trojaner!Probleme mit einer oder mehreren OTL/SATA Festplatten!

maik78 · 22.06.2011, 11:47

hab seit neuestem riesige probleme mit meinem com.hab mir anscheinend einen trojaner eingefangen

.nun bekomm ich immer die meldung probleme mit einer oder mehreren otl/sata festplatten.
seit dem hab ich einen schwarzen bildschirm,meine icons sind weg,desktop leer,taskmanager lässt sich nicht öffnen,festplatte zeigt an das ich noch immer den selben stand habe wie vor dem trojaner.
kann aber keine ordner öffnen da die irgendwo verschollen sind

.
hab auch schon mal das otl durchlaufen lassen.

OTL Logfile:

Code:

ATTFilter

OTL logfile created on: 20.06.2011 16:31:48 - Run 1
OTL by OldTimer - Version 3.2.24.1     Folder = C:\Users\Luffy\Downloads
Windows Vista Home Basic Edition  (Version = 6.0.6000) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18904)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
893,56 Mb Total Physical Memory | 486,90 Mb Available Physical Memory | 54,49% Memory free
2,13 Gb Paging File | 1,86 Gb Available in Paging File | 87,13% Paging File free
Paging file location(s): C:\pagefile.sys 1339 1339 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 37,26 Gb Total Space | 7,96 Gb Free Space | 21,37% Space Free | Partition Type: NTFS
 
Computer Name: WIHTEBIRT | User Name: Luffy | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Luffy\Downloads\OTL(3).exe (OldTimer Tools)
PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Users\Luffy\Downloads\OTL(3).exe (OldTimer Tools)
MOD - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Chrome\Hook\rpchrome10browserrecordhelper.dll (RealNetworks, Inc.)
MOD - C:\Windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.5570_none_509463cabcb6ef2a\msvcr90.dll (Microsoft Corporation)
MOD - C:\Windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.5570_none_509463cabcb6ef2a\msvcp90.dll (Microsoft Corporation)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6000.16386_none_5d07289e07e1d100\comctl32.dll (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (ScanQuery Service) -- C:\ProgramData\ScanQuery\scanquery141.exe ()
SRV - (avg9wd) -- C:\Program Files\AVG\AVG9\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (avg9emc) -- C:\Program Files\AVG\AVG9\avgemc.exe (AVG Technologies CZ, s.r.o.)
SRV - (ICQ Service) -- C:\Programme\ICQ6Toolbar\ICQ Service.exe ()
SRV - (Boonty Games) -- C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe (BOONTY)
SRV - (TuneUp.ProgramStatisticsSvc) -- C:\Windows\System32\TUProgSt.exe (TuneUp Software)
SRV - (TuneUp.Defrag) -- C:\Windows\System32\TuneUpDefragService.exe (TuneUp Software)
SRV - (UxTuneUp) -- C:\Windows\System32\uxtuneup.dll (TuneUp Software)
SRV - (OMSI download service) -- C:\Programme\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe ()
SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (WcesComm) -- C:\Windows\WindowsMobile\wcescomm.dll (Microsoft Corporation)
SRV - (RapiMgr) -- C:\Windows\WindowsMobile\rapimgr.dll (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (AvgTdiX) -- C:\Windows\System32\Drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.)
DRV - (AvgMfx86) -- C:\Windows\System32\Drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (AvgLdx86) -- C:\Windows\System32\Drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (AvgRkx86) -- C:\Windows\System32\Drivers\avgrkx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (VIAHdAudAddService) -- C:\Windows\System32\drivers\viahduaa.sys (VIA Technologies, Inc.)
DRV - (HdAudAddService) -- C:\Windows\System32\drivers\viahduaa.sys (VIA Technologies, Inc.)
DRV - (SIS163u) -- C:\Windows\System32\drivers\sis163u.sys (Silicon Integrated Systems Corp.)
DRV - (FETND6V) -- C:\Windows\System32\drivers\fetnd6v.sys (VIA Technologies, Inc.              )
DRV - (smserial) -- C:\Windows\System32\drivers\smserial.sys (Motorola Inc.)
DRV - (KMWDFILTER) -- C:\Windows\System32\drivers\KMWDFILTER.sys (Windows (R) Codename Longhorn DDK provider)
DRV - (s0016unic) Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (WDM) -- C:\Windows\System32\drivers\s0016unic.sys (MCCI Corporation)
DRV - (s0016nd5) Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (NDIS) -- C:\Windows\System32\drivers\s0016nd5.sys (MCCI Corporation)
DRV - (s0016mdfl) -- C:\Windows\System32\drivers\s0016mdfl.sys (MCCI Corporation)
DRV - (s0016mdm) -- C:\Windows\System32\drivers\s0016mdm.sys (MCCI Corporation)
DRV - (s0016mgmt) Sony Ericsson Device 0016 USB WMC Device Management Drivers (WDM) -- C:\Windows\System32\drivers\s0016mgmt.sys (MCCI Corporation)
DRV - (s0016obex) -- C:\Windows\System32\drivers\s0016obex.sys (MCCI Corporation)
DRV - (s0016bus) Sony Ericsson Device 0016 driver (WDM) -- C:\Windows\System32\drivers\s0016bus.sys (MCCI Corporation)
DRV - (SNPSTD3) USB PC Camera (SNPSTD3) -- C:\Windows\System32\drivers\snpstd3.sys (Sonix Co. Ltd.)
DRV - (S3G700) -- C:\Windows\System32\drivers\VTGKModeDX32.sys (S3 Graphics Co., Ltd.)
DRV - (winusb) -- C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)
DRV - (vsdatant) -- C:\Windows\System32\vsdatant.sys (Zone Labs, LLC)
DRV - (OVT511Plus) -- C:\Windows\System32\drivers\omcamvid.sys (OmniVision Technologies, Inc.)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://home.sweetim.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://start.facemoods.com/?a=ddr&s={searchTerms}&f=4
IE - HKLM\..\URLSearchHook:  - Reg Error: Key error. File not found
IE - HKLM\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKLM\..\URLSearchHook: {8dbb6d8e-e4a6-4e3b-9753-af78b226441c} - C:\Programme\Softonic_Deutsch\tbSoft.dll (Conduit Ltd.)
IE - HKLM\..\URLSearchHook: {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} - Reg Error: Key error. File not found
IE - HKLM\..\URLSearchHook: {e9911ec6-1bcc-40b0-9993-e0eea7f6953f} - C:\Programme\DVDVideoSoft\tbDVDV.dll (Conduit Ltd.)
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-2527848741-3311900059-3240881507-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = 
IE - HKU\S-1-5-21-2527848741-3311900059-3240881507-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Hamstersoft Search Start
IE - HKU\S-1-5-21-2527848741-3311900059-3240881507-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Restore = Facemoods Search
IE - HKU\S-1-5-21-2527848741-3311900059-3240881507-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-2527848741-3311900059-3240881507-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.sweetim.com/search.asp?src=2&q="
FF - prefs.js..browser.search.selectedEngine: "ICQ Search"
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"
FF - prefs.js..extensions.enabledItems: {3f963a5b-e555-4543-90e2-c3908898db71}:9.0.0.872
FF - prefs.js..extensions.enabledItems: {800b5000-a755-47e1-992b-48a1c1357f07}:1.1.9
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:14.0.3
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: ffxtlbr@Facemoods.com:1.2.1
FF - prefs.js..extensions.enabledItems: {DE9265D8-D55D-4286-9DC4-F8D8A0CA2F64}:1.0
FF - prefs.js..extensions.enabledItems: ClickPotatoLite@ClickPotatoLite.com:10.0.668.0
FF - prefs.js..keyword.URL: "hxxp://www.hamsterstart.com/s/?src=FF-Address&site=Yahoo!&cfg=2-475-0-0&q="
FF - prefs.js..sweetim.toolbar.previous.browser.search.defaultenginename: "Google"
FF - prefs.js..sweetim.toolbar.previous.browser.search.defaulturl: "hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q="
FF - prefs.js..sweetim.toolbar.previous.browser.search.selectedEngine: "ICQ Search"
FF - prefs.js..browser.startup.homepage: "hxxp://berlin.pennergame.de/"
FF - prefs.js..sweetim.toolbar.previous.keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&q="
 
 
FF - HKLM\software\mozilla\Firefox\Extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files\AVG\AVG9\Firefox [2010.11.24 21:09:28 | 000,000,000 | -H-D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{3112ca9c-de6d-4884-a869-9855de68056c}: C:\ProgramData\Google\Toolbar for Firefox\{3112ca9c-de6d-4884-a869-9855de68056c} [2010.02.06 18:31:33 | 000,000,000 | -H-D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2011.06.13 14:20:13 | 000,000,000 | -H-D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\ClickPotatoLite@ClickPotatoLite.com: C:\Program Files\ClickPotatoLite\bin\10.0.668.0\firefox\extensions [2011.04.14 07:16:42 | 000,000,000 | -H-D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.17\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.06.16 09:28:54 | 000,000,000 | -H-D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.17\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.06.16 09:28:54 | 000,000,000 | -H-D | M]
 
