Hallo
seit neustem ist mein Pc sehr viel langsamer geworden und zudem muss ich ihn manchmal direkt nach dem Aufstarten zwangsmässig (mit langem drücken auf den On-Knopf)(Habe einen Laptop) ausschalten, weil nichts mehr geht. Also ich kann nichts mehr anklicken etc.

Hier das Hijackthis Logfile

Logfile of HijackThis v1.99.1
Scan saved at 19:51:08, on 21.03.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5296.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSetMgr.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\SNDSrvc.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Acer\eManager\anbmServ.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccProxy.exe
C:\WINDOWS\system32\cisvc.exe
C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Programme\Norton AntiVirus\navapsvc.exe
C:\Programme\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\WINDOWS\system32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\PROGRA~1\NORTON~2\SPEEDD~1\nopdb.exe
C:\WINDOWS\system32\svchost.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\Security Center\SymWSC.exe
C:\Programme\Synaptics\SynTP\SynTPLpr.exe
C:\Programme\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Arcade\PCMService.exe
C:\WINDOWS\system32\rundll32.exe
C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\acer\epm\epm-dm.exe
C:\Programme\Launch Manager\QtZgAcer.EXE
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe
C:\Programme\Java\jre1.5.0_06\bin\jusched.exe
C:\PROGRA~1\LEXMAR~1\ACMonitor_X83.exe
C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X83.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
C:\Programme\MessengerPlus! 3\MsgPlus.exe
C:\WINDOWS\VM_STI.EXE
C:\WINDOWS\system32\ezSP_Px.exe
C:\Programme\QuickTime\qttask.exe
D:\programme\CyberLink\PowerDVD\PDVDServ.exe
C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe
D:\programme\ICQLite\ICQLite.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\Siemens\Gigaset WLAN Adapter\wlm.exe
C:\Programme\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\explorer.exe
C:\Programme\Internet Explorer\IEXPLORE.EXE
C:\Programme\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\explorer.exe
C:\Dokumente und Einstellungen\MissTurner\Eigene Dateien\hijackthis_199\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ch/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=54729
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=55245&clcid={SUB_CLCID}
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://global.acer.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: CNisExtBho Class - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Programme\Gemeinsame Dateien\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programme\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Programme\Gemeinsame Dateien\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programme\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [SynTPLpr] C:\Programme\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programme\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Arcade\PCMService.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [ATIPTA] C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [EPM-DM] c:\acer\epm\epm-dm.exe
O4 - HKLM\..\Run: [ePowerManagement] C:\Acer\ePM\ePM.exe boot
O4 - HKLM\..\Run: [LManager] C:\Programme\Launch Manager\QtZgAcer.EXE
O4 - HKLM\..\Run: [ccApp] "C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Programme\Norton Internet Security Professional\UrlLstCk.exe
O4 - HKLM\..\Run: [Lexmark X83 Button Monitor] C:\PROGRA~1\LEXMAR~1\ACMonitor_X83.exe
O4 - HKLM\..\Run: [Lexmark X83 Button Manager] C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X83.exe
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Programme\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE WEBSHOT II USB CAM 300K
O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\system32\ezSP_Px.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [RemoteControl] D:\programme\CyberLink\PowerDVD\PDVDServ.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [ICQ Lite] D:\programme\ICQLite\ICQLite.exe -minimize
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Programme\MessengerPlus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [msnmsgr] "C:\Programme\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\RunOnce: [ICQ Lite] D:\programme\ICQLite\ICQLite.exe -trayboot
O4 - Startup: Adobe Gamma.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: BitTorrent.lnk = C:\Programme\BitTorrent\bittorrent.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Programme\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Gigaset WLAN Adapter Monitor.lnk = ?
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - D:\programme\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - D:\programme\ICQLite\ICQLite.exe
O9 - Extra button: Klicke hier um das Projekt xp-AntiSpy zu unterstützen - {CB4F312B-E337-4C50-997D-1A3B9465B8A4} - C:\Programme\xp-AntiSpy\sponsoring\sponsor.html (file missing) (HKCU)
O9 - Extra 'Tools' menuitem: Unterstützung für xp-AntiSpy - {CB4F312B-E337-4C50-997D-1A3B9465B8A4} - C:\Programme\xp-AntiSpy\sponsoring\sponsor.html (file missing) (HKCU)
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupda ... 3587781130
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 9187176132
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: WB - D:\PROGRA~1\WINDOW~1\fastload.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSetMgr.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Norton AntiVirus Auto-Protect-Dienst (navapsvc) - Symantec Corporation - C:\Programme\Norton AntiVirus\navapsvc.exe
O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\Norman\Nvc\BIN\nipsvc.exe (file missing)
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Programme\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Programme\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
O23 - Service: SAVScan - Symantec Corporation - C:\Programme\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\GEMEIN~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\SNDSrvc.exe
O23 - Service: Sony SCSI Helper Service - Sony Corporation - C:\Programme\Gemeinsame Dateien\Sony Shared\Fsk\SonySCSIHelperService.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~2\SPEEDD~1\nopdb.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\Security Center\SymWSC.exe



Wäre froh um jegliche Hilfe!

lg MissTurner

versuche es zuerst einmal mit einer Systemwiederherstellung.


