=on.2,or.r_gc.r_pw.&fp=23af041f066a1428&biw=1440&bih=807
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook: {40c3cc16-7269-4b32-9531-17f2950fb06f} - C:\Programme\Winload\tbWinl.dll (Conduit Ltd.)
IE - HKCU\..\URLSearchHook: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\tbDVDV.dll (Conduit Ltd.)
IE - HKCU\..\URLSearchHook: {8dbb6d8e-e4a6-4e3b-9753-af78b226441c} - C:\Programme\Softonic_Deutsch\tbSof0.dll (Conduit Ltd.)
IE - HKCU\..\URLSearchHook: {e9911ec6-1bcc-40b0-9993-e0eea7f6953f} - C:\Programme\DVDVideoSoft\tbDVDV.dll (Conduit Ltd.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
[color=#E56717]========== FireFox ==========[/color]
 
FF - prefs.js..browser.search.defaultthis.engineName: "SearchElf 1.2 Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2769726&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.selectedEngine: "SearchElf 1.2 Customized Web Search"
FF - prefs.js..browser.startup.homepage: "about:home"
FF - prefs.js..extensions.enabledItems: {e001c731-5e37-4538-a5cb-8168736a2360}:0.9.9.76
FF - prefs.js..extensions.enabledItems: {e9911ec6-1bcc-40b0-9993-e0eea7f6953f}:2.5.6.0
FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:1.0
FF - prefs.js..extensions.enabledItems: {4776510a-a1f4-41f3-a3c8-35b474ecef23}:1.0.8
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:5.0.0.6906
FF - prefs.js..extensions.enabledItems: {872b5b88-9db5-4310-bdd0-ac189557e5f5}:2.7.2.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: fdm_ffext@freedownloadmanager.org:1.3.4
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: engine@conduit.com:3.2.5.2
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: finder@meingutscheincode.de:2.0
FF - prefs.js..extensions.enabledItems: {40c3cc16-7269-4b32-9531-17f2950fb06f}:2.5.8.6
FF - prefs.js..extensions.enabledItems: {195A3098-0BD5-4e90-AE22-BA1C540AFD1E}:2.9.3
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..keyword.URL: "chrome://browser-region/locale/region.properties"
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@garmin.com/GpsControl: C:\Program Files\Garmin GPS Plugin\npGarmin.dll (GARMIN Corp.)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Picasa2\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pack.google.com/Google Updater;version=14: C:\Program Files\Google\Google Updater\2.4.1970.7372\npCIDetect14.dll (Google)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@doubletwist.com/NPPodcast: C:\Program Files\Common Files\doubleTwist\NPPodcast.dll File not found
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 5.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.08.09 15:35:33 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 5.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.08.09 13:33:55 | 000,000,000 | ---D | M]
 