[2009.02.18 13:20:26 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\Luffy\AppData\Roaming\mozilla\Extensions
[2011.06.20 16:06:59 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\Luffy\AppData\Roaming\mozilla\Firefox\Profiles\li06tyiv.default\extensions
[2010.08.27 11:53:46 | 000,000,000 | -H-D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Luffy\AppData\Roaming\mozilla\Firefox\Profiles\li06tyiv.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011.06.18 01:43:20 | 000,000,000 | -H-D | M] (Google Toolbar for Firefox) -- C:\Users\Luffy\AppData\Roaming\mozilla\Firefox\Profiles\li06tyiv.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2010.02.10 19:33:51 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\Luffy\AppData\Roaming\mozilla\Firefox\Profiles\li06tyiv.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}(32)
[2011.04.04 22:03:59 | 000,000,000 | -H-D | M] ("ICQ Toolbar") -- C:\Users\Luffy\AppData\Roaming\mozilla\Firefox\Profiles\li06tyiv.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2009.05.10 14:28:14 | 000,000,000 | -H-D | M] (Softonic Deutsch Toolbar) -- C:\Users\Luffy\AppData\Roaming\mozilla\Firefox\Profiles\li06tyiv.default\extensions\{8dbb6d8e-e4a6-4e3b-9753-af78b226441c}
[2011.06.13 15:14:00 | 000,000,000 | -H-D | M] (Greasemonkey) -- C:\Users\Luffy\AppData\Roaming\mozilla\Firefox\Profiles\li06tyiv.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
[2010.02.21 12:43:12 | 000,000,000 | -H-D | M] (DVDVideoSoft Toolbar) -- C:\Users\Luffy\AppData\Roaming\mozilla\Firefox\Profiles\li06tyiv.default\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}
[2010.12.18 21:56:44 | 000,000,000 | -H-D | M] (SweetIM Toolbar for Firefox) -- C:\Users\Luffy\AppData\Roaming\mozilla\Firefox\Profiles\li06tyiv.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}
[2010.05.24 07:23:40 | 000,000,000 | -H-D | M] (SweetIM Toolbar for Firefox) -- C:\Users\Luffy\AppData\Roaming\mozilla\Firefox\Profiles\li06tyiv.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}(40)
[2011.03.19 09:38:51 | 000,000,000 | -H-D | M] (Facemoods) -- C:\Users\Luffy\AppData\Roaming\mozilla\Firefox\Profiles\li06tyiv.default\extensions\ffxtlbr@Facemoods.com
[2011.06.18 01:43:20 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\Luffy\AppData\Roaming\mozilla\Firefox\Profiles\li06tyiv.default\extensions\staged-xpis
[2011.06.19 21:25:26 | 000,000,950 | -H-- | M] () -- C:\Users\Luffy\AppData\Roaming\Mozilla\Firefox\Profiles\li06tyiv.default\searchplugins\icqplugin-1.xml
[2010.08.26 16:21:41 | 000,000,950 | -H-- | M] () -- C:\Users\Luffy\AppData\Roaming\Mozilla\Firefox\Profiles\li06tyiv.default\searchplugins\icqplugin-10.xml
[2010.08.31 06:49:05 | 000,000,950 | -H-- | M] () -- C:\Users\Luffy\AppData\Roaming\Mozilla\Firefox\Profiles\li06tyiv.default\searchplugins\icqplugin-11.xml
[2011.05.08 11:06:23 | 000,000,950 | -H-- | M] () -- C:\Users\Luffy\AppData\Roaming\Mozilla\Firefox\Profiles\li06tyiv.default\searchplugins\icqplugin-12.xml
[2011.06.12 17:30:21 | 000,000,950 | -H-- | M] () -- C:\Users\Luffy\AppData\Roaming\Mozilla\Firefox\Profiles\li06tyiv.default\searchplugins\icqplugin-13.xml
[2011.06.13 15:11:50 | 000,000,656 | -H-- | M] () -- C:\Users\Luffy\AppData\Roaming\Mozilla\Firefox\Profiles\li06tyiv.default\searchplugins\icqplugin-14.xml
[2011.06.16 20:33:56 | 000,000,950 | -H-- | M] () -- C:\Users\Luffy\AppData\Roaming\Mozilla\Firefox\Profiles\li06tyiv.default\searchplugins\icqplugin-15.xml
[2009.04.01 19:05:14 | 000,000,950 | -H-- | M] () -- C:\Users\Luffy\AppData\Roaming\Mozilla\Firefox\Profiles\li06tyiv.default\searchplugins\icqplugin-2.xml
[2009.04.06 19:17:00 | 000,000,950 | -H-- | M] () -- C:\Users\Luffy\AppData\Roaming\Mozilla\Firefox\Profiles\li06tyiv.default\searchplugins\icqplugin-3.xml
[2009.05.05 19:24:45 | 000,000,950 | -H-- | M] () -- C:\Users\Luffy\AppData\Roaming\Mozilla\Firefox\Profiles\li06tyiv.default\searchplugins\icqplugin-4.xml
[2009.06.16 00:21:13 | 000,000,950 | -H-- | M] () -- C:\Users\Luffy\AppData\Roaming\Mozilla\Firefox\Profiles\li06tyiv.default\searchplugins\icqplugin-5.xml
[2009.10.05 07:36:57 | 000,000,950 | -H-- | M] () -- C:\Users\Luffy\AppData\Roaming\Mozilla\Firefox\Profiles\li06tyiv.default\searchplugins\icqplugin-6.xml
[2009.10.11 17:09:14 | 000,000,950 | -H-- | M] () -- C:\Users\Luffy\AppData\Roaming\Mozilla\Firefox\Profiles\li06tyiv.default\searchplugins\icqplugin-7.xml
[2010.01.03 20:25:38 | 000,000,950 | -H-- | M] () -- C:\Users\Luffy\AppData\Roaming\Mozilla\Firefox\Profiles\li06tyiv.default\searchplugins\icqplugin-8.xml
[2010.01.20 15:27:48 | 000,000,950 | -H-- | M] () -- C:\Users\Luffy\AppData\Roaming\Mozilla\Firefox\Profiles\li06tyiv.default\searchplugins\icqplugin-9.xml
[2010.04.22 14:33:22 | 000,000,945 | -H-- | M] () -- C:\Users\Luffy\AppData\Roaming\Mozilla\Firefox\Profiles\li06tyiv.default\searchplugins\icqplugin.xml
[2010.12.18 21:56:27 | 000,003,915 | -H-- | M] () -- C:\Users\Luffy\AppData\Roaming\Mozilla\Firefox\Profiles\li06tyiv.default\searchplugins\sweetim.xml
[2011.06.10 08:05:33 | 000,001,061 | -H-- | M] () -- C:\Users\Luffy\AppData\Roaming\Mozilla\Firefox\Profiles\li06tyiv.default\searchplugins\yahoo-zugo.xml
[2011.06.19 21:25:23 | 000,000,000 | -H-D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2010.11.02 20:37:01 | 000,000,000 | -H-D | M] ("ICQ Toolbar") -- C:\Programme\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2010.02.11 22:14:36 | 000,000,000 | -H-D | M] ("ICQ Toolbar") -- C:\Programme\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}(11)
[2010.03.02 08:31:31 | 000,000,000 | -H-D | M] ("ICQ Toolbar") -- C:\Programme\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}(17)
[2010.03.02 09:00:33 | 000,000,000 | -H-D | M] ("ICQ Toolbar") -- C:\Programme\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}(18)
[2010.05.24 14:28:21 | 000,000,000 | -H-D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010.08.22 21:20:45 | 000,000,000 | -H-D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2010.11.03 14:25:27 | 000,000,000 | -H-D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2011.06.10 15:02:03 | 000,000,000 | -H-D | M] (ScanQuery) -- C:\Programme\Mozilla Firefox\extensions\{DE9265D8-D55D-4286-9DC4-F8D8A0CA2F64}
[2010.11.24 21:09:28 | 000,000,000 | -H-D | M] (AVG Safe Search) -- C:\PROGRAM FILES\AVG\AVG9\FIREFOX
[2011.04.14 07:16:42 | 000,000,000 | -H-D | M] (ClickPotatoLite Component) -- C:\PROGRAM FILES\CLICKPOTATOLITE\BIN\10.0.668.0\FIREFOX\EXTENSIONS
[2009.04.10 15:51:23 | 000,000,000 | -H-D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
[2009.08.29 07:01:01 | 000,000,000 | -H-D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
[2009.12.01 19:22:59 | 000,000,000 | -H-D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
