BKA-Trojaner und keine Ahnung wie ich ihn beseitigen soll

Thorv · 28.07.2011, 17:12

Also wie gesagt ich habe auch den BKA-Virus und weiß nicht was ich dagegen tun kann.

Ich hoffe hier kann mir jemand verständlich und Schritt für Schritt erklären wie ich mein Problem löse.
Dabei sollte eine Windows-Neu-Installation verhindert werden.

Ich freue mich auf jede Hilfe.

MfG

cosinus · 29.07.2011, 10:02

Da musst du mit OTLPE ran. Benötigt wird dafür ein zweiter (virenfreier!!) Windows-Rechner mit Brenner und einen CD-R oder CD-RW Rohling. Den infizierten Rechner von dieser selbstgebrannten OTLPE-CD dann booten.

Falls Du kein Brennprogramm installiert hast, lade dir bitte ISOBurner herunter. Das Programm wird Dir erlauben, OTLPE auf eine CD zu brennen und sie bootfähig zu machen. Du brauchst das Tool nur zu installieren, der Rest läuft automatisch => Wie brenne ich eine ISO Datei auf CD/DVD.

Lade OTLPENet.exe von OldTimer herunter und speichere sie auf Deinem Desktop. Anmerkung: Die Datei ist ca. 120 MB groß und es wird bei langsamer Internet-Verbindung ein wenig dauern, bis Du sie runtergeladen hast.
Wenn der Download fertig ist, mache einen Doppelklick auf die Datei und beantworte die Frage "Do you want to burn the CD?" mit Yes.
Lege eine leere CD in Deinen Brenner.
ImgBurn (oder Dein Brennprogramm) wird das Archiv extrahieren und OTLPE Network auf die CD brennen.
Wenn der Brenn-Vorgang abgeschlossen ist, wirst Du eine Dialogbox sehen => "Operation successfully completed".
Du kannst nun die Fenster des Brennprogramms schließen.

Nun boote von der OTLPE CD. Hinweis: Wie boote ich von CD

Dein System sollte nach einigen Minuten den REATOGO-X-PE Desktop anzeigen.
Mache einen Doppelklick auf das OTLPE Icon.
Wenn Du gefragt wirst "Do you wish to load the remote registry", dann wähle Yes.
Wenn Du gefragt wirst "Do you wish to load remote user profile(s) for scanning", dann wähle Yes.
Vergewissere Dich, dass die Box "Automatically Load All Remaining Users" gewählt ist und drücke OK.
OTLpe sollte nun starten.
Drücke Run Scan, um den Scan zu starten.
Wenn der Scan fertig ist, werden die Dateien C:\OTL.Txt und C:\Extras.Txt erstellt
Kopiere diese Datei auf Deinen USB-Stick, wenn Du keine Internetverbindung auf diesem System hast.
Bitte poste den Inhalt von C:\OTL.Txt und Extras.Txt.

Thorv · 29.07.2011, 16:44

Vielen Dank erstmal für die Hilfe.

Hab die Datei auf CD gebrannt, allerdings kann ich nicht von der CD booten.
Weder manuell, noch wenn ich sie auf "höchste Priorität" eingestellt habe.
Der PC startet "normal", allerdings taucht der BKA-Virus nicht mehr auf.

Was soll ich jetzt tun?

Thorv · 29.07.2011, 19:42

Hab nochmal mein Gehirn rausgekramt und mir ist eingefallen, dass ich das Programm ja jetzt normal starten kann

Folgend die LOG-files:

OTL.txt

Code:

ATTFilter

OTL logfile created on: 29.07.2011 20:32:03 - Run 1
OTL by OldTimer - Version 3.2.26.1     Folder = C:\Users\FamGeisel\Desktop
 An unknown product  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 1,41 Gb Available Physical Memory | 70,71% Memory free
5,00 Gb Paging File | 4,28 Gb Available in Paging File | 85,69% Paging File free
Paging file location(s): C:\pagefile.sys 3069 3069 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 149,05 Gb Total Space | 51,04 Gb Free Space | 34,25% Space Free | Partition Type: NTFS
 
Computer Name: FAMGEISEL-PC | User Name: FamGeisel | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2011.07.29 20:31:17 | 000,579,584 | ---- | M] (OldTimer Tools) -- C:\Users\FamGeisel\Desktop\OTL.exe
PRC - [2011.06.19 01:30:31 | 000,056,032 | ---- | M] (Alps Electric Co., Ltd.) -- C:\Program Files\DellTPad\HidFind.exe
PRC - [2011.06.19 01:30:28 | 000,292,208 | ---- | M] (Alps Electric Co., Ltd.) -- C:\Program Files\DellTPad\Apoint.exe
PRC - [2011.06.19 01:30:27 | 000,054,640 | ---- | M] (Alps Electric Co., Ltd.) -- C:\Program Files\DellTPad\Apntex.exe
PRC - [2011.06.19 01:30:27 | 000,054,568 | ---- | M] (Alps Electric Co., Ltd.) -- C:\Program Files\DellTPad\ApMsgFwd.exe
PRC - [2011.06.06 17:58:48 | 000,671,552 | ---- | M] (TuneUp Software) -- C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesApp32.exe
PRC - [2011.06.06 17:56:54 | 001,524,544 | ---- | M] (TuneUp Software) -- C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe
PRC - [2011.06.06 12:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2011.03.24 13:24:34 | 000,072,936 | ---- | M] (SANDBOXIE L.T.D) -- C:\Program Files\Raphael\SbieSvc.exe
PRC - [2009.10.31 07:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2009.07.14 03:14:46 | 000,115,200 | ---- | M] () -- \\?\C:\Windows\System32\wbem\WMIADAP.EXE
PRC - [2009.07.14 03:14:42 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
PRC - [2009.07.14 03:14:15 | 000,271,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe
 
 
========== Modules (SafeList) ==========
 
MOD - [2011.07.29 20:31:17 | 000,579,584 | ---- | M] (OldTimer Tools) -- C:\Users\FamGeisel\Desktop\OTL.exe
MOD - [2010.08.21 07:21:32 | 001,680,896 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - File not found [Auto | Stopped] --  -- (Hamachi2Svc)
SRV - [2011.06.06 17:56:54 | 001,524,544 | ---- | M] (TuneUp Software) [Auto | Running] -- C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe -- (TuneUp.UtilitiesSvc)
SRV - [2011.06.06 17:54:08 | 000,029,504 | ---- | M] (TuneUp Software) [Auto | Running] -- C:\Windows\System32\uxtuneup.dll -- (UxTuneUp)
SRV - [2011.06.06 12:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2011.04.13 15:39:50 | 000,387,696 | ---- | M] (Kaspersky Lab ZAO) [On_Demand | Stopped] -- C:\Program Files\Kaspersky Lab\Kaspersky Security Suite CBE 11\avp.exe -- (AVP)
SRV - [2011.03.24 13:24:34 | 000,072,936 | ---- | M] (SANDBOXIE L.T.D) [Auto | Running] -- C:\Program Files\Raphael\SbieSvc.exe -- (SbieSvc)
SRV - [2010.03.25 10:25:22 | 030,969,208 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Microsoft Office\Office14\GROOVE.EXE -- (Microsoft SharePoint Workspace Audit Service)
SRV - [2009.07.14 03:16:15 | 000,016,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\StorSvc.dll -- (StorSvc)
SRV - [2009.07.14 03:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009.07.14 03:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)
SRV - [2009.07.14 03:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend)
 
 
========== Driver Services (SafeList) ==========
 
DRV - [2011.06.19 15:22:53 | 000,488,536 | ---- | M] (Kaspersky Lab) [File_System | System | Running] -- C:\Windows\System32\drivers\klif.sys -- (KLIF)
DRV - [2011.06.19 01:30:27 | 000,255,096 | ---- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Apfiltr.sys -- (ApfiltrService)
DRV - [2011.06.06 17:07:20 | 000,010,064 | ---- | M] (TuneUp Software) [Kernel | On_Demand | Running] -- C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesDriver32.sys -- (TuneUpUtilitiesDrv)
DRV - [2011.03.24 13:24:30 | 000,126,696 | ---- | M] (SANDBOXIE L.T.D) [Kernel | On_Demand | Running] -- C:\Program Files\Raphael\SbieDrv.sys -- (SbieDrv)
DRV - [2010.10.16 20:55:00 | 010,084,360 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2010.06.09 17:43:52 | 000,011,352 | ---- | M] (Kaspersky Lab ZAO) [Kernel | System | Running] -- C:\Windows\System32\drivers\kl2.sys -- (kl2)
DRV - [2010.06.09 17:43:50 | 000,132,184 | ---- | M] (Kaspersky Lab ZAO) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\kl1.sys -- (KL1)
DRV - [2010.04.22 19:07:34 | 000,022,104 | ---- | M] (Kaspersky Lab ZAO) [Kernel | System | Running] -- C:\Windows\System32\drivers\klim6.sys -- (KLIM6)
DRV - [2010.02.24 08:06:30 | 000,562,464 | ---- | M] (Ralink Technology, Corp.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\netr73.sys -- (netr73)
DRV - [2009.11.02 20:27:16 | 000,019,984 | ---- | M] (Kaspersky Lab) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\klmouflt.sys -- (klmouflt)
DRV - [2009.07.14 03:19:10 | 000,175,824 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\vmbus.sys -- (vmbus)
DRV - [2009.07.14 03:19:10 | 000,040,896 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\vmstorfl.sys -- (storflt)
DRV - [2009.07.14 03:19:10 | 000,028,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\storvsc.sys -- (storvsc)
DRV - [2009.07.14 01:52:10 | 000,014,336 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\vwifimp.sys -- (vwifimp)
DRV - [2009.07.14 01:28:47 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\vms3cap.sys -- (s3cap)
DRV - [2009.07.14 01:28:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\VMBusHID.sys -- (VMBusHID)
DRV - [2009.03.18 17:35:40 | 000,026,176 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\hamachi.sys -- (hamachi)
DRV - [2008.11.11 14:42:00 | 000,024,832 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lgusbmodem.sys -- (USBModem)
DRV - [2008.11.11 14:41:00 | 000,019,968 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lgusbdiag.sys -- (UsbDiag)
DRV - [2008.11.11 14:41:00 | 000,013,056 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lgusbbus.sys -- (usbbus)
DRV - [2005.12.01 12:49:22 | 000,023,600 | ---- | M] (Licensed for Gebhard Software) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\drhard.sys -- (drhard)
DRV - [2005.11.14 14:28:00 | 000,034,176 | ---- | M] (O2Micro ) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\o2media.sys -- (O2MDRDR)
DRV - [2005.02.10 18:46:06 | 000,152,296 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\VMM.sys -- (vmm)
DRV - [2004.07.14 11:23:00 | 000,045,568 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\VMNetSrv.sys -- (VPCNetS2)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\URLSearchHook: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - Reg Error: Value error. File not found
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.t-online.de/cpm-redir/ie-8.html
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.searchqu.com/406
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 24 9E 86 36 15 88 CB 01  [binary data]
IE - HKCU\..\URLSearchHook: {ba14329e-9550-4989-b3f2-9732e92d17cc} - Reg Error: Key error. File not found
IE - HKCU\..\URLSearchHook: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - Reg Error: Value error. File not found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultthis.engineName: "InnoGames Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2682599&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://www.web.de"
FF - prefs.js..extensions.enabledItems: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.9.2
FF - prefs.js..extensions.enabledItems: {ba14329e-9550-4989-b3f2-9732e92d17cc}:3.3.3.2
FF - prefs.js..extensions.enabledItems: antiphishing@bullguard:1.0
FF - prefs.js..extensions.enabledItems: engine@conduit.com:3.3.3.2
FF - prefs.js..extensions.enabledItems: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065}:3.3.3.2
FF - prefs.js..extensions.enabledItems: foxgame2@foxgame.org:2.0 Beta
FF - prefs.js..extensions.enabledItems: vshare@toolbar:1.0.0
FF - prefs.js..extensions.enabledItems: fbdislike@doweb.fr:1.2.3
FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:5.0.0.6778
FF - prefs.js..extensions.enabledItems: {c7478d43-2bd5-4844-98b8-c2a6aa9ed677}:3.3.3.2
FF - prefs.js..extensions.enabledItems: personas@christopher.beard:1.6.2
FF - prefs.js..extensions.enabledItems: firefox@tvunetworks.com:2
FF - prefs.js..extensions.enabledItems: 5
FF - prefs.js..extensions.enabledItems: 3
FF - prefs.js..extensions.enabledItems: 1
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1
FF - prefs.js..extensions.enabledItems: YoutubeDownloader@PeterOlayev.com:1.5
FF - prefs.js..extensions.enabledItems: youtube2mp3@mondayx.de:1.0.7
FF - prefs.js..extensions.enabledItems: {c0c9a2c7-2e5c-4447-bc53-97718bc91e1b}:4.1
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: {A79D8B60-1FF0-47F0-8E79-8CDE1FECB0FD}:1.0.0
FF - prefs.js..keyword.URL: "hxxp://dts.search-results.com/sr?src=ffb&appid=102&systemid=406&q="
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pages.tvunetworks.com/WebPlayer: C:\Windows\system32\TVUAx\npTVUAx.dll (TVU networks)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\@veetle.com/veetleCorePlugin,version=0.9.18: C:\Program Files\Veetle\plugins\npVeetle.dll (Veetle Inc)
FF - HKLM\Software\MozillaPlugins\@veetle.com/veetlePlayerPlugin,version=0.9.18: C:\Program Files\Veetle\Player\npvlc.dll (Veetle Inc)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
 