[2011.08.09 15:35:41 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Bergwacht\AppData\Roaming\mozilla\Extensions
[2011.08.09 15:35:33 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2011.08.09 10:28:46 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2011.08.09 10:28:46 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2011.08.09 10:28:46 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2011.08.09 10:28:46 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2011.08.09 10:28:46 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
[2011.08.09 10:28:46 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
[2011.08.09 10:28:46 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}
File not found (No name found) -- 
[2009.09.01 18:21:14 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION
[2011.07.08 09:31:38 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2011.05.04 04:52:23 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2010.01.01 10:00:00 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2010.01.01 10:00:00 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2010.01.01 10:00:00 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2010.01.01 10:00:00 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2010.01.01 10:00:00 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2010.01.01 10:00:00 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2010.02.13 14:50:35 | 000,002,003 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1             localhost
O1 - Hosts: 78.46.249.74 google.com 
O1 - Hosts: 78.46.249.74 google.com.au 
O1 - Hosts: 78.46.249.74 http://www.google.com.au
O1 - Hosts: 78.46.249.74 google.be 
O1 - Hosts: 78.46.249.74 http://www.google.be
O1 - Hosts: 78.46.249.74 google.com.br 
O1 - Hosts: 78.46.249.74 http://www.google.com.br
O1 - Hosts: 78.46.249.74 google.ca 
O1 - Hosts: 78.46.249.74 http://www.google.ca
O1 - Hosts: 78.46.249.74 google.ch 
O1 - Hosts: 78.46.249.74 http://www.google.ch
O1 - Hosts: 78.46.249.74 google.de 
O1 - Hosts: 78.46.249.74 http://www.google.de
O1 - Hosts: 78.46.249.74 google.dk 
O1 - Hosts: 78.46.249.74 http://www.google.dk
O1 - Hosts: 78.46.249.74 google.fr 
O1 - Hosts: 78.46.249.74 http://www.google.fr
O1 - Hosts: 78.46.249.74 google.ie 
O1 - Hosts: 78.46.249.74 http://www.google.ie
O1 - Hosts: 78.46.249.74 google.it 
O1 - Hosts: 78.46.249.74 http://www.google.it
O1 - Hosts: 78.46.249.74 google.co.jp 
O1 - Hosts: 78.46.249.74 http://www.google.co.jp
O1 - Hosts: 23 more lines...
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Winload Toolbar) - {40c3cc16-7269-4b32-9531-17f2950fb06f} - C:\Programme\Winload\tbWinl.dll (Conduit Ltd.)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O2 - BHO: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\tbDVDV.dll (Conduit Ltd.)
O2 - BHO: (Softonic Deutsch Toolbar) - {8dbb6d8e-e4a6-4e3b-9753-af78b226441c} - C:\Programme\Softonic_Deutsch\tbSof0.dll (Conduit Ltd.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll (Google Inc.)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (FDMIECookiesBHO Class) - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Programme\Free Download Manager\iefdm2.dll ()
O2 - BHO: (DVDVideoSoft Toolbar) - {e9911ec6-1bcc-40b0-9993-e0eea7f6953f} - C:\Programme\DVDVideoSoft\tbDVDV.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Easy-WebPrint) - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Programme\Canon\Easy-WebPrint\Toolband.dll ()
O3 - HKLM\..\Toolbar: (Winload Toolbar) - {40c3cc16-7269-4b32-9531-17f2950fb06f} - C:\Programme\Winload\tbWinl.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\tbDVDV.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Softonic Deutsch Toolbar) - {8dbb6d8e-e4a6-4e3b-9753-af78b226441c} - C:\Programme\Softonic_Deutsch\tbSof0.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (DVDVideoSoft Toolbar) - {e9911ec6-1bcc-40b0-9993-e0eea7f6953f} - C:\Programme\DVDVideoSoft\tbDVDV.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (Winload Toolbar) - {40C3CC16-7269-4B32-9531-17F2950FB06F} - C:\Programme\Winload\tbWinl.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (DVDVideoSoftTB Toolbar) - {872B5B88-9DB5-4310-BDD0-AC189557E5F5} - C:\Programme\DVDVideoSoftTB\tbDVDV.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (Softonic Deutsch Toolbar) - {8DBB6D8E-E4A6-4E3B-9753-AF78B226441C} - C:\Programme\Softonic_Deutsch\tbSof0.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (DVDVideoSoft Toolbar) - {E9911EC6-1BCC-40B0-9993-E0EEA7F6953F} - C:\Programme\DVDVideoSoft\tbDVDV.dll (Conduit Ltd.)
O4 - HKLM..\Run: [avast5] C:\Programme\Alwil Software\Avast5\AvastUI.exe (AVAST Software)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [Corel Photo Downloader]  File not found
O4 - HKLM..\Run: [FreePDF Assistant] C:\Programme\FreePDF_XP\fpassist.exe (shbox.de)
O4 - HKLM..\Run: [PDFPrint] C:\Programme\PDF24\pdf24.exe (Geek Software GmbH)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [{72558D48-6DC0-5E4E-9F81-81EF86D8A8BF}]  File not found
O4 - HKCU..\Run: [doubleTwist]  File not found
O4 - HKCU..\Run: [iPhone Explorer Launcher] C:\Program Files\Software4u\iPhone Explorer\Software4u.IPELauncher.exe (Marx Softwareentwicklung - http://www.software4u.de)
O4 - HKCU..\Run: [WMPNSCFG] C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)
O4 - Startup: C:\Users\Bergwacht\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Netzmanager.lnk = C:\Programme\Netzmanager\netzmanager.exe (Deutsche Telekom AG)
O4 - Startup: C:\Users\Bergwacht\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk = C:\Programme\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation)
O4 - Startup: C:\Users\Bergwacht\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Transmiti.lnk =  File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 2
O8 - Extra context menu item: add to &BOM - C:\\PROGRA~1\\BIET-O~1\\\\AddToBOM.hta ()
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: Alles mit FDM herunterladen - C:\Program Files\Free Download Manager\dlall.htm ()
O8 - Extra context menu item: An OneNote s&enden - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O8 - Extra context menu item: Auswahl mit FDM herunterladen - C:\Program Files\Free Download Manager\dlselected.htm ()
O8 - Extra context menu item: Datei mit FDM herunterladen - C:\Program Files\Free Download Manager\dllink.htm ()
O8 - Extra context menu item: Easy-WebPrint Add To Print List - C:\Program Files\Canon\Easy-WebPrint\Resource.dll ()
O8 - Extra context menu item: Easy-WebPrint High Speed Print - C:\Program Files\Canon\Easy-WebPrint\Resource.dll ()
O8 - Extra context menu item: Easy-WebPrint Preview - C:\Program Files\Canon\Easy-WebPrint\Resource.dll ()
O8 - Extra context menu item: Easy-WebPrint Print - C:\Program Files\Canon\Easy-WebPrint\Resource.dll ()
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - C:\Programme\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Videos mit FDM herunterladen - C:\Program Files\Free Download Manager\dlfvideo.htm ()
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: eBay - Der weltweite Online Marktplatz - {76577871-04EC-495E-A12B-91F7C3600AFA} - Reg Error: Value error. File not found
O9 - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra Button: Amazon.de - {8A918C1D-E123-4E36-B562-5C1519E434CE} - Reg Error: Value error. File not found
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {3860DD98-0549-4D50-AA72-5D17D200EE10} http://cdn.scan.onecare.live.com/resource/download/scanner/de-at/wlscctrl2.cab (Windows Live OneCare safety scanner control)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (Reg Error: Key error.)
O16 - DPF: {82774781-8F4E-11D1-AB1C-0000F8773BF0} https://transfers.ds.microsoft.com/FTM/TransferSource/grTransferCtrl.cab (DLC Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programme\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Bergwacht\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O24 - Desktop BackupWallPaper: C:\Users\Bergwacht\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{70ecae66-71fe-11de-a7e0-00238bc738fb}\Shell\AutoRun\command - "" = PortableRoboForm.exe
O33 - MountPoints2\{9798f510-d28f-11df-8ff0-002258f361f3}\Shell - "" = AutoRun
O33 - MountPoints2\{9798f510-d28f-11df-8ff0-002258f361f3}\Shell\AutoRun\command - "" = H:\LaunchU3.exe -a
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O34 - HKLM BootExecute: (lsdelete) - C:\Windows\System32\lsdelete.exe ()
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
[color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color]
 