[2010.05.24 14:28:21 | 000,000,000 | -H-D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010.08.22 21:20:45 | 000,000,000 | -H-D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2010.11.03 14:25:27 | 000,000,000 | -H-D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2011.06.10 15:02:03 | 000,000,000 | -H-D | M] (ScanQuery) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{DE9265D8-D55D-4286-9DC4-F8D8A0CA2F64}
[2011.06.13 14:20:13 | 000,000,000 | -H-D | M] (RealPlayer Browser Record Plugin) -- C:\PROGRAMDATA\REAL\REALPLAYER\BROWSERRECORDPLUGIN\FIREFOX\EXT
[2010.09.15 05:50:38 | 000,472,808 | -H-- | M] (Sun Microsystems, Inc.) -- C:\Programme\Mozilla Firefox\plugins\npdeployJava1.dll
[2011.06.16 09:28:41 | 000,001,392 | -H-- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2011.06.16 09:28:41 | 000,002,344 | -H-- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml
[2011.03.19 09:39:05 | 000,002,046 | -H-- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\fcmdSrchddr.xml
[2011.06.16 09:28:42 | 000,006,805 | -H-- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2011.06.16 09:28:42 | 000,001,178 | -H-- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2011.06.16 09:28:42 | 000,001,105 | -H-- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | -H-- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1             localhost
O2 - BHO: (ShoppingReport2) - {258C9770-1713-4021-8D7E-1F184A2BD754} - C:\Programme\ShoppingReport2\Bin\2.7.34\ShoppingReport.dll (SmartShopper Networks)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Programme\AVG\AVG9\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (CescrtHlpr Object) - {64182481-4F71-486b-A045-B233BD0DA8FC} - C:\Programme\facemoods.com\facemoods\1.4.17.5\bh\facemoods.dll (facemoods.com BHO)
O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Programme\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)
O2 - BHO: (Softonic Deutsch Toolbar) - {8dbb6d8e-e4a6-4e3b-9753-af78b226441c} - C:\Programme\Softonic_Deutsch\tbSoft.dll (Conduit Ltd.)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\Programme\Google\GoogleToolbar1.dll (Google Germany GmbH)
O2 - BHO: (DVDVideoSoft Toolbar) - {e9911ec6-1bcc-40b0-9993-e0eea7f6953f} - C:\Programme\DVDVideoSoft\tbDVDV.dll (Conduit Ltd.)
O2 - BHO: (SweetIM Toolbar Helper) - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
O3 - HKLM\..\Toolbar: (facemoods Toolbar) - {DB4E9724-F518-4dfd-9C7C-78B52103CAB9} - C:\Programme\facemoods.com\facemoods\1.4.17.5\facemoodsTlbr.dll (facemoods.com)
O3 - HKLM\..\Toolbar: (DVDVideoSoft Toolbar) - {e9911ec6-1bcc-40b0-9993-e0eea7f6953f} - C:\Programme\DVDVideoSoft\tbDVDV.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (SweetIM Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O3 - HKU\S-1-5-21-2527848741-3311900059-3240881507-1000\..\Toolbar\WebBrowser: (DVDVideoSoft Toolbar) - {E9911EC6-1BCC-40B0-9993-E0EEA7F6953F} - C:\Programme\DVDVideoSoft\tbDVDV.dll (Conduit Ltd.)
O3 - HKU\S-1-5-21-2527848741-3311900059-3240881507-1000\..\Toolbar\WebBrowser: (SweetIM Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O4 - HKLM..\Run: [AVG9_TRAY] C:\Programme\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [ClickPotatoLiteSA] C:\Program Files\ClickPotatoLite\bin\10.0.668.0\ClickPotatoLiteSA.exe (Pinball Corporation.)
O4 - HKLM..\Run: [facemoods] C:\Program Files\facemoods.com\facemoods\1.4.17.5\facemoodssrv.exe (facemoods.com)
O4 - HKLM..\Run: [NeroFilterCheck] C:\Programme\Common Files\Ahead\Lib\NeroCheck.exe (Nero AG)
O4 - HKLM..\Run: [SMSERIAL] C:\Programme\Motorola\SMSERIAL\sm56hlpr.exe (Motorola Inc.)
O4 - HKLM..\Run: [snpstd3] C:\Windows\vsnpstd3.exe ()
O4 - HKLM..\Run: [SweetIM] C:\Programme\SweetIM\Messenger\SweetIM.exe (SweetIM Technologies Ltd.)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Real\RealPlayer\update\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKLM..\Run: [Windows Mobile-based device management] C:\Windows\WindowsMobile\wmdSync.exe (Microsoft Corporation)
O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-21-2527848741-3311900059-3240881507-1000..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe (Nero AG)
O4 - HKU\S-1-5-21-2527848741-3311900059-3240881507-1000..\Run: [BitTorrent DNA] C:\Users\Luffy\Program Files\DNA\btdna.exe (BitTorrent, Inc.)
O4 - HKU\S-1-5-21-2527848741-3311900059-3240881507-1000..\Run: [fVsVFGfVFkPeQTy] C:\ProgramData\fVsVFGfVFkPeQTy.exe (Sysinternals)
O4 - HKU\S-1-5-21-2527848741-3311900059-3240881507-1000..\Run: [GMX SMS-Manager] C:\Programme\GMX\GMX SMS-Manager\SMSMngr.exe (1&1 Internet AG)
O4 - HKU\S-1-5-21-2527848741-3311900059-3240881507-1000..\Run: [Sony Ericsson PC Suite] C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe (Sony Ericsson Mobile Communications AB)
O4 - HKU\S-1-5-21-2527848741-3311900059-3240881507-1000..\Run: [swg] C:\Programme\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe (Google Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O7 - HKU\S-1-5-21-2527848741-3311900059-3240881507-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O9 - Extra Button: ICQ7.4 - {73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - C:\Programme\ICQ7.4\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.4 - {73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - C:\Programme\ICQ7.4\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: ClickPotato - {B58926D6-CFB0-45d2-9C28-4B5A0F0368AE} - C:\Programme\ClickPotatoLite\bin\10.0.668.0\ClickPotatoLiteSABHO.dll (Pinball Corporation)
O9 - Extra Button: ShopperReports - Compare product prices - {DB38E21A-0133-419d-92AD-ECDFD5244D6D} - C:\Programme\ShoppingReport2\Bin\2.7.34\ShoppingReport.dll (SmartShopper Networks)
O9 - Extra Button: ShopperReports - Compare travel rates - {EB620C54-E229-4942-87CE-E717109FC8C6} - C:\Programme\ShoppingReport2\Bin\2.7.34\ShoppingReport.dll (SmartShopper Networks)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} hxxp://icq.oberon-media.com/Gameshell/GameHost/1.0/OberonGameHost.cab (Oberon Flash Game Host)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Programme\AVG\AVG9\avgpp.dll (AVG Technologies CZ, s.r.o.)
O20 - AppInit_DLLs: (avgrsstx.dll) - C:\Windows\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Luffy\Desktop\Neuer Ordner\symbole_files\(03)_Hak.JPG
O24 - Desktop BackupWallPaper: C:\Users\Luffy\Desktop\Neuer Ordner\symbole_files\(03)_Hak.JPG
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | -H-- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{69018abc-f15a-11de-8180-00a0d1c4b279}\Shell - "" = AutoRun
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
NetSvcs: UxTuneUp - C:\Windows\System32\uxtuneup.dll (TuneUp Software)
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias -  File not found
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
 