Start -> Hilfe und Support -> zur Option "Computeränderungen mit der Systemwiederherstellung rückgängig machen"
Dort wählst du: "Computer zu einem früheren Zeitpunkt wiederherstellen" -> Weiter
Die fett angezeigten Daten im Kalender zeigen dir gesetzte Wiederherstellungspunkte. ...gehe soweit wie moeglich zurueck....im Datum
http://virus-protect.org/systemwiederherstellung.html

+
dann versuche einen Onlinescan mit Kaspersky zu machen
http://virus-protect.org/onlinescan.html
+
dann poste das neue Log vom HijackThis

weiss nicht wirklich ob ich das mit dem Onlinescan richtig gemacht habe... war ein wenig komisch

hier das Logfile:

C:\Programme\Gemeinsame Dateien\Symantec Shared\Security Center\SymWSC.exe
C:\Programme\Synaptics\SynTP\SynTPLpr.exe
C:\Programme\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\rundll32.exe
C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\acer\epm\epm-dm.exe
C:\Programme\Launch Manager\QtZgAcer.EXE
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe
C:\Programme\Java\jre1.5.0_06\bin\jusched.exe
C:\PROGRA~1\LEXMAR~1\ACMonitor_X83.exe
C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X83.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
C:\Programme\MessengerPlus! 3\MsgPlus.exe
C:\WINDOWS\VM_STI.EXE
C:\WINDOWS\system32\ezSP_Px.exe
C:\Programme\QuickTime\qttask.exe
D:\programme\CyberLink\PowerDVD\PDVDServ.exe
C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe
D:\programme\ICQLite\ICQLite.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\Siemens\Gigaset WLAN Adapter\wlm.exe
C:\Programme\MSN Messenger\msnmsgr.exe
C:\Programme\BitTorrent\bittorrent.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Programme\Internet Explorer\IEXPLORE.EXE
C:\Dokumente und Einstellungen\MissTurner\Eigene Dateien\hijackthis_199\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ch/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=54729
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=55245&clcid={SUB_CLCID}
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://global.acer.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: CNisExtBho Class - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Programme\Gemeinsame Dateien\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programme\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Programme\Gemeinsame Dateien\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programme\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [SynTPLpr] C:\Programme\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programme\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Arcade\PCMService.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [ATIPTA] C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [EPM-DM] c:\acer\epm\epm-dm.exe
O4 - HKLM\..\Run: [ePowerManagement] C:\Acer\ePM\ePM.exe boot
O4 - HKLM\..\Run: [LManager] C:\Programme\Launch Manager\QtZgAcer.EXE
O4 - HKLM\..\Run: [ccApp] "C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Programme\Norton Internet Security Professional\UrlLstCk.exe
O4 - HKLM\..\Run: [Lexmark X83 Button Monitor] C:\PROGRA~1\LEXMAR~1\ACMonitor_X83.exe
O4 - HKLM\..\Run: [Lexmark X83 Button Manager] C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X83.exe
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Programme\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE WEBSHOT II USB CAM 300K
O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\system32\ezSP_Px.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [RemoteControl] D:\programme\CyberLink\PowerDVD\PDVDServ.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [ICQ Lite] D:\programme\ICQLite\ICQLite.exe -minimize
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Programme\MessengerPlus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [msnmsgr] "C:\Programme\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\RunOnce: [ICQ Lite] D:\programme\ICQLite\ICQLite.exe -trayboot
O4 - Startup: Adobe Gamma.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: BitTorrent.lnk = C:\Programme\BitTorrent\bittorrent.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Programme\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Gigaset WLAN Adapter Monitor.lnk = ?
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - D:\programme\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - D:\programme\ICQLite\ICQLite.exe
O9 - Extra button: Klicke hier um das Projekt xp-AntiSpy zu unterstützen - {CB4F312B-E337-4C50-997D-1A3B9465B8A4} - C:\Programme\xp-AntiSpy\sponsoring\sponsor.html (file missing) (HKCU)
O9 - Extra 'Tools' menuitem: Unterstützung für xp-AntiSpy - {CB4F312B-E337-4C50-997D-1A3B9465B8A4} - C:\Programme\xp-AntiSpy\sponsoring\sponsor.html (file missing) (HKCU)
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/ka ... nicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupda ... 3587781130
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 9187176132
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: WB - D:\PROGRA~1\WINDOW~1\fastload.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSetMgr.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Norton AntiVirus Auto-Protect-Dienst (navapsvc) - Symantec Corporation - C:\Programme\Norton AntiVirus\navapsvc.exe
O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\Norman\Nvc\BIN\nipsvc.exe (file missing)
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Programme\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Programme\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
O23 - Service: SAVScan - Symantec Corporation - C:\Programme\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\GEMEIN~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\SNDSrvc.exe
O23 - Service: Sony SCSI Helper Service - Sony Corporation - C:\Programme\Gemeinsame Dateien\Sony Shared\Fsk\SonySCSIHelperService.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~2\SPEEDD~1\nopdb.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\Security Center\SymWSC.exe

dieses Log sieht viel besser aus

Warum hast du den Scanreport vom Kaspersky nicht hier kopiert ???

tut mir Leid, das ist wohl irgendwie untergegangen, habe ihn zwar gespeichert, aber irgendwie ist er nirgendwo zu finden

Also war das alles, oder kann ich sonst noch was tun um das Ganze wieder zu beschleunigen?