 
[2010.11.19 20:16:04 | 000,000,000 | ---D | M] (No name found) -- C:\Users\FamGeisel\AppData\Roaming\mozilla\Extensions
[2011.07.28 18:24:01 | 000,000,000 | ---D | M] (No name found) -- C:\Users\FamGeisel\AppData\Roaming\mozilla\Firefox\Profiles\6okg7wqc.default\extensions
[2011.07.29 04:07:01 | 000,000,000 | ---D | M] (No name found) -- C:\Users\FamGeisel\AppData\Roaming\mozilla\Firefox\Profiles\6okg7wqc.default\extensions\{c0c9a2c7-2e5c-4447-bc53-97718bc91e1b}
[2011.07.29 04:07:01 | 000,000,000 | ---D | M] (InnoGames Community Toolbar) -- C:\Users\FamGeisel\AppData\Roaming\mozilla\Firefox\Profiles\6okg7wqc.default\extensions\{c7478d43-2bd5-4844-98b8-c2a6aa9ed677}
[2011.07.29 04:07:00 | 000,000,000 | ---D | M] (FDislike) -- C:\Users\FamGeisel\AppData\Roaming\mozilla\Firefox\Profiles\6okg7wqc.default\extensions\fbdislike@doweb.fr
[2011.07.29 04:07:00 | 000,000,000 | ---D | M] (No name found) -- C:\Users\FamGeisel\AppData\Roaming\mozilla\Firefox\Profiles\6okg7wqc.default\extensions\foxgame2@foxgame.org
[2011.03.23 18:59:41 | 000,000,000 | ---D | M] (Personas) -- C:\Users\FamGeisel\AppData\Roaming\mozilla\Firefox\Profiles\6okg7wqc.default\extensions\personas@christopher.beard
[2011.07.29 04:06:20 | 000,000,000 | ---D | M] (Yontoo Layers) -- C:\Users\FamGeisel\AppData\Roaming\mozilla\Firefox\Profiles\6okg7wqc.default\extensions\plugin@yontoo.com
[2011.06.22 14:13:00 | 000,000,919 | ---- | M] () -- C:\Users\FamGeisel\AppData\Roaming\Mozilla\Firefox\Profiles\6okg7wqc.default\searchplugins\conduit.xml
[2011.03.22 23:40:57 | 000,001,908 | ---- | M] () -- C:\Users\FamGeisel\AppData\Roaming\Mozilla\Firefox\Profiles\6okg7wqc.default\searchplugins\metacrawler.xml
[2011.06.28 17:03:19 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\mozilla firefox\extensions
File not found (No name found) -- 
[2011.01.03 23:49:13 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\RAPHAEL\FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
() (No name found) -- C:\USERS\FAMGEISEL\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\6OKG7WQC.DEFAULT\EXTENSIONS\{C0C9A2C7-2E5C-4447-BC53-97718BC91E1B}.XPI
() (No name found) -- C:\USERS\FAMGEISEL\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\6OKG7WQC.DEFAULT\EXTENSIONS\{E4A8A97B-F2ED-450B-B12D-EE082BA24781}.XPI
() (No name found) -- C:\USERS\FAMGEISEL\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\6OKG7WQC.DEFAULT\EXTENSIONS\COMPATIBILITY@ADDONS.MOZILLA.ORG.XPI
() (No name found) -- C:\USERS\FAMGEISEL\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\6OKG7WQC.DEFAULT\EXTENSIONS\E3PO@WMCLAN.NET.XPI
() (No name found) -- C:\USERS\FAMGEISEL\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\6OKG7WQC.DEFAULT\EXTENSIONS\FOXGAME2@FOXGAME.ORG.XPI
() (No name found) -- C:\USERS\FAMGEISEL\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\6OKG7WQC.DEFAULT\EXTENSIONS\MP4DOWNLOADER@JEFF.NET.XPI
() (No name found) -- C:\USERS\FAMGEISEL\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\6OKG7WQC.DEFAULT\EXTENSIONS\WEBMASTER@KEEP-TUBE.COM.XPI
[2010.01.01 10:00:00 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2010.01.01 10:00:00 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2010.01.01 10:00:00 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2010.01.01 10:00:00 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2010.01.01 10:00:00 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2010.01.01 10:00:00 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2009.06.10 23:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O2 - BHO: (IEVkbdBHO Class) - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Security Suite CBE 11\ievkbd.dll (Kaspersky Lab ZAO)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~3\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~3\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (softonic-de3 Toolbar) - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - Reg Error: Value error. File not found
O2 - BHO: (FilterBHO Class) - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky Security Suite CBE 11\klwtbbho.dll (Kaspersky Lab ZAO)
O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (softonic-de3 Toolbar) - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - Reg Error: Value error. File not found
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O4 - HKLM..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe (Alps Electric Co., Ltd.)
O4 - HKLM..\Run: [BCSSync] C:\Program Files\Microsoft Office\Office14\BCSSync.exe (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 16
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O8 - Extra context menu item: Free YouTube Download - C:\Users\FamGeisel\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: &Virtuelle Tastatur - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files\Kaspersky Lab\Kaspersky Security Suite CBE 11\klwtbbho.dll (Kaspersky Lab ZAO)
O9 - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra Button: Li&nks untersuchen - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files\Kaspersky Lab\Kaspersky Security Suite CBE 11\klwtbbho.dll (Kaspersky Lab ZAO)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O20 - AppInit_DLLs: (c:\progra~2\~1\appdata\local\temp\macrom~1\swfupd~1\swfupdate.dll roaming) - c:\ProgramData\~1\AppData\Local\Temp\Macromedia\swfupdate\swfupdate.dll (Adobe Systems Inc.)
O20 - AppInit_DLLs: (C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll) - C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll (Kaspersky Lab ZAO)
O20 - AppInit_DLLs: (C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll) - C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll (Kaspersky Lab ZAO)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - Winlogon\Notify\klogon: DllName - C:\Windows\system32\klogon.dll - C:\Windows\System32\klogon.dll (Kaspersky Lab ZAO)
O21 - SSODL: SwUpdate - {003541A1-3BC0-1B1C-AAF3-040114001C01}ings... - CLSID or File not found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~1\MICROS~3\Office14\GROOVEEX.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.07.29 20:31:10 | 000,579,584 | ---- | C] (OldTimer Tools) -- C:\Users\FamGeisel\Desktop\OTL.exe
[2011.07.27 17:43:24 | 000,000,000 | ---D | C] -- C:\Program Files\Reality Pump
[2011.07.25 20:25:58 | 000,000,000 | ---D | C] -- C:\Users\FamGeisel\Desktop\My DVD
[2011.07.25 20:20:32 | 000,000,000 | ---D | C] -- C:\Users\FamGeisel\Documents\Xilisoft DVD Creator 6
[2011.07.25 19:57:49 | 000,000,000 | ---D | C] -- C:\Users\FamGeisel\AppData\Local\Xilisoft
[2011.07.25 19:56:27 | 000,000,000 | ---D | C] -- C:\Users\FamGeisel\AppData\Roaming\Xilisoft
[2011.07.22 20:59:54 | 000,000,000 | ---D | C] -- C:\Users\FamGeisel\AppData\Local\CrashDumps
[2011.07.15 23:17:37 | 000,000,000 | ---D | C] -- C:\Windows\System32\DRVSTORE
[2011.07.15 23:10:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Soluto
[2011.07.15 21:18:08 | 000,000,000 | ---D | C] -- C:\Users\FamGeisel\AppData\Roaming\NVIDIA
[2011.07.14 20:32:14 | 000,000,000 | ---D | C] -- C:\Wichtige Programme
[2011.07.14 17:42:42 | 000,000,000 | ---D | C] -- C:\Users\FamGeisel\Documents\Outlook-Dateien
[2011.07.14 17:13:36 | 000,000,000 | ---D | C] -- C:\Program Files\LG PC Suite II
[2011.07.14 17:13:22 | 000,000,000 | ---D | C] -- C:\Users\FamGeisel\AppData\Roaming\InstallShield
[2011.07.07 15:47:22 | 000,000,000 | ---D | C] -- C:\Users\FamGeisel\Desktop\Auto
[2011.07.04 22:39:13 | 000,000,000 | ---D | C] -- C:\Users\FamGeisel\AppData\Roaming\dvdcss
[2011.06.30 21:25:03 | 000,000,000 | ---D | C] -- C:\Program Files\PageRage
[2011.06.30 21:24:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Tarma Installer
[2011.03.14 15:55:47 | 000,022,528 | ---- | C] (Microsoft) -- C:\Users\FamGeisel\AppData\Local\60353310,5468.ToDelete
[2011.03.14 15:55:47 | 000,022,528 | ---- | C] (Microsoft) -- C:\Users\FamGeisel\AppData\Local\59754010,7421.ToDelete
[2011.03.14 15:55:47 | 000,022,528 | ---- | C] (Microsoft) -- C:\Users\FamGeisel\AppData\Local\59153741,2109.ToDelete
[2011.03.14 15:55:47 | 000,022,528 | ---- | C] (Microsoft) -- C:\Users\FamGeisel\AppData\Local\58554695,3125.ToDelete
[2011.03.14 15:55:47 | 000,022,528 | ---- | C] (Microsoft) -- C:\Users\FamGeisel\AppData\Local\57954185,5468.ToDelete
[2011.03.14 15:55:47 | 000,022,528 | ---- | C] (Microsoft) -- C:\Users\FamGeisel\AppData\Local\57354924,8046.ToDelete
[2011.03.14 15:55:47 | 000,022,528 | ---- | C] (Microsoft) -- C:\Users\FamGeisel\AppData\Local\56754665,039.ToDelete
[2011.03.14 15:55:47 | 000,022,528 | ---- | C] (Microsoft) -- C:\Users\FamGeisel\AppData\Local\56155396,4843.ToDelete
[2011.03.14 15:55:47 | 000,022,528 | ---- | C] (Microsoft) -- C:\Users\FamGeisel\AppData\Local\55555068,3593.ToDelete
[2011.03.14 15:55:47 | 000,022,528 | ---- | C] (Microsoft) -- C:\Users\FamGeisel\AppData\Local\55474981,4453.ToDelete
[2011.03.14 15:55:47 | 000,022,528 | ---- | C] (Microsoft) -- C:\Users\FamGeisel\AppData\Local\54955819,3359.ToDelete
[2011.03.14 15:55:47 | 000,022,528 | ---- | C] (Microsoft) -- C:\Users\FamGeisel\AppData\Local\54355592,7734.ToDelete
[2011.03.14 15:55:47 | 000,022,528 | ---- | C] (Microsoft) -- C:\Users\FamGeisel\AppData\Local\53752510,7421.ToDelete
[2010.11.20 01:06:00 | 000,912,344 | ---- | C] (Mozilla Corporation) -- C:\Users\FamGeisel\AppData\Roaming\windefender.exe
[2009.07.13 22:46:42 | 001,169,224 | -H-- | C] (Microsoft Corporation) -- C:\Users\FamGeisel\AppData\Roaming\BS37SPB.exe
[2009.07.13 22:46:42 | 001,169,224 | ---- | C] (Microsoft Corporation) -- C:\Users\FamGeisel\AppData\Roaming\BS37Sp.exe
[6 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[6 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2011.07.29 20:34:27 | 000,017,264 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011.07.29 20:34:27 | 000,017,264 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011.07.29 20:34:04 | 000,652,054 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011.07.29 20:34:04 | 000,120,986 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011.07.29 20:31:17 | 000,579,584 | ---- | M] (OldTimer Tools) -- C:\Users\FamGeisel\Desktop\OTL.exe
[2011.07.29 20:27:32 | 000,000,336 | ---- | M] () -- C:\Windows\tasks\DriverScanner.job
[2011.07.29 20:27:04 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011.07.29 20:26:54 | 1609,089,024 | -HS- | M] () -- C:\hiberfil.sys
[2011.07.16 22:36:43 | 000,012,777 | ---- | M] () -- C:\Users\FamGeisel\.recently-used.xbel
[2011.07.16 20:49:42 | 000,032,401 | ---- | M] () -- C:\Users\FamGeisel\Desktop\pic.jpg
[2011.07.16 19:59:03 | 000,000,193 | ---- | M] () -- C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc
[6 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[6 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2011.07.28 18:20:34 | 1609,089,024 | -HS- | C] () -- C:\hiberfil.sys
[2011.07.16 22:36:43 | 000,012,777 | ---- | C] () -- C:\Users\FamGeisel\.recently-used.xbel
[2011.07.16 20:33:37 | 000,032,401 | ---- | C] () -- C:\Users\FamGeisel\Desktop\pic.jpg
[2011.07.15 23:21:12 | 000,000,193 | ---- | C] () -- C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc
[2011.06.22 22:12:12 | 000,182,272 | ---- | C] () -- C:\Windows\patchw32.dll
[2011.06.19 15:25:20 | 000,115,369 | ---- | C] () -- C:\Windows\System32\drivers\klin.dat
[2011.06.19 15:25:20 | 000,097,859 | ---- | C] () -- C:\Windows\System32\drivers\klick.dat
[2011.06.15 21:08:30 | 000,001,964 | ---- | C] () -- C:\Windows\Sandboxie.ini
[2011.05.12 21:04:01 | 000,013,886 | ---- | C] () -- C:\Users\FamGeisel\AppData\Local\75841214,8437
[2011.05.12 20:58:15 | 000,008,192 | ---- | C] () -- C:\Users\FamGeisel\AppData\Local\75495955,0781
[2011.05.09 22:03:38 | 000,013,886 | ---- | C] () -- C:\Users\FamGeisel\AppData\Local\79418519,5312
[2011.05.08 23:10:50 | 000,009,790 | ---- | C] () -- C:\Users\FamGeisel\AppData\Local\83450506,9765
[2011.04.28 15:48:45 | 000,000,000 | ---- | C] () -- C:\Users\FamGeisel\AppData\Local\56925154,2968
[2011.04.17 17:27:35 | 000,008,192 | ---- | C] () -- C:\Users\FamGeisel\AppData\Local\62855843,3359
[2011.04.10 17:41:47 | 000,000,000 | ---- | C] () -- C:\Users\FamGeisel\AppData\Local\63707698,2421
[2011.04.10 15:49:21 | 000,000,000 | ---- | C] () -- C:\Users\FamGeisel\AppData\Local\56961052,7343
[2011.04.10 15:44:52 | 000,008,338 | ---- | C] () -- C:\Users\FamGeisel\AppData\Local\56692598,7968
[2011.04.10 13:59:41 | 000,000,000 | ---- | C] () -- C:\Users\FamGeisel\AppData\Local\50381726,125
[2011.04.10 13:50:28 | 000,004,096 | ---- | C] () -- C:\Users\FamGeisel\AppData\Local\49828752,9296
[2011.04.10 01:30:53 | 000,000,000 | ---- | C] () -- C:\Users\FamGeisel\AppData\Local\5453058,5937
[2011.03.15 22:25:11 | 000,000,000 | ---- | C] () -- C:\Windows\System32\mail.dat
[2011.03.15 22:25:04 | 000,000,000 | ---- | C] () -- C:\Windows\System32\mess.dat
[2010.12.26 16:08:16 | 000,053,248 | ---- | C] () -- C:\Windows\System32\CommonDL.dll
[2010.12.26 16:08:16 | 000,002,413 | ---- | C] () -- C:\Windows\System32\lgAxconfig.ini
[2010.12.13 17:07:07 | 000,000,056 | -H-- | C] () -- C:\Windows\System32\ezsidmv.dat
[2010.11.23 16:43:36 | 002,391,355 | ---- | C] () -- C:\Users\FamGeisel\AppData\Roaming\data.dat
[2010.11.21 15:19:37 | 000,088,280 | -H-- | C] () -- C:\Windows\System32\mlfcache.dat
[2009.09.09 19:01:40 | 000,027,675 | ---- | C] () -- C:\Windows\System32\drivers\klopp.dat
[2009.07.14 06:57:37 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009.07.14 06:33:53 | 000,406,584 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2009.07.14 04:05:48 | 000,652,054 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2009.07.14 04:05:48 | 000,291,294 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2009.07.14 04:05:48 | 000,120,986 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2009.07.14 04:05:48 | 000,031,548 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2009.07.14 04:05:05 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2009.07.14 04:04:11 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2009.07.14 02:19:49 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe
[2009.07.14 01:55:01 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009.07.14 01:51:43 | 000,073,728 | ---- | C] () -- C:\Windows\System32\BthpanContextHandler.dll
[2009.07.14 01:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\System32\BWContextHandler.dll
[2009.06.10 23:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat

< End of report >

Extras.txt

Code:

ATTFilter

OTL Extras logfile created on: 29.07.2011 20:32:07 - Run 1
OTL by OldTimer - Version 3.2.26.1     Folder = C:\Users\FamGeisel\Desktop
 An unknown product  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 1,41 Gb Available Physical Memory | 70,71% Memory free
5,00 Gb Paging File | 4,28 Gb Available in Paging File | 85,69% Paging File free
Paging file location(s): C:\pagefile.sys 3069 3069 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 149,05 Gb Total Space | 51,04 Gb Free Space | 34,25% Space Free | Partition Type: NTFS
 
Computer Name: FAMGEISEL-PC | User Name: FamGeisel | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Raphael\FireFox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office14\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Program Files\Microsoft Office\Office14\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Users\FamGeisel\AppData\Roaming\BS37Sp.exe" = C:\Users\FamGeisel\AppData\Roaming\BS37Sp.exe:*:Enabled:Windows Messanger -- (Microsoft Corporation)
"C:\Users\FamGeisel\AppData\Roaming\BS37SPB.exe" = C:\Users\FamGeisel\AppData\Roaming\BS37SPB.exe:*:Enabled:Windows Messanger -- (Microsoft Corporation)
"C:\Users\FAMGEI~1\AppData\Local\Temp\39192.exe" = C:\Users\FAMGEI~1\AppData\Local\Temp\39192.exe:*:Enabled:Windows Messanger
"C:\Users\FAMGEI~1\AppData\Local\Temp\22595.exe" = C:\Users\FAMGEI~1\AppData\Local\Temp\22595.exe:*:Enabled:Windows Messanger
"C:\Users\FamGeisel\AppData\Roaming\5W56P32CKB.exe" = C:\Users\FamGeisel\AppData\Roaming\5W56P32CKB.exe:*:Enabled:Windows Messanger
"C:\Users\FamGeisel\AppData\Roaming\windefender.exe" = C:\Users\FamGeisel\AppData\Roaming\windefender.exe:*:Enabled:Windows Messanger -- (Mozilla Corporation)
"c:\wichtige programme\firefox\firefox.exe" = c:\wichtige programme\firefox\firefox.exe:*:Enabled:Windows Messanger
"C:\Users\FAMGEI~1\AppData\Local\Temp\50163.exe" = C:\Users\FAMGEI~1\AppData\Local\Temp\50163.exe:*:Enabled:Windows Messanger
"C:\Users\FAMGEI~1\AppData\Local\Temp\769.exe" = C:\Users\FAMGEI~1\AppData\Local\Temp\769.exe:*:Enabled:Windows Messanger
"C:\Users\FamGeisel\AppData\Roaming\4.3.exe" = C:\Users\FamGeisel\AppData\Roaming\4.3.exe:*:Enabled:Windows Messanger
"C:\Users\FAMGEI~1\AppData\Local\Temp\19589.exe" = C:\Users\FAMGEI~1\AppData\Local\Temp\19589.exe:*:Enabled:Windows Messanger
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{14DCD95A-EBA3-4BF0-B7EF-533852E99BE6}" = LG PC Suite II
"{196BB40D-1578-3D01-B289-BEFC77A11A1E}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.30319
"{24036256-BFDB-4CD3-BE8A-A3D6160F2E16}" = TuneUp Utilities 2011
"{26A24AE4-039D-4CA4-87B4-2F83216023FF}" = Java(TM) 6 Update 23
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{5335DADB-34BA-4AE8-A519-648D78498846}" = Skype™ 5.3
"{5D4C60AA-84E6-4E1A-8A68-69970D387BE1}" = TuneUp Utilities Language Pack (de-DE)
"{6059C682-4C5F-4106-8487-943E98225D3B}" = LG MC USB Modem driver
"{66F1F013-008F-4875-B283-5A814B820347}" = Kaspersky Security Suite CBE 11
"{793A260C-CDBF-499C-ABBA-B51E8E076867}_is1" = Uniblue PowerSuite
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{90140000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2010
"{90140000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2010
"{90140000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2010
"{90140000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2010
"{90140000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2010
"{90140000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2010
"{90140000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2010
"{90140000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2010
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2010
"{90140000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2010
"{90140000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2010
"{90140000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2010
"{90140000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2010
"{90140000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2010
"{9580813D-94B1-4C28-9426-A441E2BB29A5}" = Counter-Strike: Source
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = Dell Touchpad
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.0) - Deutsch
"{B2FE1952-0186-46c3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 260.99
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 260.99
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX-Systemsoftware 260.99
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B9DB4C76-01A4-46D5-8910-F7AA6376DBAF}" = NVIDIA PhysX
"{C2F8CA82-2BD9-4513-B2D1-08A47914C1DA}_is1" = Uniblue DriverScanner
"{C3ABE126-2BB2-4246-BFE1-6797679B3579}" = LG USB Modem driver
"{CCCAFDDE-ECEC-4AE4-BD97-047076BBD4A9}" = Microsoft Virtual PC 2004
"{CE4A3D0F-D1B0-47D1-BF99-3E957C548D12}" = LogMeIn Hamachi
"{E55B3271-7CA8-4D0C-AE06-69A24856E996}_is1" = Uniblue SpeedUpMyPC
"{EF5B1E83-1403-4F0E-A8E6-C169DF0CCE8C}" = LG PC Suite II
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"conduitEngine" = Conduit Engine
"InstallWIX_{66F1F013-008F-4875-B283-5A814B820347}" = Kaspersky Security Suite CBE 11
"LogMeIn Hamachi" = LogMeIn Hamachi
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Office14.PROPLUS" = Microsoft Office Professional Plus 2010
"OpenAL" = OpenAL
"QuickTime" = QuickTime
"Sandboxie" = Sandboxie 3.54 (32-bit)
"TuneUp Utilities 2011" = TuneUp Utilities 2011
"Uninstall_is1" = Uninstall 1.0.0.1
"Veetle TV" = Veetle TV 0.9.18
"VLC media player" = VLC media player 1.1.10
"WinGimp-2.0_is1" = GIMP 2.6.11
"WinRAR archiver" = WinRAR
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 28.07.2011 07:50:40 | Computer Name = FamGeisel-PC | Source = System Restore | ID = 8193
Description = 
 
Error - 28.07.2011 09:31:52 | Computer Name = FamGeisel-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: B6232F3A374.exe, Version: 0.0.0.0,
 Zeitstempel: 0x3fd1a333  Name des fehlerhaften Moduls: kernel32.dll, Version: 6.1.7600.16481,
 Zeitstempel: 0x4b1e3897  Ausnahmecode: 0xc0000005  Fehleroffset: 0x00001f24  ID des fehlerhaften
 Prozesses: 0x5d8  Startzeit der fehlerhaften Anwendung: 0x01cc4d2ab4bc9608  Pfad der
 fehlerhaften Anwendung: C:\Recycle.Bin\B6232F3A374.exe  Pfad des fehlerhaften Moduls:
 C:\Windows\system32\kernel32.dll  Berichtskennung: f38e6320-b91d-11e0-a994-0009df8074e9
 
Error - 28.07.2011 12:28:07 | Computer Name = FamGeisel-PC | Source = Microsoft-Windows-LoadPerf | ID = 3006
Description = Die Zeichenfolgen der Leistungsindikatoren, die für die Sprach-ID 
"007" definiert wurden, können nicht gelesen werden. Das erste DWORD im Datenbereich
 enthält den Win32-Fehlercode.
 
Error - 28.07.2011 12:28:07 | Computer Name = FamGeisel-PC | Source = Microsoft-Windows-LoadPerf | ID = 3006
Description = Die Zeichenfolgen der Leistungsindikatoren, die für die Sprach-ID 
"007" definiert wurden, können nicht gelesen werden. Das erste DWORD im Datenbereich
 enthält den Win32-Fehlercode.
 
Error - 28.07.2011 14:03:09 | Computer Name = FamGeisel-PC | Source = Microsoft-Windows-LoadPerf | ID = 3006
Description = Die Zeichenfolgen der Leistungsindikatoren, die für die Sprach-ID 
"007" definiert wurden, können nicht gelesen werden. Das erste DWORD im Datenbereich
 enthält den Win32-Fehlercode.
 
Error - 28.07.2011 14:03:09 | Computer Name = FamGeisel-PC | Source = Microsoft-Windows-LoadPerf | ID = 3006
Description = Die Zeichenfolgen der Leistungsindikatoren, die für die Sprach-ID 
"007" definiert wurden, können nicht gelesen werden. Das erste DWORD im Datenbereich
 enthält den Win32-Fehlercode.
 
Error - 29.07.2011 11:47:28 | Computer Name = FamGeisel-PC | Source = Microsoft-Windows-LoadPerf | ID = 3006
Description = Die Zeichenfolgen der Leistungsindikatoren, die für die Sprach-ID 
"007" definiert wurden, können nicht gelesen werden. Das erste DWORD im Datenbereich
 enthält den Win32-Fehlercode.
 
Error - 29.07.2011 11:47:28 | Computer Name = FamGeisel-PC | Source = Microsoft-Windows-LoadPerf | ID = 3006
Description = Die Zeichenfolgen der Leistungsindikatoren, die für die Sprach-ID 
"007" definiert wurden, können nicht gelesen werden. Das erste DWORD im Datenbereich
 enthält den Win32-Fehlercode.
 
Error - 29.07.2011 14:34:04 | Computer Name = FamGeisel-PC | Source = Microsoft-Windows-LoadPerf | ID = 3006
Description = Die Zeichenfolgen der Leistungsindikatoren, die für die Sprach-ID 
"007" definiert wurden, können nicht gelesen werden. Das erste DWORD im Datenbereich
 enthält den Win32-Fehlercode.
 
Error - 29.07.2011 14:34:04 | Computer Name = FamGeisel-PC | Source = Microsoft-Windows-LoadPerf | ID = 3006
Description = Die Zeichenfolgen der Leistungsindikatoren, die für die Sprach-ID 
"007" definiert wurden, können nicht gelesen werden. Das erste DWORD im Datenbereich
 enthält den Win32-Fehlercode.
 
[ System Events ]
Error - 29.07.2011 11:35:31 | Computer Name = FamGeisel-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Heimnetzgruppen-Anbieter" ist vom Dienst "Funktionssuchanbieter-Host"
 abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:   %%1058
 
Error - 29.07.2011 11:38:31 | Computer Name = FamGeisel-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "LogMeIn Hamachi 2.0 Tunneling Engine" wurde aufgrund folgenden
 Fehlers nicht gestartet:   %%3
 
Error - 29.07.2011 11:38:47 | Computer Name = FamGeisel-PC | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Computerbrowser" wurde mit folgendem Fehler beendet:   %%1115
 
Error - 29.07.2011 11:38:47 | Computer Name = FamGeisel-PC | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Server" wurde mit folgendem Fehler beendet:   %%1062
 
Error - 29.07.2011 11:41:38 | Computer Name = FamGeisel-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "LogMeIn Hamachi 2.0 Tunneling Engine" wurde aufgrund folgenden
 Fehlers nicht gestartet:   %%3
 
Error - 29.07.2011 11:42:19 | Computer Name = FamGeisel-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Heimnetzgruppen-Anbieter" ist vom Dienst "Funktionssuchanbieter-Host"
 abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:   %%1058
 
Error - 29.07.2011 12:46:26 | Computer Name = FamGeisel-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "LogMeIn Hamachi 2.0 Tunneling Engine" wurde aufgrund folgenden
 Fehlers nicht gestartet:   %%3
 
Error - 29.07.2011 12:46:59 | Computer Name = FamGeisel-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Heimnetzgruppen-Anbieter" ist vom Dienst "Funktionssuchanbieter-Host"
 abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:   %%1058
 
Error - 29.07.2011 14:27:13 | Computer Name = FamGeisel-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "LogMeIn Hamachi 2.0 Tunneling Engine" wurde aufgrund folgenden
 Fehlers nicht gestartet:   %%3
 
Error - 29.07.2011 14:27:43 | Computer Name = FamGeisel-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Heimnetzgruppen-Anbieter" ist vom Dienst "Funktionssuchanbieter-Host"
 abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:   %%1058
 
 
< End of report >

cosinus · 30.07.2011, 18:50

Wenn du das normal starten kannst, solltest du einen CustomScan machen, aber erst bitte Malwarebytes ausführen:

Bitte routinemäßig einen Vollscan mit Malwarebytes machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!

CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

Starte bitte die OTL.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Kopiere nun den Inhalt in die Textbox.

