Zurück   Trojaner-Board > Malware entfernen > Plagegeister aller Art und deren Bekämpfung
Personal Shield Pro hat mich erwischt

Personal Shield Pro hat mich erwischt


Plagegeister aller Art und deren Bekämpfung: Personal Shield Pro hat mich erwischt

Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen.

Antwort
Alt 13.08.2011, 12:57   #1
Erdwurm93
 
Personal Shield Pro hat mich erwischt - Standard

Personal Shield Pro hat mich erwischt


Hallo liebe Trojaner Board Nutzer! Ich hab mich hier neu registriert und das liegt nicht nur daran, dass ihr alle so sympathische Jungs und Mädels seid, sondern weil ich seit neustem Personal Shield Pro auf dem Rechner hab.Mein Rechner ist ein HP Laptop mit Win7. Zu Shield Pro gibt es hier ja schon einen Thread, der wurde aber über einen Monat nicht mehr aktualisiert. Trotzdem befolge ich mal die ersten Schritte aus dem anderen Thread. Also hier der Malwarebytes Log:
Zitat:
Malwarebytes' Anti-Malware 1.51.1.1800
www.malwarebytes.org

Datenbank Version: 7453

Windows 6.1.7601 Service Pack 1
Internet Explorer 9.0.8112.16421

13.08.2011 13:07:56
mbam-log-2011-08-13 (13-07-56).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Durchsuchte Objekte: 452443
Laufzeit: 2 Stunde(n), 46 Minute(n), 2 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 2
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 3
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 13

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
c:\Users\Edgar\AppData\Local\ratdsns.dll (Trojan.Hiloti) -> Delete on reboot.
c:\Users\Edgar\AppData\Local\oguyikov.dll (Trojan.Agent.U) -> Delete on reboot.

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Okukamabimo (Trojan.Hiloti) -> Value: Okukamabimo -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\fB13602FlHjA13602 (Trojan.FakeAlert) -> Value: fB13602FlHjA13602 -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Mhasuxoxo (Trojan.Agent.U) -> Value: Mhasuxoxo -> Delete on reboot.

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
c:\Users\Edgar\AppData\Local\ratdsns.dll (Trojan.Hiloti) -> Delete on reboot.
c:\programdata\fb13602flhja13602\fb13602flhja13602.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\Users\Edgar\AppData\Local\Temp\0.8163109151742529.exe (Trojan.Ransom.Gen) -> Quarantined and deleted successfully.
c:\Users\Edgar\AppData\Local\Temp\setup2448779484.exe (Trojan.Hiloti) -> Quarantined and deleted successfully.
c:\Users\Edgar\AppData\Local\Temp\setup1820253980.exe (Rootkit.TDSS) -> Quarantined and deleted successfully.
c:\Users\Edgar\AppData\LocalLow\Sun\Java\deployment\cache\6.0\49\6b41de31-1683a955 (Trojan.Ransom.Gen) -> Quarantined and deleted successfully.
c:\Users\Edgar\AppData\Roaming\Adobe\plugs\mmc17339542.txt (Rootkit.TDSS) -> Quarantined and deleted successfully.
c:\Users\Edgar\downloads\u94.exe (HackTool.Proxy) -> Quarantined and deleted successfully.
c:\Users\Edgar\AppData\Local\Temp\0.5403404318580771.exe (Exploit.Drop.2) -> Quarantined and deleted successfully.
c:\Users\Edgar\AppData\Roaming\Adobe\shed\thr1.chm (Malware.Trace) -> Quarantined and deleted successfully.
c:\Users\Edgar\AppData\Roaming\Adobe\plugs\mmc158.exe (Trojan.Agent.Gen) -> Quarantined and deleted successfully.
c:\Users\Edgar\AppData\Roaming\Adobe\plugs\mmc17373394.txt (Trojan.Agent.Gen) -> Quarantined and deleted successfully.
c:\Users\Edgar\AppData\Local\oguyikov.dll (Trojan.Agent.U) -> Delete on reboot.

Und hier nun noch der Log File von OTL:

OTL Logfile:
Code:
ATTFilter
OTL logfile created on: 13.08.2011 13:29:57 - Run 1
OTL by OldTimer - Version 3.2.26.1 Folder = C:\Users\Edgar\Desktop\Neuer Ordner
Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 1,12 Gb Available Physical Memory | 56,27% Memory free
4,00 Gb Paging File | 2,89 Gb Available in Paging File | 72,20% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 221,20 Gb Total Space | 84,34 Gb Free Space | 38,13% Space Free | Partition Type: NTFS
Drive D: | 11,68 Gb Total Space | 2,20 Gb Free Space | 18,84% Space Free | Partition Type: NTFS
 