Kaspersky loescht keine Viren per Onlinescan-- er zeigt nur an, deshalb solltest du den scanreport suchen oder noch mal scannen

stelle den Cleaner genauso ein, wie hier angegeben:
http://virus-protect.org/cleanup.html

TuneUp 2006 (30 Tage free) Shareware
http://virus-protect.org/reinigungstoolsregistry.html
wende an:
Cleanup repair -- TuneUp Diskcleaner
Cleanup repair -- Registry Cleaner

Ist das mit dem Scanreport wirklich so wichtig... das hat bei mir nämlich ewig gedauert... und das ganze jetzt nochmals machen

Clean Up und das andere hab ich jetzt gemacht.

nimm diese Proggies aus dem Autostart, und klicke sie direkt an, wenn du sie brauchst.
Der Autostart von deinem PC ist voellig ueberladen.

öffne das HijackThis -- Button "scan" -- vor die Einträge Häkchen setzen -- Button "Fix checked" -- PC neustarten

O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [ICQ Lite] D:\programme\ICQLite\ICQLite.exe -minimize
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Programme\MessengerPlus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [msnmsgr] "C:\Programme\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\RunOnce: [ICQ Lite] D:\programme\ICQLite\ICQLite.exe -trayboot
O4 - Startup: BitTorrent.lnk = C:\Programme\BitTorrent\bittorrent.exe

PC neustarten

der scan mit kaspersky ist nur notwendig, falls etwas gefunden wurde...denn es muss manuell geloescht werden

Okay gut, das hab ich gemacht!
Brauchst du jetzt nochmal ein Logfile, oder ist es so okay?

O4 - HKCU\..\Run: [MessengerPlus3] "C:\Programme\MessengerPlus! 3\MsgPlus.exe" /WinStart

...? lg

Yourhighness hat geschrieben:

O4 - HKCU\..\Run: [MessengerPlus3] "C:\Programme\MessengerPlus! 3\MsgPlus.exe" /WinStart

...? lg

....?

Oops sorry. Das ist fuer Nikita gedacht ...mfg

Johannes,

nun ja, ich wuerde mir diesen Muell nie auf den Rechner laden (MessengerPlus3), und damit den LOP-Trojan, aber ich sehe keinen im Log.....

MissTurner
http://virus-protect.org/counterspy.html
scanne mit counterspy und poste den scanreport

Hallo Biene. Siehe bitte in Gruen. Mal ne andere Farbe ^^.

NB: Java jre1.5.0_06 ist anfaellig fuer malware / spyware etc. Es sollte sich die neueste Version geladen werden...gotta go. mfg

soo... hier der Scanreport:

Spyware Scan Details
Start Date: 24.03.2006 13:52:39
End Date: 24.03.2006 14:27:39
Total Time: 35 mins

Detected spyware

Messenger Plus! Adware Bundler more information...
Details: Messenger Plus! is a add-on for MSN Messenger. Messenger Plus! installs an OPTIONAL adware called C2Media which is also known as LOP.com.
Status: Ignored

Infected files detected
c:\programme\messengerplus! 3\resources\msgplusres.dll
c:\programme\messengerplus! 3\msgplus.exe
c:\programme\messengerplus! 3\msgplush.dll
c:\programme\messengerplus! 3\richedhook.dll
c:\programme\messengerplus! 3\msgplusloader.dll
c:\programme\messengerplus! 3\lame_enc.dll
c:\programme\messengerplus! 3\libsndfile.dll
c:\programme\messengerplus! 3\detoured.dll
C:\WINDOWS\system32\MsgPlusLoader.dll
C:\System Volume Information\_restore{18A3BEE4-69C8-4613-BC76-0027E40DCE5D}\RP69\A0027840.dll
C:\System Volume Information\_restore{18A3BEE4-69C8-4613-BC76-0027E40DCE5D}\RP69\A0027841.exe
C:\System Volume Information\_restore{18A3BEE4-69C8-4613-BC76-0027E40DCE5D}\RP69\A0027842.dll
C:\System Volume Information\_restore{18A3BEE4-69C8-4613-BC76-0027E40DCE5D}\RP69\A0027843.dll
C:\System Volume Information\_restore{18A3BEE4-69C8-4613-BC76-0027E40DCE5D}\RP69\A0027844.dll
C:\System Volume Information\_restore{18A3BEE4-69C8-4613-BC76-0027E40DCE5D}\RP69\A0027845.dll
C:\System Volume Information\_restore{18A3BEE4-69C8-4613-BC76-0027E40DCE5D}\RP69\A0027846.dll
C:\System Volume Information\_restore{18A3BEE4-69C8-4613-BC76-0027E40DCE5D}\RP69\A0027848.dll