Code:

ATTFilter

netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Klick auf .
Kopiere nun den Inhalt aus OTL.txt hier in Deinen Thread

Thorv · 02.08.2011, 01:36

Malwarebytes:

Code:

ATTFilter

Malwarebytes' Anti-Malware 1.51.1.1800
www.malwarebytes.org

Datenbank Version: 7348

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

02.08.2011 02:10:40
mbam-log-2011-08-02 (02-10-40).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)
Durchsuchte Objekte: 423878
Laufzeit: 1 Stunde(n), 47 Minute(n), 34 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 4
Infizierte Registrierungswerte: 1
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 2
Infizierte Dateien: 5

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
HKEY_CLASSES_ROOT\CLSID\{003541A1-3BC0-1B1C-AAF3-040114001C01} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{D69FFE1F-9D52-A0BD-E2CA-44234DE092C3} (Backdoor.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{D69FFE1F-9D52-A0BD-E2CA-44234DE092C3} (Backdoor.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\VB and VBA Program Settings\SrvID (Malware.Trace) -> Quarantined and deleted successfully.

Infizierte Registrierungswerte:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\SwUpdate (Trojan.Agent) -> Value: SwUpdate -> Quarantined and deleted successfully.

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
c:\Users\famgeisel\AppData\Roaming\windefender (Rogue.WinDefender) -> Quarantined and deleted successfully.
c:\Recycle.Bin (Trojan.Spyeyes) -> Quarantined and deleted successfully.

Infizierte Dateien:
c:\Office\microsoft.office.professional.plus.2010.x86.german.vl.edition-tiw\mini-kms_activator_v1.052.exe (Riskware.Keygen) -> Quarantined and deleted successfully.
c:\Users\famgeisel\AppData\Local\Temp\jar_cache9191800569305618801.tmp (Spyware.SpyEye) -> Quarantined and deleted successfully.
c:\Users\famgeisel\AppData\Roaming\windefender.exe (Trojan.Agent.Gen) -> Quarantined and deleted successfully.
c:\Users\famgeisel\AppData\Roaming\data.dat (Stolen.Data) -> Quarantined and deleted successfully.
c:\Recycle.Bin\4741a0751cdc865 (Trojan.Spyeyes) -> Quarantined and deleted successfully.

OTL.txt

Code:

ATTFilter

OTL logfile created on: 02.08.2011 02:13:05 - Run 2
OTL by OldTimer - Version 3.2.26.1     Folder = C:\Users\FamGeisel\Desktop
 An unknown product  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 1,27 Gb Available Physical Memory | 63,47% Memory free
5,00 Gb Paging File | 4,12 Gb Available in Paging File | 82,41% Paging File free
Paging file location(s): C:\pagefile.sys 3069 3069 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 149,05 Gb Total Space | 76,65 Gb Free Space | 51,43% Space Free | Partition Type: NTFS
 
Computer Name: FAMGEISEL-PC | User Name: FamGeisel | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2011.08.01 18:58:39 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe
PRC - [2011.07.29 20:31:17 | 000,579,584 | ---- | M] (OldTimer Tools) -- C:\Users\FamGeisel\Desktop\OTL.exe
PRC - [2011.06.19 01:30:31 | 000,056,032 | ---- | M] (Alps Electric Co., Ltd.) -- C:\Program Files\DellTPad\HidFind.exe
PRC - [2011.06.19 01:30:28 | 000,292,208 | ---- | M] (Alps Electric Co., Ltd.) -- C:\Program Files\DellTPad\Apoint.exe
PRC - [2011.06.19 01:30:27 | 000,054,640 | ---- | M] (Alps Electric Co., Ltd.) -- C:\Program Files\DellTPad\Apntex.exe
PRC - [2011.06.19 01:30:27 | 000,054,568 | ---- | M] (Alps Electric Co., Ltd.) -- C:\Program Files\DellTPad\ApMsgFwd.exe
PRC - [2011.06.06 17:58:48 | 000,671,552 | ---- | M] (TuneUp Software) -- C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesApp32.exe
PRC - [2011.06.06 17:56:54 | 001,524,544 | ---- | M] (TuneUp Software) -- C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe
PRC - [2011.06.06 12:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2011.06.02 07:55:31 | 000,271,872 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe
PRC - [2011.04.21 07:53:10 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
PRC - [2011.04.21 07:52:51 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe
PRC - [2011.04.21 07:52:36 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
PRC - [2011.02.26 07:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2009.07.14 03:14:42 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
 
 
========== Modules (SafeList) ==========
 
MOD - [2011.07.29 20:31:17 | 000,579,584 | ---- | M] (OldTimer Tools) -- C:\Users\FamGeisel\Desktop\OTL.exe
MOD - [2010.08.21 07:21:32 | 001,680,896 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - [2011.08.01 18:58:39 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011.06.06 17:56:54 | 001,524,544 | ---- | M] (TuneUp Software) [Auto | Running] -- C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe -- (TuneUp.UtilitiesSvc)
SRV - [2011.06.06 17:54:08 | 000,029,504 | ---- | M] (TuneUp Software) [Auto | Running] -- C:\Windows\System32\uxtuneup.dll -- (UxTuneUp)
SRV - [2011.06.06 12:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2011.04.21 07:52:51 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2010.03.25 10:25:22 | 030,969,208 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Microsoft Office\Office14\GROOVE.EXE -- (Microsoft SharePoint Workspace Audit Service)
SRV - [2009.07.14 03:16:15 | 000,016,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\StorSvc.dll -- (StorSvc)
SRV - [2009.07.14 03:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009.07.14 03:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)
SRV - [2009.07.14 03:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend)
 
 
========== Driver Services (SafeList) ==========
 
DRV - [2011.08.01 18:58:40 | 000,138,192 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2011.08.01 18:58:40 | 000,066,616 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2011.07.06 19:52:42 | 000,041,272 | ---- | M] (Malwarebytes Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\mbamswissarmy.sys -- (MBAMSwissArmy)
DRV - [2011.06.19 01:30:27 | 000,255,096 | ---- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Apfiltr.sys -- (ApfiltrService)
DRV - [2011.06.06 17:07:20 | 000,010,064 | ---- | M] (TuneUp Software) [Kernel | On_Demand | Running] -- C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesDriver32.sys -- (TuneUpUtilitiesDrv)
DRV - [2010.10.16 20:55:00 | 010,084,360 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2010.02.24 08:06:30 | 000,562,464 | ---- | M] (Ralink Technology, Corp.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\netr73.sys -- (netr73)
DRV - [2009.10.08 17:55:33 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009.07.14 03:19:10 | 000,175,824 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\vmbus.sys -- (vmbus)
DRV - [2009.07.14 03:19:10 | 000,040,896 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\vmstorfl.sys -- (storflt)
DRV - [2009.07.14 03:19:10 | 000,028,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\storvsc.sys -- (storvsc)
DRV - [2009.07.14 01:52:10 | 000,014,336 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\vwifimp.sys -- (vwifimp)
DRV - [2009.07.14 01:28:47 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\vms3cap.sys -- (s3cap)
DRV - [2009.07.14 01:28:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\VMBusHID.sys -- (VMBusHID)
DRV - [2009.03.18 17:35:40 | 000,026,176 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\hamachi.sys -- (hamachi)
DRV - [2008.11.11 14:42:00 | 000,024,832 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lgusbmodem.sys -- (USBModem)
DRV - [2008.11.11 14:41:00 | 000,019,968 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lgusbdiag.sys -- (UsbDiag)
DRV - [2008.11.11 14:41:00 | 000,013,056 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lgusbbus.sys -- (usbbus)
DRV - [2005.12.01 12:49:22 | 000,023,600 | ---- | M] (Licensed for Gebhard Software) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\drhard.sys -- (drhard)
DRV - [2005.11.14 14:28:00 | 000,034,176 | ---- | M] (O2Micro ) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\o2media.sys -- (O2MDRDR)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\URLSearchHook: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - Reg Error: Value error. File not found
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.t-online.de/cpm-redir/ie-8.html
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.searchqu.com/406
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 24 9E 86 36 15 88 CB 01  [binary data]
IE - HKCU\..\URLSearchHook: {ba14329e-9550-4989-b3f2-9732e92d17cc} - Reg Error: Key error. File not found
IE - HKCU\..\URLSearchHook: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - Reg Error: Value error. File not found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultthis.engineName: "InnoGames Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2682599&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://www.web.de"
FF - prefs.js..extensions.enabledItems: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.9.2
FF - prefs.js..extensions.enabledItems: {ba14329e-9550-4989-b3f2-9732e92d17cc}:3.3.3.2
FF - prefs.js..extensions.enabledItems: antiphishing@bullguard:1.0
FF - prefs.js..extensions.enabledItems: engine@conduit.com:3.3.3.2
FF - prefs.js..extensions.enabledItems: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065}:3.3.3.2
FF - prefs.js..extensions.enabledItems: foxgame2@foxgame.org:2.0 Beta
FF - prefs.js..extensions.enabledItems: vshare@toolbar:1.0.0
FF - prefs.js..extensions.enabledItems: fbdislike@doweb.fr:1.2.3
FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:5.0.0.6778
FF - prefs.js..extensions.enabledItems: {c7478d43-2bd5-4844-98b8-c2a6aa9ed677}:3.3.3.2
FF - prefs.js..extensions.enabledItems: personas@christopher.beard:1.6.2
FF - prefs.js..extensions.enabledItems: firefox@tvunetworks.com:2
FF - prefs.js..extensions.enabledItems: 5
FF - prefs.js..extensions.enabledItems: 3
FF - prefs.js..extensions.enabledItems: 1
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1
FF - prefs.js..extensions.enabledItems: YoutubeDownloader@PeterOlayev.com:1.5
FF - prefs.js..extensions.enabledItems: youtube2mp3@mondayx.de:1.0.7
FF - prefs.js..extensions.enabledItems: {c0c9a2c7-2e5c-4447-bc53-97718bc91e1b}:4.1
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: {A79D8B60-1FF0-47F0-8E79-8CDE1FECB0FD}:1.0.0
FF - prefs.js..keyword.URL: "hxxp://dts.search-results.com/sr?src=ffb&appid=102&systemid=406&q="
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pages.tvunetworks.com/WebPlayer: C:\Windows\system32\TVUAx\npTVUAx.dll (TVU networks)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\@veetle.com/veetleCorePlugin,version=0.9.18: C:\Program Files\Veetle\plugins\npVeetle.dll (Veetle Inc)
FF - HKLM\Software\MozillaPlugins\@veetle.com/veetlePlayerPlugin,version=0.9.18: C:\Program Files\Veetle\Player\npvlc.dll (Veetle Inc)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 5.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.07.29 21:47:20 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 5.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
 