Computer Name: EDGAR-PC | User Name: Edgar | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2011.08.13 13:20:31 | 000,579,584 | ---- | M] (OldTimer Tools) -- C:\Users\Edgar\Desktop\Neuer Ordner\OTL.exe
PRC - [2011.08.01 10:28:16 | 000,124,480 | ---- | M] (ICQ, LLC.) -- C:\Program Files\ICQ7.5\ICQ.exe
PRC - [2011.06.30 13:48:02 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe
PRC - [2011.06.24 06:22:20 | 000,271,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe
PRC - [2011.04.30 13:16:37 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe
PRC - [2011.04.08 07:14:00 | 002,218,600 | ---- | M] (NVIDIA Corporation) -- C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
PRC - [2011.04.07 22:43:04 | 000,841,832 | ---- | M] (NVIDIA Corporation) -- C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
PRC - [2011.02.25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2010.11.20 14:17:47 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
PRC - [2010.11.04 18:27:55 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
PRC - [2010.01.14 22:10:53 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
PRC - [2009.07.14 03:14:29 | 000,017,408 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\PrintIsolationHost.exe
PRC - [2007.03.06 11:35:02 | 000,198,168 | ---- | M] (InterVideo Inc.) -- C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe
PRC - [2005.03.09 20:50:18 | 000,018,944 | ---- | M] (hxxp://libusb-win32.sourceforge.net) -- C:\Windows\System32\libusbd-nt.exe
 
 
========== Modules (SafeList) ==========
 
MOD - [2011.08.13 13:20:31 | 000,579,584 | ---- | M] (OldTimer Tools) -- C:\Users\Edgar\Desktop\Neuer Ordner\OTL.exe
MOD - [2010.11.20 13:55:09 | 001,680,896 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - File not found [On_Demand | Stopped] -- -- (ACDaemon)
SRV - [2011.06.30 13:48:02 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011.06.24 17:42:29 | 000,403,240 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2011.04.30 13:16:37 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2011.04.08 07:14:00 | 002,218,600 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe -- (nvUpdatusService)
SRV - [2009.07.14 03:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009.07.14 03:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007.03.06 11:35:02 | 000,198,168 | ---- | M] (InterVideo Inc.) [Auto | Running] -- C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe -- (Capture Device Service)
SRV - [2005.11.17 15:18:52 | 001,527,900 | ---- | M] (MAGIX®) [Disabled | Stopped] -- C:\Program Files\MAGIX\Common\Database\bin\fbserver.exe -- (FirebirdServerMAGIXInstance)
SRV - [2005.03.09 20:50:18 | 000,018,944 | ---- | M] (hxxp://libusb-win32.sourceforge.net) [Auto | Running] -- C:\Windows\System32\libusbd-nt.exe -- (libusbd)
 