SafeBootMin: AppMgmt - Service
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: NTDS -  File not found
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet: AppMgmt - Service
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: NTDS -  File not found
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - 
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0
ActiveX: {23325F73-AF59-1597-8F0F-C604055ABA54} - .NET Framework
ActiveX: {233C1507-6A77-46A4-9443-F871F945D258} - Adobe Shockwave Director 11.0.3
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2A202491-F00D-11cf-87CC-0020AFEECF20} - Adobe Shockwave Director 11.0.3
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - 
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {DAA94A2A-2A8D-4D3B-9DB8-56FBECED082D} - Microsoft .NET Framework 1.1 Security Update (KB953297)
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E78BFA60-5393-4C38-82AB-E8019E464EB4} - .NET Framework
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.lhacm - C:\Windows\System32\lhacm.acm (Microsoft Corporation)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.XVID - C:\Windows\System32\xvidvfw.dll ()
Drivers32: wave1 - C:\Windows\System32\serwvdrv.dll (Microsoft Corporation)
 
CREATERESTOREPOINT
Error creating restore point.
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.06.20 13:54:40 | 000,000,000 | -H-D | C] -- C:\Users\Luffy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Vista Repair
[2011.06.20 13:53:48 | 000,364,544 | -H-- | C] (Sysinternals) -- C:\ProgramData\29089552.exe
[2011.06.20 13:44:28 | 000,452,608 | -H-- | C] (Sysinternals) -- C:\ProgramData\fVsVFGfVFkPeQTy.exe
[2011.06.16 00:53:13 | 000,000,000 | -H-D | C] -- C:\6b149aa75bb92c904a121bb2
[2011.06.10 08:06:01 | 000,000,000 | -H-D | C] -- C:\Users\Luffy\AppData\Roaming\HamsterSoft
[2011.06.10 08:05:46 | 000,000,000 | -H-D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hamster Soft
[2011.06.10 08:05:41 | 000,000,000 | -H-D | C] -- C:\Programme\Hamster Soft
[2011.06.10 08:03:04 | 000,314,808 | -H-- | C] (HamsterSoft, Inc.) -- C:\Users\Luffy\Desktop\hamsterfreevideoconverter.exe
[2011.06.08 11:55:30 | 000,000,000 | -H-D | C] -- C:\Users\Luffy\Desktop\dragons
[2011.06.07 11:56:05 | 000,000,000 | -H-D | C] -- C:\Programme\Common Files\xing shared
[2011.06.07 11:55:50 | 000,198,848 | -H-- | C] (RealNetworks, Inc.) -- C:\Windows\System32\rmoc3260.dll
[2011.06.07 11:55:35 | 000,006,656 | -H-- | C] (RealNetworks, Inc.) -- C:\Windows\System32\pndx5016.dll
[2011.06.07 11:55:35 | 000,005,632 | -H-- | C] (RealNetworks, Inc.) -- C:\Windows\System32\pndx5032.dll
[2011.06.07 11:55:33 | 000,000,000 | -H-D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Real
[2011.05.27 01:33:24 | 000,000,000 | -H-D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth
[2010.07.05 20:28:50 | 000,148,736 | -H-- | C] (Avanquest Software) -- C:\ProgramData\hpe5275.dll
[2007.03.12 12:41:52 | 000,061,440 | -H-- | C] ( ) -- C:\Windows\System32\vsnpstd3.dll
[2005.11.23 13:55:32 | 000,053,248 | -H-- | C] ( ) -- C:\Windows\System32\csnpstd3.dll
[1 C:\*.tmp files -> C:\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2011.06.20 16:23:52 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011.06.20 16:03:18 | 000,000,522 | -H-- | M] () -- C:\Windows\tasks\1-Klick-Wartung.job
[2011.06.20 16:01:54 | 000,003,552 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011.06.20 16:01:54 | 000,003,552 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011.06.20 16:01:54 | 000,001,094 | -H-- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011.06.20 15:37:15 | 000,229,672 | -H-- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2011.06.20 15:33:55 | 000,000,286 | -H-- | M] () -- C:\Windows\tasks\RealUpgradeScheduledTaskS-1-5-21-2527848741-3311900059-3240881507-1000.job
[2011.06.20 14:24:01 | 000,001,098 | -H-- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011.06.20 13:55:19 | 000,000,224 | -H-- | M] () -- C:\ProgramData\~29089552
[2011.06.20 13:55:18 | 000,000,152 | -H-- | M] () -- C:\ProgramData\~29089552r
[2011.06.20 13:54:41 | 000,000,591 | -H-- | M] () -- C:\Users\Luffy\Desktop\Windows Vista Repair.lnk
[2011.06.20 13:54:20 | 000,000,336 | -H-- | M] () -- C:\ProgramData\29089552
[2011.06.20 13:53:48 | 000,364,544 | -H-- | M] (Sysinternals) -- C:\ProgramData\29089552.exe
[2011.06.20 13:44:26 | 000,452,608 | -H-- | M] (Sysinternals) -- C:\ProgramData\fVsVFGfVFkPeQTy.exe
[2011.06.20 10:25:05 | 078,264,409 | -H-- | M] () -- C:\Windows\System32\drivers\Avg\incavi.avm
[2011.06.20 10:18:42 | 000,000,436 | -H-- | M] () -- C:\Windows\System32\drivers\etc\hosts.ics
[2011.06.10 08:05:50 | 000,001,108 | -H-- | M] () -- C:\Users\Luffy\Desktop\Hamster Free Video Converter.lnk
[2011.06.10 08:03:06 | 000,314,808 | -H-- | M] (HamsterSoft, Inc.) -- C:\Users\Luffy\Desktop\hamsterfreevideoconverter.exe
[2011.06.08 11:58:43 | 000,001,637 | -H-- | M] () -- C:\Users\Luffy\Desktop\Paint.lnk
[2011.06.07 11:55:50 | 000,198,848 | -H-- | M] (RealNetworks, Inc.) -- C:\Windows\System32\rmoc3260.dll
[2011.06.07 11:55:35 | 000,006,656 | -H-- | M] (RealNetworks, Inc.) -- C:\Windows\System32\pndx5016.dll
[2011.06.07 11:55:35 | 000,005,632 | -H-- | M] (RealNetworks, Inc.) -- C:\Windows\System32\pndx5032.dll
[2011.06.07 11:55:33 | 000,272,896 | -H-- | M] (Progressive Networks) -- C:\Windows\System32\pncrt.dll
[2011.06.02 11:34:39 | 004,045,158 | -H-- | M] () -- C:\Windows\System32\perfh007.dat
[2011.06.02 11:34:39 | 001,665,680 | -H-- | M] () -- C:\Windows\System32\perfh009.dat
[2011.06.02 11:34:39 | 001,234,642 | -H-- | M] () -- C:\Windows\System32\perfc007.dat
[2011.06.02 11:34:39 | 001,112,968 | -H-- | M] () -- C:\Windows\System32\perfc009.dat
[2011.06.02 11:34:02 | 000,000,069 | -H-- | M] () -- C:\Windows\NeroDigital.ini
[2011.06.02 11:33:59 | 000,127,488 | -H-- | M] () -- C:\Users\Luffy\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[1 C:\*.tmp files -> C:\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2011.06.20 15:33:55 | 000,000,286 | -H-- | C] () -- C:\Windows\tasks\RealUpgradeScheduledTaskS-1-5-21-2527848741-3311900059-3240881507-1000.job
[2011.06.20 13:55:18 | 000,000,224 | -H-- | C] () -- C:\ProgramData\~29089552
[2011.06.20 13:55:18 | 000,000,152 | -H-- | C] () -- C:\ProgramData\~29089552r
[2011.06.20 13:54:41 | 000,000,591 | -H-- | C] () -- C:\Users\Luffy\Desktop\Windows Vista Repair.lnk
[2011.06.20 13:54:20 | 000,000,336 | -H-- | C] () -- C:\ProgramData\29089552
[2011.06.10 08:05:50 | 000,001,108 | -H-- | C] () -- C:\Users\Luffy\Desktop\Hamster Free Video Converter.lnk
[2011.06.08 11:58:43 | 000,001,637 | -H-- | C] () -- C:\Users\Luffy\Desktop\Paint.lnk
[2011.04.14 07:17:55 | 000,650,752 | -H-- | C] () -- C:\Windows\System32\xvidcore.dll
[2011.04.14 07:17:55 | 000,240,640 | -H-- | C] () -- C:\Windows\System32\xvidvfw.dll
[2010.05.30 11:53:58 | 000,000,151 | -H-- | C] () -- C:\Windows\PhotoSnapViewer.INI
[2010.02.06 20:57:47 | 000,000,618 | -H-- | C] () -- C:\Windows\eReg.dat
[2010.01.14 21:55:42 | 000,000,960 | -H-- | C] () -- C:\ProgramData\ss.ini
[2010.01.01 20:05:39 | 000,307,200 | -H-- | C] () -- C:\Windows\System32\AscSQLite.dll
[2009.10.12 22:32:09 | 000,000,069 | -H-- | C] () -- C:\Windows\NeroDigital.ini
[2009.10.12 22:20:29 | 000,000,039 | -H-- | C] () -- C:\Windows\Irremote.ini
[2009.06.02 20:05:18 | 000,000,088 | -H-- | C] () -- C:\Users\Luffy\AppData\Local\koega.bat
[2009.06.02 15:16:48 | 000,321,462 | -H-- | C] () -- C:\Users\Luffy\AppData\Local\gokui_nav.dat
[2009.06.02 15:16:48 | 000,000,643 | -H-- | C] () -- C:\Users\Luffy\AppData\Local\gokui_navps.dat
[2009.05.27 19:39:20 | 000,000,090 | -H-- | C] () -- C:\Users\Luffy\AppData\Local\ysgwyee.bat
[2009.05.27 08:02:16 | 000,000,088 | -H-- | C] () -- C:\Users\Luffy\AppData\Local\ucgye.bat
[2009.05.19 20:12:35 | 000,000,090 | -H-- | C] () -- C:\Users\Luffy\AppData\Local\sscqwuq.bat
[2009.05.19 12:29:36 | 000,000,090 | -H-- | C] () -- C:\Users\Luffy\AppData\Local\eaqukcm.bat
[2009.05.13 19:16:58 | 000,000,088 | -H-- | C] () -- C:\Users\Luffy\AppData\Local\uwqwe.bat
[2009.05.09 09:56:56 | 000,000,088 | -H-- | C] () -- C:\Users\Luffy\AppData\Local\qyiym.bat
[2009.05.04 16:07:04 | 000,024,206 | -H-- | C] () -- C:\Users\Luffy\AppData\Roaming\UserTile.png
[2009.04.24 18:52:41 | 000,000,088 | -H-- | C] () -- C:\Users\Luffy\AppData\Local\awwkm.bat
[2009.04.23 09:32:13 | 000,000,306 | RHS- | C] () -- C:\ProgramData\ntuser.pol
[2009.04.22 09:12:59 | 000,000,090 | -H-- | C] () -- C:\Users\Luffy\AppData\Local\igemwmi.bat
[2009.04.21 09:43:42 | 000,000,090 | -H-- | C] () -- C:\Users\Luffy\AppData\Local\smekscg.bat
[2009.04.21 08:47:36 | 000,000,031 | -H-- | C] () -- C:\Windows\warhead.ini
[2009.04.19 10:00:52 | 000,000,040 | -H-- | C] () -- C:\Windows\SIERRA.INI
[2009.04.18 12:01:37 | 000,069,632 | -H-- | C] () -- C:\Windows\System32\xmltok.dll
[2009.04.18 12:01:37 | 000,036,864 | -H-- | C] () -- C:\Windows\System32\xmlparse.dll
[2009.04.18 11:33:20 | 000,000,068 | -H-- | C] () -- C:\Windows\WININIT.INI
[2009.04.18 10:59:01 | 000,118,784 | -H-- | C] () -- C:\Windows\bwUnin-6.3.2.62-4476822L.exe
[2009.04.17 10:57:39 | 000,003,934 | -H-- | C] () -- C:\Windows\cdplayer.ini
[2009.04.17 09:55:54 | 000,127,488 | -H-- | C] () -- C:\Users\Luffy\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009.03.12 04:42:36 | 000,000,090 | -H-- | C] () -- C:\Users\Luffy\AppData\Local\oameg.bat
[2009.02.16 15:20:50 | 000,000,093 | -H-- | C] () -- C:\Users\Luffy\AppData\Local\fusioncache.dat
[2008.10.13 01:15:24 | 000,290,748 | -H-- | C] () -- C:\Windows\System32\perfi007.dat
[2008.10.13 01:15:23 | 004,045,158 | -H-- | C] () -- C:\Windows\System32\perfh007.dat
[2008.10.13 01:15:23 | 001,234,642 | -H-- | C] () -- C:\Windows\System32\perfc007.dat
[2008.10.13 01:15:23 | 000,036,916 | -H-- | C] () -- C:\Windows\System32\perfd007.dat
[2008.10.12 15:28:35 | 000,000,680 | -H-- | C] () -- C:\Users\Luffy\AppData\Local\d3d9caps.dat
[2006.11.02 14:53:49 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006.11.02 14:44:53 | 000,229,672 | -H-- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006.11.02 12:33:01 | 001,665,680 | -H-- | C] () -- C:\Windows\System32\perfh009.dat
[2006.11.02 12:33:01 | 001,112,968 | -H-- | C] () -- C:\Windows\System32\perfc009.dat
[2006.11.02 12:33:01 | 000,287,440 | -H-- | C] () -- C:\Windows\System32\perfi009.dat
[2006.11.02 12:33:01 | 000,030,674 | -H-- | C] () -- C:\Windows\System32\perfd009.dat
[2006.11.02 12:23:21 | 000,215,943 | -H-- | C] () -- C:\Windows\System32\dssec.dat
[2006.11.02 10:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006.11.02 10:19:00 | 000,000,741 | -H-- | C] () -- C:\Windows\System32\NOISE.DAT
[2006.11.02 09:40:29 | 000,013,750 | -H-- | C] () -- C:\Windows\System32\pacerprf.ini
[2006.11.02 09:25:31 | 000,673,088 | -H-- | C] () -- C:\Windows\System32\mlang.dat
[2006.11.02 09:22:43 | 000,099,999 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2006.11.02 09:22:43 | 000,018,271 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2006.10.27 08:26:56 | 000,069,632 | -H-- | C] () -- C:\Windows\System32\vuins32.dll
[2006.09.19 10:07:28 | 000,827,392 | -H-- | C] () -- C:\Windows\vsnpstd3.exe
[2004.02.27 17:36:18 | 000,015,498 | -H-- | C] () -- C:\Windows\snpstd3.ini
[2001.09.18 13:00:00 | 000,065,536 | -H-- | C] () -- C:\Windows\System32\bmpproc.dll
[2001.09.18 13:00:00 | 000,032,528 | -H-- | C] () -- C:\Windows\amcap.exe
 