[2010.11.19 20:16:04 | 000,000,000 | ---D | M] (No name found) -- C:\Users\FamGeisel\AppData\Roaming\mozilla\Extensions
[2011.07.31 08:44:55 | 000,000,000 | ---D | M] (No name found) -- C:\Users\FamGeisel\AppData\Roaming\mozilla\Firefox\Profiles\6okg7wqc.default\extensions
[2011.07.29 04:07:01 | 000,000,000 | ---D | M] (InnoGames Community Toolbar) -- C:\Users\FamGeisel\AppData\Roaming\mozilla\Firefox\Profiles\6okg7wqc.default\extensions\{c7478d43-2bd5-4844-98b8-c2a6aa9ed677}
[2011.07.29 04:07:00 | 000,000,000 | ---D | M] (FDislike) -- C:\Users\FamGeisel\AppData\Roaming\mozilla\Firefox\Profiles\6okg7wqc.default\extensions\fbdislike@doweb.fr
[2011.07.29 04:07:00 | 000,000,000 | ---D | M] (No name found) -- C:\Users\FamGeisel\AppData\Roaming\mozilla\Firefox\Profiles\6okg7wqc.default\extensions\foxgame2@foxgame.org
[2011.03.23 18:59:41 | 000,000,000 | ---D | M] (Personas) -- C:\Users\FamGeisel\AppData\Roaming\mozilla\Firefox\Profiles\6okg7wqc.default\extensions\personas@christopher.beard
[2011.07.29 04:06:20 | 000,000,000 | ---D | M] (Yontoo Layers) -- C:\Users\FamGeisel\AppData\Roaming\mozilla\Firefox\Profiles\6okg7wqc.default\extensions\plugin@yontoo.com
[2011.06.22 14:13:00 | 000,000,919 | ---- | M] () -- C:\Users\FamGeisel\AppData\Roaming\Mozilla\Firefox\Profiles\6okg7wqc.default\searchplugins\conduit.xml
[2011.03.22 23:40:57 | 000,001,908 | ---- | M] () -- C:\Users\FamGeisel\AppData\Roaming\Mozilla\Firefox\Profiles\6okg7wqc.default\searchplugins\metacrawler.xml
[2011.07.29 21:47:20 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\mozilla firefox\extensions
File not found (No name found) -- 
() (No name found) -- C:\USERS\FAMGEISEL\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\6OKG7WQC.DEFAULT\EXTENSIONS\{C0C9A2C7-2E5C-4447-BC53-97718BC91E1B}.XPI
() (No name found) -- C:\USERS\FAMGEISEL\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\6OKG7WQC.DEFAULT\EXTENSIONS\{E4A8A97B-F2ED-450B-B12D-EE082BA24781}.XPI
() (No name found) -- C:\USERS\FAMGEISEL\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\6OKG7WQC.DEFAULT\EXTENSIONS\COMPATIBILITY@ADDONS.MOZILLA.ORG.XPI
() (No name found) -- C:\USERS\FAMGEISEL\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\6OKG7WQC.DEFAULT\EXTENSIONS\E3PO@WMCLAN.NET.XPI
() (No name found) -- C:\USERS\FAMGEISEL\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\6OKG7WQC.DEFAULT\EXTENSIONS\FOXGAME2@FOXGAME.ORG.XPI
() (No name found) -- C:\USERS\FAMGEISEL\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\6OKG7WQC.DEFAULT\EXTENSIONS\MP4DOWNLOADER@JEFF.NET.XPI
() (No name found) -- C:\USERS\FAMGEISEL\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\6OKG7WQC.DEFAULT\EXTENSIONS\WEBMASTER@KEEP-TUBE.COM.XPI
[2011.07.08 09:31:38 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2010.01.01 10:00:00 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2010.01.01 10:00:00 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2010.01.01 10:00:00 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2010.01.01 10:00:00 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2010.01.01 10:00:00 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2010.01.01 10:00:00 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2009.06.10 23:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~3\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~3\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (softonic-de3 Toolbar) - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - Reg Error: Value error. File not found
O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (softonic-de3 Toolbar) - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - Reg Error: Value error. File not found
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O4 - HKLM..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe (Alps Electric Co., Ltd.)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [BCSSync] C:\Program Files\Microsoft Office\Office14\BCSSync.exe (Microsoft Corporation)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 16
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O8 - Extra context menu item: Free YouTube Download - C:\Users\FamGeisel\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~1\MICROS~3\Office14\GROOVEEX.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias -  File not found
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: UxTuneUp - C:\Windows\System32\uxtuneup.dll (TuneUp Software)
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
MsConfig - StartUpReg: BullGuard - hkey= - key= -  File not found
MsConfig - StartUpReg: LogMeIn Hamachi Ui - hkey= - key= -  File not found
MsConfig - StartUpReg: Raptr - hkey= - key= -  File not found
MsConfig - StartUpReg: windefender - hkey= - key= -  File not found
MsConfig - State: "startup" - 2
 
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: BsScanner - Service
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: NTDS -  File not found
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vmms - Service
SafeBootMin: WinDefend - C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: BsScanner - Service
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: NTDS -  File not found
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vmms - Service
SafeBootNet: WinDefend - C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {8DCBEDE1-2B2C-E2DA-DA9B-02DCA3E75EEB} - 
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - 
ActiveX: >{8D637D60-BBDB-41BC-99AA-3BCB524BF750} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
 