 
========== Driver Services (SafeList) ==========
 
DRV - [2011.07.06 19:52:42 | 000,041,272 | ---- | M] (Malwarebytes Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\mbamswissarmy.sys -- (MBAMSwissArmy)
DRV - [2011.06.30 13:48:13 | 000,138,192 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2011.06.30 13:48:13 | 000,066,616 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2011.04.08 07:14:00 | 010,690,024 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2010.11.20 12:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV - [2010.11.20 11:59:44 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)
DRV - [2010.06.03 17:07:18 | 000,013,112 | ---- | M] (Windows (R) Win 7 DDK provider) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\jumi.sys -- (jumi)
DRV - [2010.02.24 12:22:10 | 000,185,472 | ---- | M] (Protect Software GmbH) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\acedrv11.sys -- (acedrv11)
DRV - [2009.12.06 15:10:19 | 000,722,416 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\System32\Drivers\sptd.sys -- (sptd)
DRV - [2009.07.14 00:02:51 | 004,231,168 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\netw5v32.sys -- (netw5v32) Intel(R)
DRV - [2009.06.25 16:58:10 | 000,048,128 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimmptsk.sys -- (rimmptsk)
DRV - [2009.06.25 16:25:58 | 000,038,400 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rixdptsk.sys -- (rismxdp)
DRV - [2009.06.25 16:10:48 | 000,044,544 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimsptsk.sys -- (rimsptsk)
DRV - [2009.06.23 02:48:58 | 001,051,136 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\CAMTHWDM.sys -- (CAMTHWDM)
DRV - [2009.05.20 08:15:32 | 003,485,952 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\snp2uvc.sys -- (SNP2UVC) USB2.0 PC Camera (SNP2UVC)
DRV - [2009.05.11 10:12:49 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009.05.05 12:15:58 | 001,095,808 | ---- | M] (Motorola Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\smserial.sys -- (smserial)
DRV - [2009.02.03 17:39:23 | 000,063,096 | ---- | M] (Protection Technology (StarForce)) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\sfdrv01a.sys -- (sfdrv01a) StarForce Protection Environment Driver (version 1.x.a)
DRV - [2008.11.11 14:41:00 | 000,013,056 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lgusbbus.sys -- (usbbus)
DRV - [2007.07.11 02:30:22 | 000,007,168 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HpqRemHid.sys -- (HpqRemHid)
DRV - [2006.11.10 16:05:00 | 000,018,688 | ---- | M] (Arcsoft, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\afc.sys -- (Afc)
DRV - [2006.06.14 16:56:56 | 000,013,680 | ---- | M] (Protection Technology (StarForce)) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\sfhlp02.sys -- (sfhlp02) StarForce Protection Helper Driver (version 2.x)
DRV - [2005.03.09 20:50:16 | 000,033,792 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\libusb0.sys -- (libusb0)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 11 7F BC 10 21 55 CC 01 [binary data]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = local;*.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultthis.engineName: "Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.selectedEngine: "Amazon.de"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://info.aol.co.uk/email/de/"
FF - prefs.js..extensions.enabledItems: battlefieldheroespatcher@ea.com:5.0.31.0
FF - prefs.js..extensions.enabledItems: GameTap@gametap.com:4.0.80.1588
FF - prefs.js..extensions.enabledItems: justintvpublisher@justin.tv:3.1.5.5
FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:1.0
FF - prefs.js..extensions.enabledItems: {EF522540-89F5-46b9-B6FE-1829E2B572C6}:5.0.1
FF - prefs.js..extensions.enabledItems: zaplivetvpublisher@zaplive.tv:3.2.1.1
FF - prefs.js..extensions.enabledItems: KPSA-home-Priess@EasternGraphics.com:1.0.2
FF - prefs.js..extensions.enabledItems: eafo3fflauncher@ea.com:1.1
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {5B52016C-D097-4aec-BE61-9F129D8FDDBA}:2.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: 2020Player@2020Technologies.com:4.5.2.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.3
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1
FF - prefs.js..extensions.enabledItems: {ab91efd4-6975-4081-8552-1b3922ed79e2}:1.0.5.1
FF - prefs.js..network.proxy.http: "localhost"
FF - prefs.js..network.proxy.http_port: 9666
FF - prefs.js..network.proxy.socks: "localhost"
FF - prefs.js..network.proxy.socks_port: 9050
FF - prefs.js..network.proxy.socks_remote_dns: true
FF - prefs.js..network.proxy.ssl: "localhost"
FF - prefs.js..network.proxy.ssl_port: 9666
FF - prefs.js..network.proxy.type: 0
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@protectdisc.com/NPMPDRM: C:\Program Files\Common Files\mpDRM\NPMPDRM.dll ( )
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.450: C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.3.448: C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.448: C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@veetle.com/vbp;version=0.9.17: C:\Program Files\Veetle\VLCBroadcast\npvbp.dll (Veetle Inc)
FF - HKLM\Software\MozillaPlugins\@veetle.com/veetleCorePlugin,version=0.9.18: C:\Program Files\Veetle\plugins\npVeetle.dll (Veetle Inc)
FF - HKLM\Software\MozillaPlugins\@veetle.com/veetlePlayerPlugin,version=0.9.18: C:\Program Files\Veetle\Player\npvlc.dll (Veetle Inc)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=1.0.2: C:\Program Files\VideoLAN\VLC\npvlc.dll (the VideoLAN Team)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@powerchallenge.com/PowerLoader: C:\Users\Edgar\AppData\LocalLow\POWERC~1\nppowerloader.dll (Power Challenge Sweden AB)
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\Edgar\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF - HKCU\Software\MozillaPlugins\electronicarts.com/GameFacePlugin: C:\Users\Edgar\AppData\Roaming\Electronic Arts\Game Face\1.0.0.18\npGameFacePlugin.dll (Electronic Arts)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 5.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.06.18 13:16:01 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 5.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.06.21 16:43:07 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 3.0\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2010.12.22 16:38:36 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 3.0\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins [2011.06.21 16:43:07 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{781B095F-4E38-4FD9-9F36-F406D15C60A3}: C:\Users\Edgar\AppData\Local\{781B095F-4E38-4FD9-9F36-F406D15C60A3} [2011.08.11 16:30:05 | 000,000,000 | ---D | M]
 