========== LOP Check ==========
 
[2009.05.10 21:13:21 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\AntsSoft
[2010.01.01 21:17:22 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\Auslogics
[2011.04.14 07:16:42 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\ClickPotatoLite
[2011.05.15 21:08:07 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\com.johnwu.sparkboothhome
[2011.06.20 16:07:21 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\DNA
[2009.05.10 14:48:01 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\gtk-2.0
[2011.06.10 08:06:01 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\HamsterSoft
[2011.06.20 13:09:56 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\ICQ
[2009.05.21 13:01:33 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\IrfanView
[2009.05.22 22:54:40 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\Opera
[2009.04.08 00:34:12 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\phonostar-Player
[2010.04.24 20:50:14 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\Sony
[2010.05.24 14:28:24 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\Sony Setup
[2009.02.16 15:17:36 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\T-Online
[2011.05.08 22:25:29 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\TS3Client
[2009.04.15 11:28:55 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\TuneUp Software
[2010.06.02 18:12:51 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\Uniblue
[2011.06.12 12:21:45 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\UseNeXT
[2011.06.20 16:03:18 | 000,000,522 | -H-- | M] () -- C:\Windows\Tasks\1-Klick-Wartung.job
[2011.06.20 16:00:28 | 000,032,620 | -H-- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2011.05.15 21:05:08 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\Adobe
[2010.07.17 11:21:30 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\Ahead
[2009.05.10 21:13:21 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\AntsSoft
[2010.05.03 08:15:22 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\Apple Computer
[2010.01.01 21:17:22 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\Auslogics
[2011.04.14 07:16:42 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\ClickPotatoLite
[2011.05.15 21:08:07 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\com.johnwu.sparkboothhome
[2011.06.20 16:07:21 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\DNA
[2011.04.03 00:33:05 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\dvdcss
[2009.02.16 15:52:41 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\Google
[2009.05.10 14:48:01 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\gtk-2.0
[2011.06.10 08:06:01 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\HamsterSoft
[2011.06.20 13:09:56 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\ICQ
[2008.10.12 15:28:41 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\Identities
[2009.05.21 13:01:33 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\IrfanView
[2009.02.13 18:34:59 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\Macromedia
[2010.10.25 13:26:24 | 000,000,000 | --SD | M] -- C:\Users\Luffy\AppData\Roaming\Microsoft
[2009.02.18 13:20:26 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\Mozilla
[2009.10.12 22:29:36 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\Nero
[2009.05.22 22:54:40 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\Opera
[2009.04.08 00:34:12 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\phonostar-Player
[2011.06.07 11:56:39 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\Real
[2010.04.24 20:50:14 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\Sony
[2010.05.24 14:28:24 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\Sony Setup
[2009.02.16 15:17:36 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\T-Online
[2011.05.15 21:29:31 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\teamspeak2
[2011.05.08 22:25:29 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\TS3Client
[2009.04.15 11:28:55 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\TuneUp Software
[2009.12.25 19:28:35 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\U3
[2010.06.02 18:12:51 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\Uniblue
[2011.06.12 12:21:45 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\UseNeXT
[2011.03.11 08:27:21 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\vlc
[2010.09.21 20:36:05 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\WinRAR
 
< %APPDATA%\*.exe /s >
[2010.04.24 20:47:55 | 000,010,134 | RH-- | M] () -- C:\Users\Luffy\AppData\Roaming\Microsoft\Installer\{0E532C84-4275-41B3-9D81-D4A1A20D8EE7}\ARPPRODUCTICON.exe
[2011.01.23 19:26:00 | 000,510,120 | -H-- | M] (RealNetworks, Inc.) -- C:\Users\Luffy\AppData\Roaming\Real\Update\setup3.13\setup.exe
[2010.04.24 20:40:13 | 033,850,672 | -H-- | M] (Apple Inc.) -- C:\Users\Luffy\AppData\Roaming\Sony Setup\9234765D-29DF-48d0-93FB-284B7B6009B9\QuickTimeInstaller.exe
[2007.10.23 10:27:20 | 000,110,592 | -H-- | M] () -- C:\Users\Luffy\AppData\Roaming\U3\temp\cleanup.exe
[2008.05.02 11:41:48 | 003,493,888 | -H-- | M] (SanDisk Corporation) -- C:\Users\Luffy\AppData\Roaming\U3\temp\Launchpad Removal.exe
[2010.06.14 22:06:15 | 005,037,504 | -H-- | M] (Uniblue Systems Ltd                                         ) -- C:\Users\Luffy\AppData\Roaming\Uniblue\RegistryBooster\_temp\ub.exe
 
< %SYSTEMDRIVE%\*.exe >
 
 
< MD5 for: AGP440.SYS  >
[2006.11.02 11:49:52 | 000,053,864 | -H-- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\drivers\AGP440.sys
[2006.11.02 11:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2006.11.02 11:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys
[2009.02.14 14:51:17 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\Windows\System32\drivers\atapi.sys
[2009.02.14 14:51:17 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_7de13c21\atapi.sys
[2009.02.14 14:51:17 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16632_none_db337a442479c42c\atapi.sys
[2009.02.14 14:51:17 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=E03E8C99D15D0381E02743C36AFC7C6F -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20757_none_dbac78a93da31a8b\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll
[2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll
 
< MD5 for: EXPLORER.EXE  >
[2009.02.14 14:50:34 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=37440D09DEAE0B672A04DCCF7ABF06BE -- C:\Windows\explorer.exe
[2009.02.14 14:50:34 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=37440D09DEAE0B672A04DCCF7ABF06BE -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_4f83bb287ccdb7e3\explorer.exe
[2009.02.14 14:50:33 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_5177ca9879e978e8\explorer.exe
[2009.02.14 14:50:32 | 002,927,616 | ---- | M] (Microsoft Corporation) MD5=50BA5850147410CDE89C523AD3BC606E -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_51e4f8c7931bd1e1\explorer.exe
[2009.02.14 15:09:03 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=6D06CD98D954FE87FB2DB8108793B399 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16549_none_4fac29707cae347a\explorer.exe
[2009.02.14 15:09:03 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=BD06F0BF753BC704B653C3A50F89D362 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20668_none_501f261995dcf2cf\explorer.exe
[2009.02.14 14:50:33 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=E7156B0B74762D9DE0E66BDCDE06E5FB -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_5033cb5995cd990b\explorer.exe
[2006.11.02 11:45:07 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=FD8C53FB002217F6F888BCF6F5D7084D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16386_none_4f7de5167cd15deb\explorer.exe
 