[2011.08.09 13:33:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
[2011.08.07 16:49:58 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox(48)
[2011.08.07 11:49:24 | 000,000,000 | ---D | C] -- C:\Program Files\Adobe(0)
[2011.07.26 09:43:51 | 000,157,472 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaws.exe
[2011.07.26 09:43:51 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaw.exe
[2011.07.26 09:43:51 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\java.exe
[2011.07.25 16:24:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2011.07.25 16:23:10 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[2011.07.25 16:20:33 | 000,000,000 | ---D | C] -- C:\Program Files\Bonjour
[2011.07.13 13:44:12 | 002,043,392 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2011.07.13 13:43:48 | 000,375,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\winsrv.dll
[2011.07.13 13:43:48 | 000,049,152 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\csrsrv.dll
[2011.07.12 11:20:54 | 000,083,816 | ---- | C] (Apple Inc.) -- C:\Windows\System32\dns-sd.exe
[2011.07.12 11:20:54 | 000,073,064 | ---- | C] (Apple Inc.) -- C:\Windows\System32\dnssd.dll
[2011.07.12 07:07:31 | 000,000,000 | ---D | C] -- C:\Program Files\Apple Software Update
[2009.07.10 11:20:56 | 000,148,736 | ---- | C] (Avanquest Software) -- C:\ProgramData\hpeD117.dll
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
[color=#E56717]========== Files - Modified Within 30 Days ==========[/color]
 