Infected registry entries detected
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Archive\@BCEIu|wQ/osae1mmdOnvs]jCerlGsicMuvjtYqo Type 2
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Archive\@BCEIu|wQ/osae1mmdOnvs]jCerlGsicMuvjtYqo FilePath
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Archive\@CEIQu|wa/osOe1owp]AjwGkinvrMuuYqo Type 2
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Archive\@CEIQu|wa/osOe1owp]AjwGkinvrMuuYqo FilePath
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Archive\@dUi_u|wK/osUe1mmdinvs_jC: HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Archive\@dUi_u|wK/osUe1mmdinvs_jC: HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Archive\@jaO]u|wG/osMe1mmdYnvsqjClyfoocnkodeclclkrSeWm Type 2
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Archive\@jaO]u|wG/osMe1mmdYnvsqjClyfoocnkodeclclkrSeWm FilePath
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Archive\@LWmgu|w[/osCe1mmdEnvsIjC{iuQqcgacofyqObo]GM Type 2
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Archive\@LWmgu|w[/osCe1mmdEnvsIjC{iuQqcgacofyqObo]GM FilePath
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Archive\@MYqou|wk/ghc0{nkCSxe2ekvtmuWiemg[ Type 2
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Archive\@MYqou|wk/ghc0{nkCSxe2ekvtmuWiemg[ FilePath
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Archive\@ni_Ku|wU/ghi0ojep_uqlKBjoejUhpeidbueb_lgiKiUi_ Type 2
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Archive\@ni_Ku|wU/ghi0ojep_uqlKBjoejUhpeidbueb_lgiKiUi_ FilePath
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Archive\@RcSeu|wW/osme1mmdgnvs[jCbxoCpxmEtbmikIdkqQaO] Type 2
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Archive\@RcSeu|wW/osme1mmdgnvs[jCbxoCpxmEtbmikIdkqQaO] FilePath
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Archive\@RcSeu|wW/osme1mmdgnvs[jCi~vCjvrEcoueIQa Type 2
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Archive\@RcSeu|wW/osme1mmdgnvs[jCi~vCjvrEcoueIQa FilePath
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Archive\@Wmg[u|wC/osEe1mmdInvsQjC3cnaftiOokdw]GM Type 2
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Archive\@Wmg[u|wC/osEe1mmdInvsQjC3cnaftiOokdw]GM FilePath
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Archive\@]GMYu|wq/osoe1mmdknvscjC4xxShaieqodWmg Type 2
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Archive\@]GMYu|wq/osoe1mmdknvscjC4xxShaieqodWmg FilePath
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Archive LastArchiveTime 1141210607
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@aO]GnsfM/pwYoC6c6q3gvocokcS LastSignin 1132394525
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@aO]GnsfM/pwYoC6c6q3gvocokcS LastChat 1129201673
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@BCEIig1QegiarvjlCOsgf]growGMY LastSignin 1143052238
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@BCEIig1QegiarvjlCOsgf]growGMY LastChat 1142792967
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@BCEIig1QegiarvjlCOsgf]growGMY XmlLogCreationTime
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@BCEIig1QegiarvjlCOsgf]growGMY XmlLogLastSize 4820
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@cSeWnsfm/nmgcpusk[A66CaqoepE{kiIjQaO LastSignin 1133544451
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@cSeWnsfm/nmgcpusk[A66CaqoepE{kiIjQaO LastChat 1133544452
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@DGMYnsfq/nmocpuskkAfrckuhcvStkteWmg LastSignin 1143134218
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@DGMYnsfq/nmocpuskkAfrckuhcvStkteWmg LastChat 1142955346
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@DGMYnsfq/nmocpuskkAfrckuhcvStkteWmg XmlLogCreationTime
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@DGMYnsfq/nmocpuskkAfrckuhcvStkteWmg XmlLogLastSize 48337
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@DGMYnsfq/pwooChchkngscjwSeW LastSignin 1126886370
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@DGMYnsfq/pwooChchkngscjwSeW LastChat 1126886375
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@EIQansfO/nm]cpuskGAtiMogj{bYfp}qfokc LastSignin 1142964023
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@EIQansfO/nm]cpuskGAtiMogj{bYfp}qfokc LastChat 1142883912
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@EIQansfO/nm]cpuskGAtiMogj{bYfp}qfokc XmlLogCreationTime
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@EIQansfO/nm]cpuskGAtiMogj{bYfp}qfokc XmlLogLastSize 22430
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@EIQansfO/pw]oCiwlGgovMqwtYqo LastSignin 1143057725
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@EIQansfO/pw]oCiwlGgovMqwtYqo LastChat 1142794675
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@EIQansfO/pw]oCiwlGgovMqwtYqo XmlLogCreationTime
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@EIQansfO/pw]oCiwlGgovMqwtYqo XmlLogLastSize 624043
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@fYqofh1kpqlcc|AwhSvomeijplfWtmg[ LastSignin 1134413242
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@fYqofh1kpqlcc|AwhSvomeijplfWtmg[ LastChat 1138041734
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@fYqofh1kpqlcc|AwhSvomeijplfWtmg[ XmlLogCreationTime
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@fYqofh1kpqlcc|AwhSvomeijplfWtmg[ XmlLogLastSize 6876