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.08.02 00:19:26 | 000,000,000 | ---D | C] -- C:\Users\FamGeisel\AppData\Roaming\Malwarebytes
[2011.08.02 00:19:20 | 000,041,272 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2011.08.02 00:19:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011.08.02 00:19:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2011.08.02 00:19:15 | 000,022,712 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2011.08.02 00:19:14 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2011.07.30 18:58:35 | 000,000,000 | ---D | C] -- C:\Users\FamGeisel\Desktop\VisualBoyAdvance-1.7.2
[2011.07.30 00:36:34 | 000,000,000 | ---D | C] -- C:\cb923d1979cc8704d6ea19fc
[2011.07.30 00:19:14 | 000,000,000 | ---D | C] -- C:\Program Files\MSXML 4.0
[2011.07.29 21:55:48 | 000,000,000 | ---D | C] -- C:\Users\FamGeisel\AppData\Roaming\Avira
[2011.07.29 21:51:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
[2011.07.29 21:51:23 | 000,138,192 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avipbb.sys
[2011.07.29 21:51:23 | 000,066,616 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avgntflt.sys
[2011.07.29 21:51:23 | 000,028,520 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\ssmdrv.sys
[2011.07.29 21:51:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira
[2011.07.29 21:51:22 | 000,000,000 | ---D | C] -- C:\Program Files\Avira
[2011.07.29 20:31:10 | 000,579,584 | ---- | C] (OldTimer Tools) -- C:\Users\FamGeisel\Desktop\OTL.exe
[2011.07.27 17:43:24 | 000,000,000 | ---D | C] -- C:\Program Files\Reality Pump
[2011.07.25 20:25:58 | 000,000,000 | ---D | C] -- C:\Users\FamGeisel\Desktop\My DVD
[2011.07.25 20:20:32 | 000,000,000 | ---D | C] -- C:\Users\FamGeisel\Documents\Xilisoft DVD Creator 6
[2011.07.25 19:57:49 | 000,000,000 | ---D | C] -- C:\Users\FamGeisel\AppData\Local\Xilisoft
[2011.07.25 19:56:27 | 000,000,000 | ---D | C] -- C:\Users\FamGeisel\AppData\Roaming\Xilisoft
[2011.07.22 20:59:54 | 000,000,000 | ---D | C] -- C:\Users\FamGeisel\AppData\Local\CrashDumps
[2011.07.15 23:17:37 | 000,000,000 | ---D | C] -- C:\Windows\System32\DRVSTORE
[2011.07.15 23:10:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Soluto
[2011.07.15 21:18:08 | 000,000,000 | ---D | C] -- C:\Users\FamGeisel\AppData\Roaming\NVIDIA
[2011.07.14 20:32:14 | 000,000,000 | ---D | C] -- C:\Wichtige Programme
[2011.07.14 17:42:42 | 000,000,000 | ---D | C] -- C:\Users\FamGeisel\Documents\Outlook-Dateien
[2011.07.14 17:13:36 | 000,000,000 | ---D | C] -- C:\Program Files\LG PC Suite II
[2011.07.14 17:13:22 | 000,000,000 | ---D | C] -- C:\Users\FamGeisel\AppData\Roaming\InstallShield
[2011.07.07 15:47:22 | 000,000,000 | ---D | C] -- C:\Users\FamGeisel\Desktop\Auto
[2011.07.04 22:39:13 | 000,000,000 | ---D | C] -- C:\Users\FamGeisel\AppData\Roaming\dvdcss
[2011.03.14 15:55:47 | 000,022,528 | ---- | C] (Microsoft) -- C:\Users\FamGeisel\AppData\Local\60353310,5468.ToDelete
[2011.03.14 15:55:47 | 000,022,528 | ---- | C] (Microsoft) -- C:\Users\FamGeisel\AppData\Local\59754010,7421.ToDelete
[2011.03.14 15:55:47 | 000,022,528 | ---- | C] (Microsoft) -- C:\Users\FamGeisel\AppData\Local\59153741,2109.ToDelete
[2011.03.14 15:55:47 | 000,022,528 | ---- | C] (Microsoft) -- C:\Users\FamGeisel\AppData\Local\58554695,3125.ToDelete
[2011.03.14 15:55:47 | 000,022,528 | ---- | C] (Microsoft) -- C:\Users\FamGeisel\AppData\Local\57954185,5468.ToDelete
[2011.03.14 15:55:47 | 000,022,528 | ---- | C] (Microsoft) -- C:\Users\FamGeisel\AppData\Local\57354924,8046.ToDelete
[2011.03.14 15:55:47 | 000,022,528 | ---- | C] (Microsoft) -- C:\Users\FamGeisel\AppData\Local\56754665,039.ToDelete
[2011.03.14 15:55:47 | 000,022,528 | ---- | C] (Microsoft) -- C:\Users\FamGeisel\AppData\Local\56155396,4843.ToDelete
[2011.03.14 15:55:47 | 000,022,528 | ---- | C] (Microsoft) -- C:\Users\FamGeisel\AppData\Local\55555068,3593.ToDelete
[2011.03.14 15:55:47 | 000,022,528 | ---- | C] (Microsoft) -- C:\Users\FamGeisel\AppData\Local\55474981,4453.ToDelete
[2011.03.14 15:55:47 | 000,022,528 | ---- | C] (Microsoft) -- C:\Users\FamGeisel\AppData\Local\54955819,3359.ToDelete
[2011.03.14 15:55:47 | 000,022,528 | ---- | C] (Microsoft) -- C:\Users\FamGeisel\AppData\Local\54355592,7734.ToDelete
[2011.03.14 15:55:47 | 000,022,528 | ---- | C] (Microsoft) -- C:\Users\FamGeisel\AppData\Local\53752510,7421.ToDelete
[2009.07.13 22:46:42 | 001,169,224 | -H-- | C] (Microsoft Corporation) -- C:\Users\FamGeisel\AppData\Roaming\BS37SPB.exe
[2009.07.13 22:46:42 | 001,169,224 | ---- | C] (Microsoft Corporation) -- C:\Users\FamGeisel\AppData\Roaming\BS37Sp.exe
[6 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[6 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2011.08.02 02:11:22 | 000,054,016 | ---- | M] () -- C:\Windows\System32\drivers\fjavndv.sys
[2011.08.01 19:02:52 | 000,017,264 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011.08.01 19:02:52 | 000,017,264 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011.08.01 19:00:23 | 000,647,506 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011.08.01 19:00:23 | 000,118,636 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011.08.01 18:58:40 | 000,138,192 | ---- | M] (Avira GmbH) -- C:\Windows\System32\drivers\avipbb.sys
[2011.08.01 18:58:40 | 000,066,616 | ---- | M] (Avira GmbH) -- C:\Windows\System32\drivers\avgntflt.sys
[2011.08.01 18:55:19 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011.08.01 18:54:56 | 1609,089,024 | -HS- | M] () -- C:\hiberfil.sys
[2011.07.30 18:16:38 | 000,406,584 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2011.07.29 21:51:36 | 000,002,031 | ---- | M] () -- C:\Users\Public\Desktop\Avira AntiVir Control Center.lnk
[2011.07.29 21:48:23 | 056,096,768 | ---- | M] () -- C:\Users\FamGeisel\Desktop\avira_antivir_personal_de.exe
[2011.07.29 21:47:21 | 000,001,115 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2011.07.29 20:31:17 | 000,579,584 | ---- | M] (OldTimer Tools) -- C:\Users\FamGeisel\Desktop\OTL.exe
[2011.07.16 22:36:43 | 000,012,777 | ---- | M] () -- C:\Users\FamGeisel\.recently-used.xbel
[2011.07.16 20:49:42 | 000,032,401 | ---- | M] () -- C:\Users\FamGeisel\Desktop\pic.jpg
[2011.07.16 19:59:03 | 000,000,193 | ---- | M] () -- C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc
[2011.07.06 19:52:42 | 000,041,272 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2011.07.06 19:52:42 | 000,022,712 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[6 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[6 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2011.08.02 02:11:22 | 000,054,016 | ---- | C] () -- C:\Windows\System32\drivers\fjavndv.sys
[2011.07.29 21:51:36 | 000,002,031 | ---- | C] () -- C:\Users\Public\Desktop\Avira AntiVir Control Center.lnk
[2011.07.29 21:48:21 | 056,096,768 | ---- | C] () -- C:\Users\FamGeisel\Desktop\avira_antivir_personal_de.exe