[2011.08.10 07:30:00 | 000,001,098 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011.08.10 07:30:00 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011.08.10 07:17:48 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011.08.10 07:17:48 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011.08.10 07:17:44 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011.08.09 23:18:52 | 000,001,022 | ---- | M] () -- C:\Windows\tasks\Google Software Updater.job
[2011.08.09 23:16:48 | 000,000,384 | ---- | M] () -- C:\Windows\tasks\Ad-Aware Update (Weekly).job
[2011.08.09 23:16:43 | 000,000,386 | ---- | M] () -- C:\Windows\tasks\Registry Reviver-Bergwacht-Startup.job
[2011.08.09 23:16:41 | 000,000,439 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts.ics
[2011.08.09 23:15:47 | 3184,369,664 | -HS- | M] () -- C:\hiberfil.sys
[2011.08.09 16:11:18 | 000,000,064 | ---- | M] () -- C:\Windows\System32\rp_stats.dat
[2011.08.09 16:11:18 | 000,000,044 | ---- | M] () -- C:\Windows\System32\rp_rules.dat
[2011.08.07 16:38:20 | 000,333,898 | ---- | M] () -- C:\Users\Bergwacht\AppData\Local\census.cache
[2011.08.07 16:37:41 | 000,214,947 | ---- | M] () -- C:\Users\Bergwacht\AppData\Local\ars.cache
[2011.08.07 16:18:39 | 000,000,036 | ---- | M] () -- C:\Users\Bergwacht\AppData\Local\housecall.guid.cache
[2011.08.03 14:30:40 | 000,001,150 | ---- | M] () -- C:\Users\Bergwacht\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk
[2011.07.24 14:24:09 | 000,674,456 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2011.07.24 14:24:09 | 000,634,540 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011.07.24 14:24:09 | 000,145,092 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2011.07.24 14:24:09 | 000,119,106 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011.07.15 14:12:44 | 000,001,356 | ---- | M] () -- C:\Users\Bergwacht\AppData\Local\d3d9caps.dat
[2011.07.15 08:45:48 | 000,398,176 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2011.07.13 14:44:28 | 000,050,176 | ---- | M] () -- C:\Users\Bergwacht\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.07.12 11:20:54 | 000,083,816 | ---- | M] (Apple Inc.) -- C:\Windows\System32\dns-sd.exe
[2011.07.12 11:20:54 | 000,073,064 | ---- | M] (Apple Inc.) -- C:\Windows\System32\dnssd.dll
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
[color=#E56717]========== Files Created - No Company Name ==========[/color]
 