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@fYqonsfk/nmccpuskSA; HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@fYqonsfk/nmccpuskSA; HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@fYqonsfk/nmccpuskSA; HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@fYqonsfk/nmccpuskSA; HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@fYqonsfk/nmccpuskSAtieogj{bWfnimndg[C LastSignin 1143056118
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@fYqonsfk/nmccpuskSAtieogj{bWfnimndg[C LastChat 1142707718
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@IQaOnsf]/nmGcpuskMA89Ycqjfdqtokc LastSignin 1140269823
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@IQaOnsf]/nmGcpuskMA89Ycqjfdqtokc LastChat 1137868865
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@IQaOnsf]/nmGcpuskMA89Ycqjfdqtokc XmlLogCreationTime
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@IQaOnsf]/nmGcpuskMA89Ycqjfdqtokc XmlLogLastSize 29075
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@i_KUnsfi/nm_cpuskKA24Unhhrhisgh_prmfKUi LastSignin 1139241021
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@i_KUnsfi/nm_cpuskKA24Unhhrhisgh_prmfKUi LastChat 1139241821
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@i_KUnsfi/nm_cpuskKA24Unhhrhisgh_prmfKUi XmlLogCreationTime
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@i_KUnsfi/nm_cpuskKA24Unhhrhisgh_prmfKUi XmlLogLastSize 2465
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@i_KUnsfi/nm_cpuskKA3~Ugxhmuieqv_aluesKUi_ LastSignin 1143134036
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@i_KUnsfi/nm_cpuskKA3~Ugxhmuieqv_aluesKUi_ LastChat 1137523294
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@i_KUnsfi/nm_cpuskKA3~Ugxhmuieqv_aluesKUi_ XmlLogCreationTime
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@i_KUnsfi/nm_cpuskKA3~Ugxhmuieqv_aluesKUi_ XmlLogLastSize 69576
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@JSeWnsfm/nmgcpusk[AcxCwuvodEtIQa LastSignin 1142878095
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@JSeWnsfm/nmgcpusk[AcxCwuvodEtIQa LastChat 1142070908
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@JSeWnsfm/nmgcpusk[AcxCwuvodEtIQa XmlLogCreationTime
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@JSeWnsfm/nmgcpusk[AcxCwuvodEtIQa XmlLogLastSize 19199
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@kcSeig1WyokmBqjwxgcap[eCEI LastSignin 1140456629
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@kcSeig1WyokmBqjwxgcap[eCEI LastChat 1126196262
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@leWmnsfg/nm[cpuskCAmyEeqbnpIbfcQknjraO] LastSignin 1143134036
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@leWmnsfg/nm[cpuskCAmyEeqbnpIbfcQknjraO] LastChat 1142884716
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@leWmnsfg/nm[cpuskCAmyEeqbnpIbfcQknjraO] XmlLogCreationTime
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@leWmnsfg/nm[cpuskCAmyEeqbnpIbfcQknjraO] XmlLogLastSize 2255153
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@N[CEnsfI/nmQcpuskaA|iOtsbgd]mgyGpdnMYq LastSignin 1143054081
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@N[CEnsfI/nmQcpuskaA|iOtsbgd]mgyGpdnMYq LastChat 1143022824
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@N[CEnsfI/nmQcpuskaA|iOtsbgd]mgyGpdnMYq XmlLogCreationTime
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@N[CEnsfI/nmQcpuskaA|iOtsbgd]mgyGpdnMYq XmlLogLastSize 21024
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@O]GMfh1YyokqBzd2lotumktkdcSe LastSignin 1143134036
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@O]GMfh1YyokqBzd2lotumktkdcSe LastChat 1141486415
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@O]GMfh1YyokqBzd2lotumktkdcSe XmlLogCreationTime
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@O]GMfh1YyokqBzd2lotumktkdcSe XmlLogLastSize 60224
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@pmg[fh1CmkeEowplCIhpeQijoeea`veOanfij]GMY LastSignin 1143134503
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@pmg[fh1CmkeEowplCIhpeQijoeea`veOanfij]GMY LastChat 1142773549
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@pmg[fh1CmkeEowplCIhpeQijoeea`veOanfij]GMY XmlLogCreationTime
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@pmg[fh1CmkeEowplCIhpeQijoeea`veOanfij]GMY XmlLogLastSize 19301
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@pmg[nsfC/nmEcpuskIA5cQjfpobakO]G LastSignin 1142965978
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@pmg[nsfC/nmEcpuskIA5cQjfpobakO]G LastChat 1132849406
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@pmg[nsfC/nmEcpuskIA5cQjfpobakO]G XmlLogCreationTime
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@pmg[nsfC/nmEcpuskIA5cQjfpobakO]G XmlLogLastSize 10766
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@RcSeig1Wok{mgxmfCgcns[m1bnqCbvEIQ LastSignin 1140283002
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@RcSeig1Wok{mgxmfCgcns[m1bnqCbvEIQ LastChat 1134239529
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@rqokig1cok{SgxmfCeujgWgucshmmnigjfjq[CE LastSignin 1143054675
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@rqokig1cok{SgxmfCeujgWgucshmmnigjfjq[CE LastChat 1143047953
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@rqokig1cok{SgxmfCeujgWgucshmmnigjfjq[CE XmlLogCreationTime
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@rqokig1cok{SgxmfCeujgWgucshmmnigjfjq[CE XmlLogLastSize 11573
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@Tg[CnsfE/nmIcpuskQAcxanrwmuO`ni]jfjqGMY LastSignin 1142966386