[2011.07.29 21:47:21 | 000,001,127 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2011.07.29 21:47:21 | 000,001,115 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2011.07.28 18:20:34 | 1609,089,024 | -HS- | C] () -- C:\hiberfil.sys
[2011.07.16 22:36:43 | 000,012,777 | ---- | C] () -- C:\Users\FamGeisel\.recently-used.xbel
[2011.07.16 20:33:37 | 000,032,401 | ---- | C] () -- C:\Users\FamGeisel\Desktop\pic.jpg
[2011.07.15 23:21:12 | 000,000,193 | ---- | C] () -- C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc
[2011.06.22 22:12:12 | 000,182,272 | ---- | C] () -- C:\Windows\patchw32.dll
[2011.06.15 21:08:30 | 000,001,964 | ---- | C] () -- C:\Windows\Sandboxie.ini
[2011.05.12 21:04:01 | 000,013,886 | ---- | C] () -- C:\Users\FamGeisel\AppData\Local\75841214,8437
[2011.05.12 20:58:15 | 000,008,192 | ---- | C] () -- C:\Users\FamGeisel\AppData\Local\75495955,0781
[2011.05.09 22:03:38 | 000,013,886 | ---- | C] () -- C:\Users\FamGeisel\AppData\Local\79418519,5312
[2011.05.08 23:10:50 | 000,009,790 | ---- | C] () -- C:\Users\FamGeisel\AppData\Local\83450506,9765
[2011.04.28 15:48:45 | 000,000,000 | ---- | C] () -- C:\Users\FamGeisel\AppData\Local\56925154,2968
[2011.04.17 17:27:35 | 000,008,192 | ---- | C] () -- C:\Users\FamGeisel\AppData\Local\62855843,3359
[2011.04.10 17:41:47 | 000,000,000 | ---- | C] () -- C:\Users\FamGeisel\AppData\Local\63707698,2421
[2011.04.10 15:49:21 | 000,000,000 | ---- | C] () -- C:\Users\FamGeisel\AppData\Local\56961052,7343
[2011.04.10 15:44:52 | 000,008,338 | ---- | C] () -- C:\Users\FamGeisel\AppData\Local\56692598,7968
[2011.04.10 13:59:41 | 000,000,000 | ---- | C] () -- C:\Users\FamGeisel\AppData\Local\50381726,125
[2011.04.10 13:50:28 | 000,004,096 | ---- | C] () -- C:\Users\FamGeisel\AppData\Local\49828752,9296
[2011.04.10 01:30:53 | 000,000,000 | ---- | C] () -- C:\Users\FamGeisel\AppData\Local\5453058,5937
[2011.03.15 22:25:11 | 000,000,000 | ---- | C] () -- C:\Windows\System32\mail.dat
[2011.03.15 22:25:04 | 000,000,000 | ---- | C] () -- C:\Windows\System32\mess.dat
[2010.12.26 16:08:16 | 000,053,248 | ---- | C] () -- C:\Windows\System32\CommonDL.dll
[2010.12.26 16:08:16 | 000,002,413 | ---- | C] () -- C:\Windows\System32\lgAxconfig.ini
[2010.12.13 17:07:07 | 000,000,056 | -H-- | C] () -- C:\Windows\System32\ezsidmv.dat
[2010.11.21 15:19:37 | 000,088,280 | -H-- | C] () -- C:\Windows\System32\mlfcache.dat
[2009.07.14 06:57:37 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009.07.14 06:33:53 | 000,406,584 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2009.07.14 04:05:48 | 000,647,506 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2009.07.14 04:05:48 | 000,291,294 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2009.07.14 04:05:48 | 000,118,636 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2009.07.14 04:05:48 | 000,031,548 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2009.07.14 04:05:05 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2009.07.14 04:04:11 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2009.07.14 02:19:49 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe
[2009.07.14 01:55:01 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009.07.14 01:51:43 | 000,073,728 | ---- | C] () -- C:\Windows\System32\BthpanContextHandler.dll
[2009.07.14 01:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\System32\BWContextHandler.dll
[2009.06.10 23:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
 
========== LOP Check ==========
 
[2011.07.29 04:06:59 | 000,000,000 | ---D | M] -- C:\Users\FamGeisel\AppData\Roaming\Azureus
[2010.11.20 13:47:21 | 000,000,000 | ---D | M] -- C:\Users\FamGeisel\AppData\Roaming\BullGuard
[2010.12.27 01:28:39 | 000,000,000 | ---D | M] -- C:\Users\FamGeisel\AppData\Roaming\DVDVideoSoftIEHelpers
[2011.07.29 04:06:59 | 000,000,000 | ---D | M] -- C:\Users\FamGeisel\AppData\Roaming\gtk-2.0
[2010.12.28 02:21:13 | 000,000,000 | ---D | M] -- C:\Users\FamGeisel\AppData\Roaming\Jumping Bytes
[2010.12.26 00:36:47 | 000,000,000 | ---D | M] -- C:\Users\FamGeisel\AppData\Roaming\LG Electronics
[2011.07.29 04:07:02 | 000,000,000 | ---D | M] -- C:\Users\FamGeisel\AppData\Roaming\Raptr
[2010.11.20 13:47:21 | 000,000,000 | ---D | M] -- C:\Users\FamGeisel\AppData\Roaming\Software Inspection Library
[2011.06.19 01:51:15 | 000,000,000 | ---D | M] -- C:\Users\FamGeisel\AppData\Roaming\TuneUp Software
[2011.07.25 19:56:27 | 000,000,000 | ---D | M] -- C:\Users\FamGeisel\AppData\Roaming\Xilisoft
[2011.06.15 14:36:27 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2010.11.22 19:26:27 | 000,000,000 | ---D | M] -- C:\Users\FamGeisel\AppData\Roaming\Adobe
[2011.07.29 21:55:48 | 000,000,000 | ---D | M] -- C:\Users\FamGeisel\AppData\Roaming\Avira
[2011.07.29 04:06:59 | 000,000,000 | ---D | M] -- C:\Users\FamGeisel\AppData\Roaming\Azureus
[2010.11.20 13:47:21 | 000,000,000 | ---D | M] -- C:\Users\FamGeisel\AppData\Roaming\BullGuard
[2011.07.04 22:39:14 | 000,000,000 | ---D | M] -- C:\Users\FamGeisel\AppData\Roaming\dvdcss
[2010.12.27 01:28:39 | 000,000,000 | ---D | M] -- C:\Users\FamGeisel\AppData\Roaming\DVDVideoSoftIEHelpers
[2011.07.29 04:06:59 | 000,000,000 | ---D | M] -- C:\Users\FamGeisel\AppData\Roaming\gtk-2.0
[2010.11.19 18:29:55 | 000,000,000 | ---D | M] -- C:\Users\FamGeisel\AppData\Roaming\Identities
[2011.07.14 17:13:22 | 000,000,000 | ---D | M] -- C:\Users\FamGeisel\AppData\Roaming\InstallShield
[2010.12.28 02:21:13 | 000,000,000 | ---D | M] -- C:\Users\FamGeisel\AppData\Roaming\Jumping Bytes
[2010.12.26 00:36:47 | 000,000,000 | ---D | M] -- C:\Users\FamGeisel\AppData\Roaming\LG Electronics
[2010.11.19 18:33:49 | 000,000,000 | ---D | M] -- C:\Users\FamGeisel\AppData\Roaming\Macromedia
[2011.08.02 00:19:26 | 000,000,000 | ---D | M] -- C:\Users\FamGeisel\AppData\Roaming\Malwarebytes
[2009.07.14 09:49:10 | 000,000,000 | ---D | M] -- C:\Users\FamGeisel\AppData\Roaming\Media Center Programs
[2011.07.29 04:04:29 | 000,000,000 | --SD | M] -- C:\Users\FamGeisel\AppData\Roaming\Microsoft
[2011.07.29 04:06:59 | 000,000,000 | ---D | M] -- C:\Users\FamGeisel\AppData\Roaming\mIRC
[2010.11.19 20:16:04 | 000,000,000 | ---D | M] -- C:\Users\FamGeisel\AppData\Roaming\Mozilla
[2011.07.15 21:18:08 | 000,000,000 | ---D | M] -- C:\Users\FamGeisel\AppData\Roaming\NVIDIA
[2011.07.29 04:07:02 | 000,000,000 | ---D | M] -- C:\Users\FamGeisel\AppData\Roaming\Raptr
[2011.08.02 00:25:49 | 000,000,000 | ---D | M] -- C:\Users\FamGeisel\AppData\Roaming\Skype
[2011.08.02 00:25:25 | 000,000,000 | ---D | M] -- C:\Users\FamGeisel\AppData\Roaming\skypePM
[2010.11.20 13:47:21 | 000,000,000 | ---D | M] -- C:\Users\FamGeisel\AppData\Roaming\Software Inspection Library
[2011.06.19 01:51:15 | 000,000,000 | ---D | M] -- C:\Users\FamGeisel\AppData\Roaming\TuneUp Software
[2011.07.29 04:07:02 | 000,000,000 | ---D | M] -- C:\Users\FamGeisel\AppData\Roaming\vlc
[2010.12.03 17:25:45 | 000,000,000 | ---D | M] -- C:\Users\FamGeisel\AppData\Roaming\WinRAR
[2011.07.25 19:56:27 | 000,000,000 | ---D | M] -- C:\Users\FamGeisel\AppData\Roaming\Xilisoft
 