[2011.08.09 17:00:37 | 000,000,384 | ---- | C] () -- C:\Windows\tasks\Ad-Aware Update (Weekly).job
[2011.08.09 10:30:48 | 3184,369,664 | -HS- | C] () -- C:\hiberfil.sys
[2011.08.07 16:38:20 | 000,333,898 | ---- | C] () -- C:\Users\Bergwacht\AppData\Local\census.cache
[2011.08.07 16:37:41 | 000,214,947 | ---- | C] () -- C:\Users\Bergwacht\AppData\Local\ars.cache
[2011.08.07 16:18:39 | 000,000,036 | ---- | C] () -- C:\Users\Bergwacht\AppData\Local\housecall.guid.cache
[2011.06.16 08:11:02 | 000,012,970 | ---- | C] () -- C:\Users\Bergwacht\AppData\Roaming\Microsoft Excel 97-2003.CAL
[2011.04.27 10:26:07 | 000,000,064 | ---- | C] () -- C:\Windows\System32\rp_stats.dat
[2011.04.27 10:26:07 | 000,000,044 | ---- | C] () -- C:\Windows\System32\rp_rules.dat
[2011.01.02 14:34:54 | 000,000,952 | -HS- | C] () -- C:\Windows\System32\KGyGaAvL.sys
[2010.12.09 15:02:48 | 000,000,127 | ---- | C] () -- C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc
[2010.12.08 18:51:03 | 000,000,126 | -HS- | C] () -- C:\ProgramData\.zreglib
[2010.10.13 11:47:37 | 000,084,480 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll
[2010.04.12 13:59:44 | 000,038,444 | ---- | C] () -- C:\Users\Bergwacht\AppData\Roaming\Kommagetrennte Werte (Windows).ADR
[2010.04.12 13:43:46 | 000,009,334 | ---- | C] () -- C:\Users\Bergwacht\AppData\Roaming\Kommagetrennte Werte (Windows).EML
[2010.04.02 18:44:47 | 000,001,356 | ---- | C] () -- C:\Users\Bergwacht\AppData\Local\d3d9caps.dat
[2010.03.26 09:31:01 | 000,059,392 | R--- | C] () -- C:\Windows\System32\streamhlp.dll
[2010.03.12 18:33:59 | 000,038,461 | ---- | C] () -- C:\Users\Bergwacht\AppData\Roaming\Microsoft Excel 97-2003.ADR
[2010.03.10 19:54:02 | 000,120,200 | ---- | C] () -- C:\Windows\System32\DLLDEV32i.dll
[2010.03.10 19:53:39 | 000,006,768 | ---- | C] () -- C:\Windows\mgxoschk.ini
[2010.03.02 18:10:10 | 000,015,873 | ---- | C] () -- C:\Windows\System32\Inetde.dll
[2010.02.18 16:05:19 | 000,002,560 | ---- | C] () -- C:\Windows\System32\drivers\mchInjDrv.sys
[2010.02.13 20:24:02 | 000,016,432 | ---- | C] () -- C:\Windows\System32\lsdelete.exe
[2009.09.11 11:38:42 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2009.09.11 11:38:42 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2009.09.01 09:09:58 | 000,000,073 | -HS- | C] () -- C:\Windows\System32\cs4060f8sie.dat
[2009.08.30 12:16:31 | 000,000,056 | -H-- | C] () -- C:\Windows\System32\ezsidmv.dat
[2009.08.03 15:07:42 | 000,403,816 | ---- | C] () -- C:\Windows\System32\OGACheckControl.dll
[2009.08.03 15:07:42 | 000,230,768 | ---- | C] () -- C:\Windows\System32\OGAEXEC.exe
[2009.07.18 15:25:26 | 000,000,772 | ---- | C] () -- C:\Windows\ODBCINST.INI
[2009.07.18 15:25:26 | 000,000,342 | ---- | C] () -- C:\Windows\ODBC.INI
[2009.07.16 13:07:34 | 000,013,924 | ---- | C] () -- C:\Users\Bergwacht\AppData\Roaming\UserTile.png
[2009.07.12 10:46:23 | 000,116,224 | ---- | C] () -- C:\Windows\System32\redmonnt.dll
[2009.07.12 10:46:23 | 000,045,056 | ---- | C] () -- C:\Windows\System32\unredmon.exe
[2009.07.09 18:56:52 | 000,000,398 | ---- | C] () -- C:\Windows\System32\CNCMP60.INI
[2009.07.09 13:09:09 | 000,050,176 | ---- | C] () -- C:\Users\Bergwacht\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009.04.15 08:47:27 | 000,204,800 | ---- | C] () -- C:\Windows\System32\IVIresizeW7.dll
[2009.04.15 08:47:27 | 000,200,704 | ---- | C] () -- C:\Windows\System32\IVIresizeA6.dll
[2009.04.15 08:47:27 | 000,192,512 | ---- | C] () -- C:\Windows\System32\IVIresizeP6.dll
[2009.04.15 08:47:27 | 000,192,512 | ---- | C] () -- C:\Windows\System32\IVIresizeM6.dll
[2009.04.15 08:47:27 | 000,188,416 | ---- | C] () -- C:\Windows\System32\IVIresizePX.dll
[2009.04.15 08:47:27 | 000,020,480 | ---- | C] () -- C:\Windows\System32\IVIresize.dll
[2009.04.15 08:37:52 | 000,000,000 | ---- | C] () -- C:\Windows\NDSTray.INI
[2009.04.15 08:08:17 | 000,128,113 | ---- | C] () -- C:\Windows\System32\csellang.ini
[2009.04.15 08:08:17 | 000,045,056 | ---- | C] () -- C:\Windows\System32\csellang.dll
[2009.04.15 08:08:17 | 000,009,480 | ---- | C] () -- C:\Windows\System32\tosmreg.ini
[2009.04.15 08:08:17 | 000,007,671 | ---- | C] () -- C:\Windows\System32\cseltbl.ini
[2009.04.15 08:03:23 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2009.04.15 06:40:48 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2009.04.15 06:26:53 | 000,002,280 | ---- | C] () -- C:\Windows\System32\drivers\CDConfig.bin
[2009.04.15 06:26:27 | 003,107,788 | ---- | C] () -- C:\Windows\System32\atiumdva.dat
[2009.04.15 06:26:27 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll
[2009.04.15 06:26:27 | 000,081,920 | ---- | C] () -- C:\Windows\System32\ATIODE.exe
[2009.04.15 06:26:27 | 000,045,056 | ---- | C] () -- C:\Windows\System32\ATIODCLI.exe
[2009.04.15 06:26:26 | 000,180,720 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat
[2008.01.21 09:15:58 | 000,674,456 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2008.01.21 09:15:58 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2008.01.21 09:15:58 | 000,145,092 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2008.01.21 09:15:58 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2006.11.02 21:40:12 | 000,174,656 | ---- | C] () -- C:\Windows\System32\PSIService.exe
[2006.11.02 14:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006.11.02 14:47:37 | 000,398,176 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006.11.02 12:33:01 | 000,634,540 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2006.11.02 12:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2006.11.02 12:33:01 | 000,119,106 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2006.11.02 12:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2006.11.02 12:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2006.11.02 10:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006.11.02 10:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006.11.02 09:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
 