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@Tg[CnsfE/nmIcpuskQAcxanrwmuO`ni]jfjqGMY LastChat 1142965536
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@Tg[CnsfE/nmIcpuskQAcxanrwmuO`ni]jfjqGMY XmlLogCreationTime
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@Tg[CnsfE/nmIcpuskQAcxanrwmuO`ni]jfjqGMY XmlLogLastSize 73687
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@Tg[CnsfE/nmIcpuskQAj~aulurdOmve]GMY LastSignin 1141324428
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@Tg[CnsfE/nmIcpuskQAj~aulurdOmve]GMY LastChat 1141324420
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@Tg[CnsfE/nmIcpuskQAj~aulurdOmve]GMY XmlLogCreationTime
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@Tg[CnsfE/nmIcpuskQAj~aulurdOmve]GMY XmlLogLastSize 183153
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@Ui_KnsfU/nmicpusk_AtiKurppbUbpmitebw_KU LastSignin 1132503619
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@Ui_KnsfU/nmicpusk_AtiKurppbUbpmitebw_KU LastChat 1132503624
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@Wmg[nsfC/nmEcpuskIAtiQiqjlfatvvOge`eo]fkrGcgMYq LastSignin 1143052892
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@Wmg[nsfC/nmEcpuskIAtiQiqjlfatvvOge`eo]fkrGcgMYq LastChat 1131734189
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@Yqoknsfc/nmScpuskeA4cWmhsipmiewg[CE LastSignin 1143134036
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@Yqoknsfc/nmScpuskeA4cWmhsipmiewg[CE LastChat 1143134293
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@Yqoknsfc/nmScpuskeA4cWmhsipmiewg[CE XmlLogCreationTime
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@Yqoknsfc/nmScpuskeA4cWmhsipmiewg[CE XmlLogLastSize 2550298
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@ZAAAnsfA/nmAcpuskAA55AcsjwrAkAAA LastSignin 1126112244
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@ZAAAnsfA/nmAcpuskAA55AcsjwrAkAAA LastChat 1135774472
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@ZAAAnsfA/nmAcpuskAA55AcsjwrAkAAA XmlLogCreationTime
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@ZAAAnsfA/nmAcpuskAA55AcsjwrAkAAA XmlLogLastSize 4054
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@_KUinsf_/nmKcpuskUA5xiwj`ir_meKUi LastSignin 1143134036
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@_KUinsf_/nmKcpuskUA5xiwj`ir_meKUi LastChat 1142011017
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@_KUinsf_/nmKcpuskUA5xiwj`ir_meKUi XmlLogCreationTime
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@_KUinsf_/nmKcpuskUA5xiwj`ir_meKUi XmlLogLastSize 35354
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@_KUinsf_/nmKcpuskUAtiiiuffp_pjcKgqpqlUti_K LastSignin 1143057668
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\@_KUinsf_/nmKcpuskUAtiiiuffp_pjcKgqpqlUti_K LastChat 1133463342
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\CtcDetach\@aO]GnsfM/pwYoC6c6q3gvocokcS Detach 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\CtcDetach\@aO]GnsfM/pwYoC6c6q3gvocokcS CtcEmail
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\CtcDetach\@DGMYnsfq/pwooChchkngscjwSeW Detach 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\CtcDetach\@DGMYnsfq/pwooChchkngscjwSeW CtcEmail
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\CtcDetach\@i_KUnsfi/nm_cpuskKA24Unhhrhisgh_prmfKUi Detach 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\CtcDetach\@i_KUnsfi/nm_cpuskKA24Unhhrhisgh_prmfKUi CtcEmail
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\CtcDetach\@RcSeig1Wok{mgxmfCgcns[m1bnqCbvEIQ Detach 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\CtcDetach\@RcSeig1Wok{mgxmfCgcns[m1bnqCbvEIQ CtcEmail
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\CtcDetach\@Tg[CnsfE/nmIcpuskQAcxanrwmuO`ni]jfjqGMY Detach 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\CtcDetach\@Tg[CnsfE/nmIcpuskQAcxanrwmuO`ni]jfjqGMY CtcEmail
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\CtcDetach\@Ui_KnsfU/nmicpusk_AtiKurppbUbpmitebw_KU Detach 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Contacts\CtcDetach\@Ui_KnsfU/nmicpusk_AtiKurppbUbpmitebw_KU CtcEmail
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Preferences\BossProtections\BossProtection0 Shortcut 544
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Preferences\SoundStats #000000000022 1
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Preferences\SoundStats LastUse01 000000000022
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Preferences SystemLogWndX 200
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Preferences SystemLogWndY 100
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Preferences SystemLogWndWidth 500
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Preferences SystemLogWndHeight 162
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Preferences FirstTimeWizard 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Preferences CustomColors
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Preferences LogDirectory C:\Dokumente und Einstellungen\MissTurner\Eigene Dateien\Meine Aufzeichnungen
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Preferences FirstLaunch 1125923665
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Preferences ToastPopupSizeW4 148
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Preferences ToastPopupSizeH4 123
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Preferences ToastPopupPos4 1116