< MD5 for: IASTORV.SYS  >
[2006.11.02 11:51:25 | 000,232,040 | -H-- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\drivers\iaStorV.sys
[2006.11.02 11:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2006.11.02 11:46:11 | 000,559,616 | ---- | M] (Microsoft Corporation) MD5=889A2C9F2AACCD8F64EF50AC0B3D553B -- C:\Windows\System32\netlogon.dll
[2006.11.02 11:46:11 | 000,559,616 | ---- | M] (Microsoft Corporation) MD5=889A2C9F2AACCD8F64EF50AC0B3D553B -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6000.16386_none_fb80f5473b0ed783\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2006.11.02 11:50:13 | 000,040,040 | -H-- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\drivers\nvstor.sys
[2006.11.02 11:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2006.11.02 11:46:12 | 000,176,640 | ---- | M] (Microsoft Corporation) MD5=80E2839D05CA5970A86D7BE2A08BFF61 -- C:\Windows\System32\scecli.dll
[2006.11.02 11:46:12 | 000,176,640 | ---- | M] (Microsoft Corporation) MD5=80E2839D05CA5970A86D7BE2A08BFF61 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6000.16386_none_35d7205fdc305e3e\scecli.dll
 
< MD5 for: USER32.DLL  >
[2009.02.14 14:37:58 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=63B4F59D7C89B1BF5277F1FFEFD491CD -- C:\Windows\System32\user32.dll
[2009.02.14 14:37:58 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=63B4F59D7C89B1BF5277F1FFEFD491CD -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.16438_none_cb39bc5b7047127e\user32.dll
[2009.02.14 14:37:58 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=9D9F061EDA75425FC67F0365E3467C86 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.20537_none_cbc258dc896598f1\user32.dll
[2006.11.02 11:46:13 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=E698A5437B89A285ACA3FF022356810A -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.16386_none_cb01aa4570716e5e\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2006.11.02 11:45:50 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=22027835939F86C3E47AD8E3FBDE3D11 -- C:\Windows\System32\userinit.exe
[2006.11.02 11:45:50 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=22027835939F86C3E47AD8E3FBDE3D11 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6000.16386_none_d9f1f819d4c4e737\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2006.11.02 11:45:57 | 000,308,224 | ---- | M] (Microsoft Corporation) MD5=9F75392B9128A91ABAFB044EA350BAAD -- C:\Windows\System32\winlogon.exe
[2006.11.02 11:45:57 | 000,308,224 | ---- | M] (Microsoft Corporation) MD5=9F75392B9128A91ABAFB044EA350BAAD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6000.16386_none_6d8c3f1ad8066b21\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2006.11.02 10:58:26 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=84620AECDCFD2A7A14E6263927D8C0ED -- C:\Windows\System32\drivers\ws2ifsl.sys
[2006.11.02 10:58:26 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=84620AECDCFD2A7A14E6263927D8C0ED -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6000.16386_none_4d4fded8cae2956d\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
[2006.11.02 12:34:05 | 000,008,192 | -H-- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV
[2006.11.02 12:34:05 | 000,020,480 | -H-- | M] () -- C:\Windows\System32\config\DEFAULT.SAV
[2006.11.02 12:34:05 | 000,008,192 | -H-- | M] () -- C:\Windows\System32\config\SECURITY.SAV
[2006.11.02 12:34:08 | 010,133,504 | -H-- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV
[2006.11.02 12:34:08 | 001,826,816 | -H-- | M] () -- C:\Windows\System32\config\SYSTEM.SAV
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
 
< End of report >

--- --- ---

OTL EXTRAS Logfile:

Code:

ATTFilter

OTL Extras logfile created on: 20.06.2011 16:31:48 - Run 1
OTL by OldTimer - Version 3.2.24.1     Folder = C:\Users\Luffy\Downloads
Windows Vista Home Basic Edition  (Version = 6.0.6000) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18904)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
893,56 Mb Total Physical Memory | 486,90 Mb Available Physical Memory | 54,49% Memory free
2,13 Gb Paging File | 1,86 Gb Available in Paging File | 87,13% Paging File free
Paging file location(s): C:\pagefile.sys 1339 1339 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 37,26 Gb Total Space | 7,96 Gb Free Space | 21,37% Space Free | Partition Type: NTFS
 
Computer Name: WIHTEBIRT | User Name: Luffy | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
 