[color=#E56717]========== LOP Check ==========[/color]
 
[2011.01.31 10:02:31 | 000,000,000 | ---D | M] -- C:\Users\Bergwacht\AppData\Roaming\Abelssoft
[2011.05.31 07:15:47 | 000,000,000 | ---D | M] -- C:\Users\Bergwacht\AppData\Roaming\Alpen3D
[2010.09.02 17:58:05 | 000,000,000 | ---D | M] -- C:\Users\Bergwacht\AppData\Roaming\BlueShot
[2010.03.10 04:15:57 | 000,000,000 | ---D | M] -- C:\Users\Bergwacht\AppData\Roaming\BOM
[2010.12.08 17:04:30 | 000,000,000 | ---D | M] -- C:\Users\Bergwacht\AppData\Roaming\Canneverbe Limited
[2011.08.03 12:27:21 | 000,000,000 | ---D | M] -- C:\Users\Bergwacht\AppData\Roaming\Canon
[2010.04.14 15:31:29 | 000,000,000 | ---D | M] -- C:\Users\Bergwacht\AppData\Roaming\CoSoSys
[2010.07.06 07:56:08 | 000,000,000 | ---D | M] -- C:\Users\Bergwacht\AppData\Roaming\Dropbox
[2010.12.10 09:08:46 | 000,000,000 | ---D | M] -- C:\Users\Bergwacht\AppData\Roaming\DVDVideoSoft
[2011.06.05 08:47:38 | 000,000,000 | ---D | M] -- C:\Users\Bergwacht\AppData\Roaming\elsterformular
[2010.07.15 16:25:08 | 000,000,000 | ---D | M] -- C:\Users\Bergwacht\AppData\Roaming\Erucda
[2011.01.31 10:13:04 | 000,000,000 | ---D | M] -- C:\Users\Bergwacht\AppData\Roaming\Foofer
[2011.08.09 18:04:13 | 000,000,000 | ---D | M] -- C:\Users\Bergwacht\AppData\Roaming\Free Download Manager
[2010.04.24 09:27:28 | 000,000,000 | ---D | M] -- C:\Users\Bergwacht\AppData\Roaming\GARMIN
[2009.07.16 09:17:26 | 000,000,000 | ---D | M] -- C:\Users\Bergwacht\AppData\Roaming\Geogrid
[2009.07.28 14:10:04 | 000,000,000 | ---D | M] -- C:\Users\Bergwacht\AppData\Roaming\gtk-2.0
[2010.08.06 08:59:23 | 000,000,000 | -HSD | M] -- C:\Users\Bergwacht\AppData\Roaming\lowsec
[2010.07.29 14:22:34 | 000,000,000 | ---D | M] -- C:\Users\Bergwacht\AppData\Roaming\MAGIX
[2010.07.15 18:27:35 | 000,000,000 | ---D | M] -- C:\Users\Bergwacht\AppData\Roaming\myphotobook
[2010.06.21 11:18:42 | 000,000,000 | ---D | M] -- C:\Users\Bergwacht\AppData\Roaming\NCH Swift Sound
[2011.05.26 10:45:59 | 000,000,000 | ---D | M] -- C:\Users\Bergwacht\AppData\Roaming\OpenCandy
[2009.07.16 13:07:34 | 000,000,000 | ---D | M] -- C:\Users\Bergwacht\AppData\Roaming\PeerNetworking
[2010.08.23 07:33:47 | 000,000,000 | ---D | M] -- C:\Users\Bergwacht\AppData\Roaming\QuickScan
[2009.12.21 09:10:23 | 000,000,000 | ---D | M] -- C:\Users\Bergwacht\AppData\Roaming\Sigel
[2010.07.31 16:09:35 | 000,000,000 | ---D | M] -- C:\Users\Bergwacht\AppData\Roaming\Software4u
[2010.02.25 12:45:15 | 000,000,000 | ---D | M] -- C:\Users\Bergwacht\AppData\Roaming\TOSHIBA
[2010.03.26 14:30:15 | 000,000,000 | ---D | M] -- C:\Users\Bergwacht\AppData\Roaming\TrojanHunter
[2011.07.25 11:19:25 | 000,000,000 | ---D | M] -- C:\Users\Bergwacht\AppData\Roaming\TuneUpMedia
[2010.12.17 12:10:38 | 000,000,000 | ---D | M] -- C:\Users\Bergwacht\AppData\Roaming\Ulead Systems
[2010.02.18 19:57:49 | 000,000,000 | ---D | M] -- C:\Users\Bergwacht\AppData\Roaming\Uniblue
[2010.07.31 10:08:35 | 000,000,000 | ---D | M] -- C:\Users\Bergwacht\AppData\Roaming\Vufam
[2010.05.16 09:54:31 | 000,000,000 | ---D | M] -- C:\Users\Bergwacht\AppData\Roaming\WinBatch
[2011.08.09 15:19:34 | 000,000,000 | ---D | M] -- C:\Users\Bergwacht\AppData\Roaming\XnView
[2011.01.31 10:13:04 | 000,000,000 | ---D | M] -- C:\Users\Bergwacht\AppData\Roaming\Ynhi
[2011.08.09 23:16:48 | 000,000,384 | ---- | M] () -- C:\Windows\Tasks\Ad-Aware Update (Weekly).job
[2011.08.09 23:16:43 | 000,000,386 | ---- | M] () -- C:\Windows\Tasks\Registry Reviver-Bergwacht-Startup.job
[2011.08.09 23:13:12 | 000,032,530 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
[color=#E56717]========== Purity Check ==========[/color]
 