< %APPDATA%\*.exe /s >
[2009.06.10 23:23:22 | 001,169,224 | ---- | M] (Microsoft Corporation) -- C:\Users\FamGeisel\AppData\Roaming\BS37Sp.exe
[2009.06.10 23:23:22 | 001,169,224 | -H-- | M] (Microsoft Corporation) -- C:\Users\FamGeisel\AppData\Roaming\BS37SPB.exe
[2010.11.20 01:19:07 | 000,310,208 | ---- | M] (Georgia Institute of Technology) -- C:\Users\FamGeisel\AppData\Roaming\Azureus\plugins\mlab\ShaperProbeC.exe
[2011.06.19 15:10:13 | 008,558,520 | ---- | M] (Vuze Inc.) -- C:\Users\FamGeisel\AppData\Roaming\Azureus\tmp\AZU5764002229947810502.tmp\Vuze_4.6.0.4b_win32.exe
 
< %SYSTEMDRIVE%\*.exe >
 
 
< MD5 for: AGP440.SYS  >
[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\drivers\AGP440.sys
[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_x86_neutral_65848c2d7375a720\AGP440.sys
[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_b9e9435f20046eeb\AGP440.sys
[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_bc1a57271cf2f285\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\drivers\atapi.sys
[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_x86_neutral_f64b9c35a3a5be81\atapi.sys
[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_dd0e7e3d82dd640d\atapi.sys
[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_df3f92057fcbe7a7\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\System32\cngaudit.dll
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
 
< MD5 for: IASTORV.SYS  >
[2011.03.11 07:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_b0daddb9e6380745\iaStorV.sys
[2011.03.11 07:43:55 | 000,332,160 | ---- | M] (Intel Corporation) MD5=71F1A494FEDF4B33C02C4A6A28D6D9E9 -- C:\Windows\System32\drivers\iaStorV.sys
[2011.03.11 07:43:55 | 000,332,160 | ---- | M] (Intel Corporation) MD5=71F1A494FEDF4B33C02C4A6A28D6D9E9 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_0033117673c16921\iaStorV.sys
[2011.03.11 07:43:55 | 000,332,160 | ---- | M] (Intel Corporation) MD5=71F1A494FEDF4B33C02C4A6A28D6D9E9 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_aef580fde910b4b0\iaStorV.sys
[2011.03.11 07:28:00 | 000,332,160 | ---- | M] (Intel Corporation) MD5=778D0E6D7D9EBA0C403BADBAAD41DB20 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_b152a892ff64119f\iaStorV.sys
[2009.07.14 03:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_18cccb83b34e1453\iaStorV.sys
[2009.07.14 03:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_aee7a89be91b9000\iaStorV.sys
[2010.11.20 14:29:54 | 000,332,160 | ---- | M] (Intel Corporation) MD5=A3CAE5D281DB4CFF7CFF8233507EE5AD -- C:\Windows\SoftwareDistribution\Download\18e2c83e42cc8f0cc17b5dbfaf982690\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_b118bc63e60a139a\iaStorV.sys
[2011.03.11 07:52:21 | 000,332,160 | ---- | M] (Intel Corporation) MD5=B9039A34C2F8769490DCC494E2402445 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_afae2d45020c148b\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\SoftwareDistribution\Download\18e2c83e42cc8f0cc17b5dbfaf982690\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_ffbf212e963c0162\netlogon.dll
[2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\System32\netlogon.dll
[2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_fd8e0d66994d7dc8\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2011.03.11 07:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_3ba44e691d6eb11d\nvstor.sys
[2011.03.11 07:44:01 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4520B63899E867F354EE012D34E11536 -- C:\Windows\System32\drivers\nvstor.sys
[2011.03.11 07:44:01 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4520B63899E867F354EE012D34E11536 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_38e464dbe521cc7f\nvstor.sys
[2011.03.11 07:44:01 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4520B63899E867F354EE012D34E11536 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_39bef1ad20475e88\nvstor.sys
[2011.03.11 07:28:10 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=66D468654A58594F5F3BA63D5AD5B1AF -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_3c1c1942369abb77\nvstor.sys
[2011.03.11 07:52:25 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=8A7583A3B58D3EEB28BB26626526BC91 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_3a779df43942be63\nvstor.sys
[2010.11.20 14:30:06 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=9283C58EBAA2618F93482EB5DABCEC82 -- C:\Windows\SoftwareDistribution\Download\18e2c83e42cc8f0cc17b5dbfaf982690\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_3be22d131d40bd72\nvstor.sys
[2009.07.14 03:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_5bde3fe2945bce9e\nvstor.sys
[2009.07.14 03:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_39b1194b205239d8\nvstor.sys
 
< MD5 for: NVSTOR32.SYS  >
[2009.08.04 18:44:14 | 000,213,024 | ---- | M] (NVIDIA Corporation) MD5=269DE658DEAF032564E8B6430B5BD170 -- C:\Program Files\NVIDIA\IDE\Win7\sataraid\nvstor32.sys
[2009.08.04 18:44:14 | 000,213,024 | ---- | M] (NVIDIA Corporation) MD5=269DE658DEAF032564E8B6430B5BD170 -- C:\Program Files\NVIDIA\IDE\WinVista\sataraid\nvstor32.sys
[2009.08.04 18:43:40 | 000,213,024 | ---- | M] (NVIDIA Corporation) MD5=3FF57A9A657C9690ECBC8B1E3B6E3979 -- C:\Program Files\NVIDIA\IDE\Win7\sata_ide\nvstor32.sys
[2009.08.04 18:43:40 | 000,213,024 | ---- | M] (NVIDIA Corporation) MD5=3FF57A9A657C9690ECBC8B1E3B6E3979 -- C:\Program Files\NVIDIA\IDE\WinVista\sata_ide\nvstor32.sys
 
< MD5 for: SCECLI.DLL  >
[2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\System32\scecli.dll
[2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_37e4387f3a6f0483\scecli.dll
[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\SoftwareDistribution\Download\18e2c83e42cc8f0cc17b5dbfaf982690\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_3a154c47375d881d\scecli.dll
 
< MD5 for: USER32.DLL  >
[2009.07.14 03:16:17 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=34B7E222E81FAFA885F0C5F2CFA56861 -- C:\Windows\System32\user32.dll
[2009.07.14 03:16:17 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=34B7E222E81FAFA885F0C5F2CFA56861 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_cd0ec264ceb014a3\user32.dll
[2010.11.20 14:21:33 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 -- C:\Windows\SoftwareDistribution\Download\18e2c83e42cc8f0cc17b5dbfaf982690\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_cf3fd62ccb9e983d\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SoftwareDistribution\Download\18e2c83e42cc8f0cc17b5dbfaf982690\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\System32\userinit.exe
[2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
 
< MD5 for: WININIT.EXE  >
[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\System32\wininit.exe
[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2009.10.28 08:17:59 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD -- C:\Windows\System32\winlogon.exe
[2009.10.28 08:17:59 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_6fc699643622d177\winlogon.exe
[2009.10.28 07:52:08 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=3BABE6767C78FBF5FB8435FEED187F30 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_703394514f56f7c2\winlogon.exe
[2010.11.20 14:17:54 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\SoftwareDistribution\Download\18e2c83e42cc8f0cc17b5dbfaf982690\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_71ca6b0233339500\winlogon.exe
[2009.07.14 03:14:45 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=8EC6A4AB12B8F3759E21F8E3A388F2CF -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_6f99573a36451166\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2009.07.14 01:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\System32\drivers\ws2ifsl.sys
[2009.07.14 01:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_4f5cf6f829213bb2\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
[2009.07.14 03:15:19 | 000,016,896 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\system32\eventcls.dll
 
<           >

< End of report >

cosinus · 02.08.2011, 09:49

Zitat:

c:\Office\microsoft.office.professional.plus.2010.x86.german.vl.edition-tiw\mini-kms_activator_v1.052.exe (Riskware.Keygen)

Cracks/Keygens sind zu 99,9% gefährliche Schädlinge, mit denen man nicht spaßen sollte. Ausserdem sind diese illegal und wir unterstützen die Verwendung von geklauter Software nicht. Somit beschränkt sich der Support auf Anleitung zur kompletten Neuinstallation!!

Dass illegale Cracks und Keygens im Wesentlichen dazu dienen, Malware zu verbreiten ist kein Geheimnis und muss jedem klar sein!

Thorv · 02.08.2011, 13:20

Ich brauchte den Keygen nur, weil ich den echten Key verlegt hast.

Und nochmal für etwas zu bezahlen, was man schon gezahlt hat, find ich unsinnig, zumal das ja auch ordentliche Beträge sind.

Ich hoffe du verstehst das und hilfst mir trotzdem.

MfG Thorv

cosinus · 02.08.2011, 14:13

Zitat:

Ich brauchte den Keygen nur, weil ich den echten Key verlegt hast.

Die Ausrede interessiert mich nicht wirklich, ist auch völlig irrelevant warum du das einsetzt, nur wenn wir sowas sehen gibt es nur noch den Hinweis auf eine Neuinstallation von Windows.

Thorv · 02.08.2011, 14:39

tsss

BKA-Trojaner und keine Ahnung wie ich ihn beseitigen soll

Plagegeister aller Art und deren Bekämpfung: BKA-Trojaner und keine Ahnung wie ich ihn beseitigen soll