[HKEY_USERS\S-1-5-21-2527848741-3311900059-3240881507-1000\SOFTWARE\Classes\<extension>]
.html [@ = ChromeHTML] -- Reg Error: Key error. File not found
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{01F71303-4B2B-45BD-BBE8-EEEF5A4216ED}" = lport=547 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 
"{0981C61B-FAB8-4E77-8DC3-4ED82BE11027}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{0CB808FE-E529-43AB-8921-365ED5816D8A}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{13B52BC0-C6B2-4E6E-A1DA-8F95F78F14C2}" = lport=67 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 
"{19A9A0F2-FAD7-4A2E-BDD5-2AC6DEC73021}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
"{1CF9BBDB-5877-4A83-B631-2722267A6835}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
"{389158C0-1863-44A2-973F-6FA4CB6D4A03}" = lport=53 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 
"{3E171DF2-5F3D-48BF-AF7F-44E70EFBC3C9}" = lport=139 | protocol=6 | dir=in | app=system | 
"{3E323BBD-DA55-4B1B-9C24-AC3CE1E512DC}" = rport=445 | protocol=6 | dir=out | app=system | 
"{860FF4AE-6755-4F68-9D62-8C489B1CDA3A}" = rport=2869 | protocol=6 | dir=out | app=system | 
"{87DD8C26-E64F-4478-A307-6D2999FC9511}" = lport=137 | protocol=17 | dir=in | app=system | 
"{9CACE15F-B4F7-4F23-8A60-790C741C3B2F}" = rport=139 | protocol=6 | dir=out | app=system | 
"{AB8F2F94-5212-48D1-A5E7-B45B403280F6}" = rport=137 | protocol=17 | dir=out | app=system | 
"{AE8ED6BB-001E-4BAF-9022-1AA72E2540CD}" = rport=138 | protocol=17 | dir=out | app=system | 
"{BE763485-BFD2-4A8E-AD10-AB850DA7F7E1}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{DECB7256-2AFB-468F-8F17-761F20EE9765}" = lport=68 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 
"{EB722D7E-DE87-4414-943E-0AC8759595E6}" = lport=138 | protocol=17 | dir=in | app=system | 
"{FFDE602C-6D6E-4CC5-BB5D-7B61C4EE0B65}" = lport=445 | protocol=6 | dir=in | app=system | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{14F13C46-891D-4AAC-AA6F-106D05BE45F6}" = dir=in | app=c:\program files\avg\avg9\avgdiagex.exe | 
"{16B83387-F3DA-408B-B1AE-6567B3C6D7E8}" = protocol=6 | dir=in | app=c:\program files\icq7.4\icq.exe | 
"{180FECEC-8001-43DC-A9A3-7EAF25071A94}" = protocol=17 | dir=in | app=c:\program files\dna\btdna.exe | 
"{29F66ED9-95FE-4634-B082-98D3CEAE3548}" = dir=out | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 
"{2D1132F1-429A-43F7-920E-BC210CAF220F}" = protocol=17 | dir=in | app=c:\programdata\sweetim\messenger\update\sweetimsetup.exe | 
"{2E6DC27D-274B-42A9-9C5F-B1FBC8155348}" = protocol=6 | dir=in | app=c:\program files\icq7.4\icq.exe | 
"{32B2E03D-8743-485F-B62F-701B99577A4D}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{3FEDB7EE-168F-4D3E-AB69-590EDD616975}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{4A6810B9-BC56-49D8-85F4-19386C073804}" = protocol=17 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe | 
"{50B4F563-C950-42E0-9D74-AE6371C326C6}" = protocol=17 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe | 
"{5934F792-6062-4803-8101-DCAB9F4DE503}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{68612014-57BB-422D-93A9-6EC7921D346E}" = protocol=6 | dir=in | app=c:\program files\icq7.4\icq.exe | 
"{7B024A61-66E0-4882-892D-8C5992FB4886}" = protocol=17 | dir=in | app=c:\program files\icq7.4\icq.exe | 
"{7FE95D49-AED0-459D-A380-3821BE9B0CF2}" = protocol=6 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe | 
"{87C1A0D4-5877-4B2B-86A8-8EBB8B0A2877}" = protocol=17 | dir=in | app=c:\program files\icq7.4\icq.exe | 
"{8BF41D2E-BF7D-45FA-B436-39FA24AD8D54}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{8CEA91F6-96B8-4FAE-96FA-DD80AD5E35FA}" = protocol=58 | dir=in | name=@hnetcfg.dll,-148 | 
"{91B08133-3DF3-42EE-A618-EA3A2E16CC0D}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{93417572-F828-4955-8B31-58744D6AF6CC}" = protocol=6 | dir=in | app=c:\program files\dna\btdna.exe | 
"{992D46F6-5EFC-4ECC-884A-65E914AA80DE}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{A8AAAAC0-DED4-4199-9CE2-42DA8FDC1DDF}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{AD100518-5F56-41CA-B3B2-5FB5A2946EF2}" = protocol=17 | dir=in | app=c:\program files\icq7.4\icq.exe | 
"{D7591F63-38D5-4BCF-8C44-26F813311A8C}" = dir=in | app=c:\program files\pando networks\media booster\pmb.exe | 
"{EB2F476C-8926-4A05-AE50-2CE5303A0C5C}" = protocol=6 | dir=in | app=c:\programdata\sweetim\messenger\update\sweetimsetup.exe | 
"{F134C143-D74C-4B4E-8600-4B94A4B6B886}" = protocol=6 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe | 
"{F8D2EE41-EF34-48B0-AB5C-C8770A107B7D}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{FF59799E-E276-42F5-864A-0C4FF8E377FB}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"TCP Query User{22395FE2-0E06-4013-85F3-6C5D44530987}C:\users\luffy\program files\dna\btdna.exe" = protocol=6 | dir=in | app=c:\users\luffy\program files\dna\btdna.exe | 
"TCP Query User{59ED5F62-1967-4C12-BC09-95A009F0B623}C:\program files\java\jre6\bin\java.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\java.exe | 
"TCP Query User{B54A3B63-280A-4F2F-A2E4-E0799C477A5A}C:\program files\dna\btdna.exe" = protocol=6 | dir=in | app=c:\program files\dna\btdna.exe | 
"TCP Query User{DA70B55C-8572-4563-BF3D-63D779515F5F}C:\program files\google\google earth\plugin\geplugin.exe" = protocol=6 | dir=in | app=c:\program files\google\google earth\plugin\geplugin.exe | 
"TCP Query User{E8F133BA-8C70-4CA2-933A-E68D9D3549DA}C:\program files\java\jre6\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe | 
"UDP Query User{52653F9B-457A-4B82-A18B-21173A45CD6D}C:\users\luffy\program files\dna\btdna.exe" = protocol=17 | dir=in | app=c:\users\luffy\program files\dna\btdna.exe | 
"UDP Query User{7DBDFE5A-042C-4DFC-89FB-1C6323D72FCA}C:\program files\google\google earth\plugin\geplugin.exe" = protocol=17 | dir=in | app=c:\program files\google\google earth\plugin\geplugin.exe | 
"UDP Query User{8FDD51A1-4028-481A-AF6B-CC54F5CDD9A7}C:\program files\java\jre6\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe | 
"UDP Query User{A80C53DF-6988-48D5-8F74-2D961B693BBC}C:\program files\java\jre6\bin\java.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\java.exe | 
"UDP Query User{B71325DA-248F-482F-B7E4-7F5D68BA49FB}C:\program files\dna\btdna.exe" = protocol=17 | dir=in | app=c:\program files\dna\btdna.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{06E6E30D-B498-442F-A943-07DE41D7F785}" = Microsoft Search Enhancement Pack
"{0E532C84-4275-41B3-9D81-D4A1A20D8EE7}" = PlayStation(R)Store
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{20D4A895-748C-4D88-871C-FDB1695B0169}" = Platform
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{26A24AE4-039D-4CA4-87B4-2F83216013FF}" = Java(TM) 6 Update 22
"{28BE306E-5DA6-4F9C-BDB0-DBA3C8C6FFFD}" = QuickTime
"{28C2DED6-325B-4CC7-983A-1777C8F7FBAB}" = RealUpgrade 1.1
"{295C31E5-3F91-498E-9623-DA24D2FA2B6A}" = T-Online WLAN-Access Finder
"{2FFE93F0-BB72-4E52-8761-354D1AAA9387}" = Sony Ericsson PC Suite 6.011.00
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4EE2B017-D82C-4B12-B071-5CF1B23D1A42}" = SweetIM for Messenger 3.4
"{501451DE-5808-4599-B544-8BD0915B6B24}_is1" = FreeRIP v3.2
"{520CD4F0-9DAC-4C5C-8CA1-D0210CFF6062}" = Media Go
"{553255F3-78FD-40F1-A6F8-6882140265FE}" = Apple Application Support
"{55A29068-F2CE-456C-9148-C869879E2357}" = TuneUp Utilities 2009
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{636A7142-586A-4DF7-9207-191A2AF5610C}_is1" = AusLogics BoostSpeed
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{73C6DCFB-B606-47F3-BDFA-9A4FBF931E37}" = ICQ7.4
"{76E41F43-59D2-4F30-BA42-9A762EE1E8DE}" = Avanquest update
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7770E71B-2D43-4800-9CB3-5B6CAAEBEBEA}" = RealNetworks - Microsoft Visual C++ 2008 Runtime
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{95120000-00AF-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (German)
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{999A2E61-63EE-61BF-26E4-0C7B8B2A0BE2}" = Media Go Video Playback Engine 1.8.111.02130
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{a0fe116e-9a8a-466f-aee0-625cb7c207e3}" = Microsoft Visual C++ 2005 Redistributable - KB2467175
"{A8F2089B-1F79-4BF6-B385-A2C2B0B9A74D}" = ImagXpress
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9F6CFB0-806D-11E0-8EA1-B8AC6F97B88E}" = Google Earth Plug-in
"{AC76BA86-7AD7-1031-7B44-A94000000001}" = Adobe Reader 9.4.3 - Deutsch
"{B6659DD8-00A7-4A24-BBFB-C1F6982E5D66}" = PlayStation(R)Network Downloader
"{BF67F764-95B6-4360-BB57-B2E5AA6C814B}" = SweetIM Toolbar for Internet Explorer 4.0
"{C2F8CA82-2BD9-4513-B2D1-08A47914C1DA}_is1" = Uniblue DriverScanner
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{DBEA1034-5882-4A88-8033-81C4EF0CFA29}" = Google Toolbar for Internet Explorer
"{E55B3271-7CA8-4D0C-AE06-69A24856E996}_is1" = Uniblue SpeedUpMyPC
"{E63E34A7-E552-412B-9E40-FD6FC5227ABA}_is1" = Uniblue RegistryBooster
"{E78BFA60-5393-4C38-82AB-E8019E464EB4}" = Microsoft .NET Framework 1.1 German Language Pack
"{F90D6825-8F1F-4E3A-9E42-A9C8A9DD1031}" = Nero 7 Premium
"Adobe Acrobat 4.0" = Adobe Acrobat 4.0
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"AudioCon" = AudioCon
"AVG9Uninstall" = AVG 9.0
"ClickPotatoLiteSA" = ClickPotato
"Driver Genius Professional Edition_is1" = Driver Genius Professional Edition
"DVDVideoSoft Toolbar" = DVDVideoSoft Toolbar
"facemoods" = Facemoods Toolbar
"Free Video to MP3 Converter_is1" = Free Video to MP3 Converter version 3.2
"GMX SMS-Manager" = GMX SMS-Manager
"Google Chrome" = Google Chrome
"Hamster Free Video Converter_is1" = HamsterFreeVideoConverter
"ICQToolbar" = ICQ Toolbar
"InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}" = VIA Plattform-Geräte-Manager
"JDownloader" = JDownloader
"LView Pro 2006 - Trial Version" = LView Pro 2006 - Trial Version
"Microsoft .NET Framework 1.1  (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.6.17)" = Mozilla Firefox (3.6.17)
"RealPlayer 12.0" = RealPlayer
"ScanQuery" = ScanQuery 1.0 build 141 powered by FIRST SEARCHBAR
"ShoppingReport2" = ShopperReports
"SMSERIAL" = Motorola SM56 Speakerphone Modem
"Softonic_Deutsch Toolbar" = Softonic_Deutsch Toolbar
"sscqwuq" = Favorit
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"Teamspeak 2 RC2_is1" = TeamSpeak 2 RC2
"Uninstall_is1" = Uninstall 1.0.0.1
"UseNeXT_is1" = UseNeXT
"VIA Chrome9 HC IGP Windows Vista Display" = VIA Display Vista Driver 7.14.10.0052
"VLC media player" = VLC media player 0.9.9
"VN_VUIns_Rhine_VIA" = VIA Rhine Family Fast Ethernet Adapter
"WebMediaPlayer" = WebMediaPlayer
"WinRAR archiver" = WinRAR
"Xvid Video Codec 1.3.1" = Xvid Video Codec
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\S-1-5-21-2527848741-3311900059-3240881507-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"BitTorrent DNA" = DNA
"TeamSpeak 3 Client" = TeamSpeak 3 Client
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 06.02.2011 07:43:52 | Computer Name = Wihtebirt | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung firefox.exe, Version 1.9.2.3989, Zeitstempel
 0x4cf9293f, fehlerhaftes Modul ntdll.dll, Version 6.0.6000.16386, Zeitstempel 0x4549bdc9,
 Ausnahmecode 0xc00000fd, Fehleroffset 0x00061635,  Prozess-ID 0x13c4, Anwendungsstartzeit
 01cbc5de2bac7d16.
 
Error - 07.02.2011 14:40:20 | Computer Name = Wihtebirt | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung firefox.exe, Version 1.9.2.3989, Zeitstempel
 0x4cf9293f, fehlerhaftes Modul ntdll.dll, Version 6.0.6000.16386, Zeitstempel 0x4549bdc9,
 Ausnahmecode 0xc00000fd, Fehleroffset 0x00061635,  Prozess-ID 0xcc8, Anwendungsstartzeit
 01cbc6aa5289bc06.
 