 
 
[color=#E56717]========== Alternate Data Streams ==========[/color]
 
@Alternate Data Stream - 24 bytes -> C:\Windows:C5313A041EC073B1
@Alternate Data Stream - 115 bytes -> C:\ProgramData\TEMP:A8ADE5D8
@Alternate Data Stream - 103 bytes -> C:\ProgramData\TEMP:DFC5A2B2


< End of report >

Alles anzeigen

[Bearbeitet durch Wawuschel]
[quote][/quote] eingefügt

heihaclau

Mit dieser Startseite: https://encrypted.google.com/webhp?hl=de#hl…iw=1440&bih=807 funktioniert es.

heihaclau

Hab jetzt das gleiche Problem auch beim Internetexplorer. Lediglich die Favoriten funktionieren ohne Problem und auch die Weiterleitungen dort.

heihaclau

Hier nochmal der Link http://justpaste.it/fsv

heihaclau

Hier nochmal der Link http://justpaste.it/fsv

heihaclau

Neues Profil wurde erstellt.
Die LAN-Einstellung ist wie auf der Anleitung, jedoch kein Häkchen gesetzt.

heihaclau

Habe den Realplayer deinstalliert, Problem besteht weiter

heihaclau

Hier der Link http://justpaste.it/fr3
Proxyeinstellung wie oben geändert - Problem bleibt
Internetexplorer funktioniert

heihaclau

Habe die Überprüfung der Firewall durchgeführt, leider noch keine Änderung

Beiträge von heihaclau

Firefox bringt 404 not found

Firefox bringt 404 not found

Firefox bringt 404 not found

Firefox bringt 404 not found

Firefox bringt 404 not found

Firefox bringt 404 not found

Firefox bringt 404 not found

Firefox bringt 404 not found

Firefox bringt 404 not found

Firefox bringt 404 not found

Firefox bringt 404 not found

Firefox bringt 404 not found

Firefox bringt 404 not found

Firefox bringt 404 not found

Firefox bringt 404 not found

Firefox bringt 404 not found

Firefox bringt 404 not found

Firefox bringt 404 not found

Firefox bringt 404 not found

Firefox bringt 404 not found