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Preferences ToastPopupResX 1280
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Preferences ToastPopupBorder4 1
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Preferences ToastPopupSizeW6 181
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Preferences ToastPopupSizeH6 116
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Preferences ToastPopupPos6 1082
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Preferences ToastPopupBorder6 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Preferences QuickIconAddOrigin 1
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Preferences MigrateLevel 2
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Preferences CustSoundsUsePreview 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Preferences AskForAutogroup 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Preferences GroupBarLocation 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\gwedhiel@gmx.ch\Preferences AutoGroupChats 1
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\Nobody\CustSounds\42089E752768 Name nigga
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\Nobody\CustSounds\42089E752768 Category 2
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\Nobody\CustSounds\42089E752768 Flags 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\Nobody\CustSounds\42089E752768 Language 5
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\Nobody\CustSounds\42089E752768 NeedsLoading 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\Nobody\CustSounds\68C56A3F233E Name Nimm ihn in den Mund
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\Nobody\CustSounds\68C56A3F233E Category 1
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\Nobody\CustSounds\68C56A3F233E Flags 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\Nobody\CustSounds\68C56A3F233E Language 5
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\Nobody\CustSounds\68C56A3F233E NeedsLoading 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\Nobody\CustSounds\A1906C8461D1 Name Adolf Fickfehler
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\Nobody\CustSounds\A1906C8461D1 Category 5
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\Nobody\CustSounds\A1906C8461D1 Flags 2
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\Nobody\CustSounds\A1906C8461D1 Language 5
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\Nobody\CustSounds\A1906C8461D1 NeedsLoading 0
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\Nobody\Data StatTime 1143022716
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\Nobody\Data CurrentStatID 1
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\Nobody\Data S1-1 -2147221504
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\Nobody\Data S2-1 4704
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\Nobody\Data S1-2 -1073479679
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\Nobody\Data S2-2 4704
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\Nobody\Data S1-3 -2147221504
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\Nobody\Data S2-3 4704
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2 LanguageFile Lang_Deutsch.ini
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2 DefaultConfiguration gwedhiel@gmx.ch
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2 SoftwareState 1142846699
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2 AutoUpdateNotification 1
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2 AutoUpdateNotificationTime 1136801851
HKEY_CURRENT_USER\Software\Patchou\MsgPlus2 AutoMsg5Start "C:\Programme\MSN Messenger\msnmsgr.exe" /background
HKEY_LOCAL_MACHINE\SOFTWARE\Patchou\MsgPlus2
HKEY_LOCAL_MACHINE\SOFTWARE\Patchou\MsgPlus2 BinDir C:\Programme\MessengerPlus! 3
HKEY_LOCAL_MACHINE\SOFTWARE\Patchou\MsgPlus2 LocalizationDir C:\Programme\MessengerPlus! 3\Resources
HKEY_LOCAL_MACHINE\SOFTWARE\Patchou\MsgPlus2 PluginDir C:\Programme\MessengerPlus! 3\Plugins
HKEY_LOCAL_MACHINE\SOFTWARE\Patchou\MsgPlus2 FileNameDll MsgPlusH.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Patchou\MsgPlus2 FileNameExe MsgPlus.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Patchou\MsgPlus2 FileNameLoader MsgPlusLoader.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Patchou\MsgPlus2 SoftwareBuild 3146
HKEY_LOCAL_MACHINE\SOFTWARE\Patchou\MsgPlus2 DefLanguageFile Lang_Deutsch.ini
HKEY_LOCAL_MACHINE\SOFTWARE\Patchou\MsgPlus2 InstallTime 1125911991
HKEY_LOCAL_MACHINE\SOFTWARE\Patchou\MsgPlus2 HookMode 1
HKEY_LOCAL_MACHINE\SOFTWARE\Patchou\MsgPlus2 ForceGlobalHook 0
HKEY_CLASSES_ROOT\MsgPlus.Encrypted
HKEY_CLASSES_ROOT\MsgPlus.Encrypted\DefaultIcon C:\Programme\MessengerPlus! 3\Resources\MsgPlusRes.dll,-2781
HKEY_CLASSES_ROOT\MsgPlus.Encrypted\shell\open\command "C:\Programme\MessengerPlus! 3\MsgPlus.exe" /LOG:%1
HKEY_CLASSES_ROOT\MsgPlus.Encrypted Encrypted Log File
HKEY_LOCAL_MACHINE\Software\microsoft\windows\currentversion\uninstall\MsgPlus! Plugin
HKEY_LOCAL_MACHINE\Software\microsoft\windows\currentversion\uninstall\MsgPlus! Plugin DisplayName Messenger Plus! 3
HKEY_LOCAL_MACHINE\Software\microsoft\windows\currentversion\uninstall\MsgPlus! Plugin UninstallString "C:\Programme\MessengerPlus! 3\MsgPlus.exe" /Remove
HKEY_LOCAL_MACHINE\Software\microsoft\windows\currentversion\uninstall\MsgPlus! Plugin DisplayIcon C:\Programme\MessengerPlus! 3\MsgPlus.exe,2