Error - 07.02.2011 17:03:04 | Computer Name = Wihtebirt | Source = Microsoft-Windows-RestartManager | ID = 10006
Description = 
 
Error - 10.02.2011 09:27:08 | Computer Name = Wihtebirt | Source = Application Hang | ID = 1002
Description = Programm ICQ.exe, Version 6.5.0.2026 arbeitet nicht mehr mit Windows
 zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen
 für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem
 zu suchen.  Prozess-ID: 1770  Anfangszeit: 01cbc908d91540b4  Zeitpunkt der Beendigung:
 1361
 
Error - 10.02.2011 09:58:07 | Computer Name = Wihtebirt | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung firefox.exe, Version 1.9.2.3989, Zeitstempel
 0x4cf9293f, fehlerhaftes Modul ntdll.dll, Version 6.0.6000.16386, Zeitstempel 0x4549bdc9,
 Ausnahmecode 0xc00000fd, Fehleroffset 0x000447f2,  Prozess-ID 0xb3c, Anwendungsstartzeit
 01cbc8ff22e1f8b3.
 
Error - 10.02.2011 10:21:05 | Computer Name = Wihtebirt | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description = 
 
Error - 18.02.2011 15:51:17 | Computer Name = Wihtebirt | Source = LoadPerf | ID = 3012
Description = 
 
Error - 18.02.2011 15:51:17 | Computer Name = Wihtebirt | Source = LoadPerf | ID = 3012
Description = 
 
Error - 18.02.2011 15:51:17 | Computer Name = Wihtebirt | Source = LoadPerf | ID = 3011
Description = 
 
Error - 20.02.2011 12:13:42 | Computer Name = Wihtebirt | Source = Application Hang | ID = 1002
Description = Programm ICQ.exe, Version 6.5.0.2026 arbeitet nicht mehr mit Windows
 zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen
 für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem
 zu suchen.  Prozess-ID: a1c  Anfangszeit: 01cbd0f8854d4fdd  Zeitpunkt der Beendigung:
 19444
 
[ System Events ]
Error - 20.06.2011 10:09:57 | Computer Name = Wihtebirt | Source = DCOM | ID = 10016
Description = 
 
Error - 20.06.2011 10:23:54 | Computer Name = Wihtebirt | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am 20.06.2011 um 16:21:47 unerwartet heruntergefahren.
 
Error - 20.06.2011 10:24:30 | Computer Name = Wihtebirt | Source = DCOM | ID = 10005
Description = 
 
Error - 20.06.2011 10:24:30 | Computer Name = Wihtebirt | Source = DCOM | ID = 10005
Description = 
 
Error - 20.06.2011 10:24:30 | Computer Name = Wihtebirt | Source = LSM | ID = 1048
Description = 
 
Error - 20.06.2011 10:24:36 | Computer Name = Wihtebirt | Source = DCOM | ID = 10005
Description = 
 
Error - 20.06.2011 10:24:38 | Computer Name = Wihtebirt | Source = DCOM | ID = 10005
Description = 
 
Error - 20.06.2011 10:24:38 | Computer Name = Wihtebirt | Source = DCOM | ID = 10005
Description = 
 
Error - 20.06.2011 10:24:44 | Computer Name = Wihtebirt | Source = Service Control Manager | ID = 7001
Description = 
 
Error - 20.06.2011 10:24:44 | Computer Name = Wihtebirt | Source = Service Control Manager | ID = 7026
Description = 
 
 
< End of report >

--- --- ---

maik78 · 22.06.2011, 13:39

achja wollte noch sagen das ich zur zeit im abgesicherten modus mit neztwerktreibern arbeite.weiß ja nicht ob das dann ein problem darstellt.

markusg · 22.06.2011, 13:53

das auf deinem pc malware ist, kann ich verstehen, noch nie vista updates, aktuell wäre zb sp2, du hast nicht mal sp1...

aber hauptsache ne torrent software instaliert...

achtung!
dieses script sowie evtl. folgende scripts sind nur für den jeweiligen user.
wenn ihr probleme habt, eröffnet eigene topics und wartet auf, für euch angepasste scripts.

• Starte bitte die OTL.exe
• Kopiere nun das Folgende in die Textbox.

:OTL
O4 - HKU\S-1-5-21-2527848741-3311900059-3240881507-1000..\Run: [fVsVFGfVFkPeQTy] C:\ProgramData\fVsVFGfVFkPeQTy.exe (Sysinternals)
[2011.06.20 13:54:40 | 000,000,000 | -H-D | C] -- C:\Users\Luffy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Vista Repair
[2011.06.20 13:53:48 | 000,364,544 | -H-- | C] (Sysinternals) -- C:\ProgramData\29089552.exe
[2011.06.20 13:44:28 | 000,452,608 | -H-- | C] (Sysinternals) -- C:\ProgramData\fVsVFGfVFkPeQTy.exe
[2011.06.20 13:55:19 | 000,000,224 | -H-- | M] () -- C:\ProgramData\~29089552
[2011.06.20 13:55:18 | 000,000,152 | -H-- | M] () -- C:\ProgramData\~29089552r
[2011.06.20 13:54:41 | 000,000,591 | -H-- | M] () -- C:\Users\Luffy\Desktop\Windows Vista Repair.lnk
[2011.06.20 13:54:20 | 000,000,336 | -H-- | M] () -- C:\ProgramData\29089552
:Files
C:\ProgramData\fVsVFGfVFkPeQTy.exe
:Commands
[purity]
[EMPTYFLASH]
[emptytemp]
[Reboot]

• Schliesse bitte nun alle Programme.
• Klicke nun bitte auf den Fix Button.
• OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
• Nach dem Neustart findest Du ein Textdokument, dessen inhalt in deiner nächsten antwort hier reinkopieren.
starte wieder im normalen modus.

lade unhide:
http://www.trojaner-board.de/54791-a...ner-board.html

maik78 · 22.06.2011, 14:16

All processes killed
========== OTL ==========
Registry value HKEY_USERS\S-1-5-21-2527848741-3311900059-3240881507-1000\Software\Microsoft\Windows\CurrentVersion\Run\\fVsVFGfVFkPeQTy deleted successfully.
C:\ProgramData\fVsVFGfVFkPeQTy.exe moved successfully.
C:\Users\Luffy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Vista Repair folder moved successfully.
C:\ProgramData\29089552.exe moved successfully.
File C:\ProgramData\fVsVFGfVFkPeQTy.exe not found.
C:\ProgramData\~29089552 moved successfully.
C:\ProgramData\~29089552r moved successfully.
C:\Users\Luffy\Desktop\Windows Vista Repair.lnk moved successfully.
C:\ProgramData\29089552 moved successfully.
========== FILES ==========
File\Folder C:\ProgramData\fVsVFGfVFkPeQTy.exe not found.
========== COMMANDS ==========

[EMPTYFLASH]

User: All Users

User: Default
->Flash cache emptied: 2834 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: Luffy
->Flash cache emptied: 12599857 bytes

User: Public

Total Flash Files Cleaned = 12,00 mb

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Luffy
->Temp folder emptied: 1990123 bytes
->Temporary Internet Files folder emptied: 53588305 bytes
->Java cache emptied: 47342201 bytes
->FireFox cache emptied: 91114830 bytes
->Google Chrome cache emptied: 310385364 bytes
->Opera cache emptied: 344454 bytes
->Flash cache emptied: 0 bytes

User: Public

%systemdrive% .tmp files removed: 39186394 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 200946 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 519,00 mb

OTL by OldTimer - Version 3.2.24.1 log created on 06222011_150544

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

markusg · 22.06.2011, 14:20

ok weiter mit dem upload. in den upload channel, link folgen bitte

maik78 · 22.06.2011, 14:24

das unhide ist grad am arbeiten ....werd dann so bald es fertig ist mit den anderen sachen weiter machen oder kann ich das nebenbei tun?

einige datein wurden wieder hergestellt aber der arbeitsplatz ist noch nicht vorhanden.

markusg · 22.06.2011, 14:27

lass es arbeiten.
immer mit der ruhe wir sind nicht fertig :-)

maik78 · 22.06.2011, 14:35

ok.....bin grad der anleitung gefolgt und bin nun bei dem upload channel.wie finde ich nun die verdächtige datei ?

markusg · 22.06.2011, 14:40

hab doch geschrieben das du den ordner packen sollst, steht über dem link zum upload channel

maik78 · 22.06.2011, 14:47

also hab es jetzt hochgeladen und hab den link von dieser seite eingegeben un meinen namen.

markusg · 22.06.2011, 14:51

danke
bitte erstelle und poste ein combofix log.
Ein Leitfaden und Tutorium zur Nutzung von ComboFix

maik78 · 22.06.2011, 18:14

sry hatte private probleme.....so....kann das combofix nur runterlanden aber nicht auf desktop speichern.zeigt nur speichern an!

markusg · 22.06.2011, 18:15

mach mal nen rechtsklick auf den download link, ziehl speichern unter, dann gehts

maik78 · 22.06.2011, 18:26

hab ich gemacht aber da komm ich wieder auf der seite raus wo ich es runterladen soll

kann ich es so starten wenn es nicht auf dem desktop ist?

ok habs hinbekommen

passiert nichts

maik78 · 22.06.2011, 18:42

kann ich es nochmal löschen un neu probieren oder ist das nicht gut?

trojaner!Probleme mit einer oder mehreren OTL/SATA Festplatten!

Plagegeister aller Art und deren Bekämpfung: trojaner!Probleme mit einer oder mehreren OTL/SATA Festplatten!