NewDotNet Browser Plug-in more information...
Details: New.Net is an Internet Explorer spyware/hijacker plug-in that adds subdomains of 'new.net' to your name resolution system (Windows’ Host file), resulting in what appear to be extra top-level domains (.shop, and so on) being resolvable.
Status: Ignored

Infected files detected
c:\windows\ndnuninstall6_38.exe
c:\windows\ndnuninstall7_22.exe
C:\System Volume Information\_restore{18A3BEE4-69C8-4613-BC76-0027E40DCE5D}\RP115\A0049204.dll
C:\System Volume Information\_restore{18A3BEE4-69C8-4613-BC76-0027E40DCE5D}\RP121\A0053736.dll
C:\System Volume Information\_restore{18A3BEE4-69C8-4613-BC76-0027E40DCE5D}\RP125\A0055240.exe
C:\System Volume Information\_restore{18A3BEE4-69C8-4613-BC76-0027E40DCE5D}\RP125\A0055242.exe


BearShare P2P Program more information...
Details: BearShare is a peer-to-peer (P2P) application that allows its users to join together in a network via the Internet and share files from each other's hard drives.
Status: Ignored

Infected files detected
C:\System Volume Information\_restore{18A3BEE4-69C8-4613-BC76-0027E40DCE5D}\RP58\A0025587.dll


WhenU.SaveNow Adware more information...
Details: WhenU.SaveNow is an adware application that displays pop-up advertising on the desktop in response to users' web browsing.
Status: Ignored

Infected files detected
C:\System Volume Information\_restore{18A3BEE4-69C8-4613-BC76-0027E40DCE5D}\RP58\A0025588.dll
C:\System Volume Information\_restore{18A3BEE4-69C8-4613-BC76-0027E40DCE5D}\RP58\A0025590.exe
C:\System Volume Information\_restore{18A3BEE4-69C8-4613-BC76-0027E40DCE5D}\RP58\A0025591.ini
C:\System Volume Information\_restore{18A3BEE4-69C8-4613-BC76-0027E40DCE5D}\RP121\A0053718.exe
C:\System Volume Information\_restore{18A3BEE4-69C8-4613-BC76-0027E40DCE5D}\RP121\A0053723.exe
C:\System Volume Information\_restore{18A3BEE4-69C8-4613-BC76-0027E40DCE5D}\RP125\A0055224.dll
C:\System Volume Information\_restore{18A3BEE4-69C8-4613-BC76-0027E40DCE5D}\RP128\A0056810.exe

Infected registry entries detected
HKEY_CLASSES_ROOT\wusn.1
HKEY_CLASSES_ROOT\wusn.1 WUSN_Id


WhenU.WhenUSearch Low Risk Adware more information...
Details: WhenU.WhenUSearch is a desktop search toolbar that displays links to advertised offers in response to users' surfing behavior and opens paid search results when users perform searches through the toolbar's search mechanism.
Status: Ignored

Infected files detected
C:\System Volume Information\_restore{18A3BEE4-69C8-4613-BC76-0027E40DCE5D}\RP122\A0054827.exe

Infected registry entries detected
HKEY_CLASSES_ROOT\WUSN.1
HKEY_CLASSES_ROOT\WUSN.1 WUSN_Id


AssasinTrojan2.0 Cookie more information...
Status: Ignored

Infected cookies detected
c:\dokumente und einstellungen\missturner\cookies\missturner@statcounter[1].txt


ATDMT.com Cookie more information...
Status: Ignored

Infected cookies detected
c:\dokumente und einstellungen\missturner\cookies\missturner@atdmt[2].txt


FastClick.com Cookie more information...
Status: Ignored

Infected cookies detected
c:\dokumente und einstellungen\missturner\cookies\missturner@fastclick[2].txt