[2009.12.14 19:23:20 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Edgar\AppData\Roaming\mozilla\Extensions
[2009.12.14 19:23:20 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Edgar\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2011.08.11 18:50:40 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Edgar\AppData\Roaming\mozilla\Firefox\Profiles\maai0k70.default\extensions
[2010.05.03 20:08:23 | 000,000,000 | ---D | M] ("UltraSurf Firefox Tool") -- C:\Users\Edgar\AppData\Roaming\mozilla\Firefox\Profiles\maai0k70.default\extensions\{5B52016C-D097-4aec-BE61-9F129D8FDDBA}
[2011.02.03 17:48:51 | 000,000,000 | ---D | M] (HP Detect) -- C:\Users\Edgar\AppData\Roaming\mozilla\Firefox\Profiles\maai0k70.default\extensions\{ab91efd4-6975-4081-8552-1b3922ed79e2}
[2011.08.11 18:50:41 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\Edgar\AppData\Roaming\mozilla\Firefox\Profiles\maai0k70.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2010.10.14 14:14:46 | 000,000,000 | ---D | M] (20-20 3D Viewer) -- C:\Users\Edgar\AppData\Roaming\mozilla\Firefox\Profiles\maai0k70.default\extensions\2020Player@2020Technologies.com
[2010.10.31 10:29:56 | 000,000,000 | ---D | M] (Battlefield Heroes Updater) -- C:\Users\Edgar\AppData\Roaming\mozilla\Firefox\Profiles\maai0k70.default\extensions\battlefieldheroespatcher@ea.com
[2011.07.20 11:43:10 | 000,000,000 | ---D | M] (German Dictionary) -- C:\Users\Edgar\AppData\Roaming\mozilla\Firefox\Profiles\maai0k70.default\extensions\de-DE@dictionaries.addons.mozilla.org
[2010.03.08 22:32:29 | 000,000,000 | ---D | M] (FIFA Online Web Launcher) -- C:\Users\Edgar\AppData\Roaming\mozilla\Firefox\Profiles\maai0k70.default\extensions\eafo3fflauncher@ea.com
[2009.11.04 18:57:38 | 000,000,000 | ---D | M] (GameTap) -- C:\Users\Edgar\AppData\Roaming\mozilla\Firefox\Profiles\maai0k70.default\extensions\GameTap@gametap.com
[2010.12.30 20:30:25 | 000,001,504 | ---- | M] () -- C:\Users\Edgar\AppData\Roaming\Mozilla\Firefox\Profiles\maai0k70.default\searchplugins\imdb.xml
[2010.06.01 20:25:13 | 000,004,140 | ---- | M] () -- C:\Users\Edgar\AppData\Roaming\Mozilla\Firefox\Profiles\maai0k70.default\searchplugins\youtube.xml
[2011.06.18 13:16:01 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2010.04.22 16:25:24 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010.08.06 19:53:24 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2010.10.17 11:28:48 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
File not found (No name found) -- 
[2009.11.20 16:49:35 | 000,000,000 | ---D | M] (RealPlayer Browser Record Plugin) -- C:\PROGRAM FILES\REAL\REALPLAYER\BROWSERRECORD\FIREFOX\EXT
[2011.08.11 16:30:05 | 000,000,000 | ---D | M] (XULRunner) -- C:\USERS\EDGAR\APPDATA\LOCAL\{781B095F-4E38-4FD9-9F36-F406D15C60A3}
() (No name found) -- C:\USERS\EDGAR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\MAAI0K70.DEFAULT\EXTENSIONS\{64161300-E22B-11DB-8314-0800200C9A66}.XPI
() (No name found) -- C:\USERS\EDGAR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\MAAI0K70.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
() (No name found) -- C:\USERS\EDGAR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\MAAI0K70.DEFAULT\EXTENSIONS\{EF522540-89F5-46B9-B6FE-1829E2B572C6}.XPI
() (No name found) -- C:\USERS\EDGAR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\MAAI0K70.DEFAULT\EXTENSIONS\COMPATIBILITY@ADDONS.MOZILLA.ORG.XPI
[2011.06.16 06:32:37 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2010.09.15 04:50:38 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2010.01.01 10:00:00 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2010.01.01 10:00:00 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2010.01.01 10:00:00 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2010.01.01 10:00:00 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2010.01.01 10:00:00 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2010.01.01 10:00:00 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2009.06.10 23:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [DivX Download Manager] File not found
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [snp2uvc] C:\Windows\vsnp2uvc.exe (Sonix)
O4 - HKLM..\Run: [TrayServer] C:\Program Files\MAGIX\Video_deluxe_15_Plus_Sonderedition\Trayserver.exe (MAGIX AG)
O4 - HKCU..\Run: [ICQ] C:\Program Files\ICQ7.5\ICQ.exe (ICQ, LLC.)
O4 - HKCU..\Run: [JumiController] File not found
O4 - HKCU..\Run: [Mhasuxoxo] C:\Users\Edgar\AppData\Local\oguyikov.dll (O2Micro)
O4 - HKCU..\Run: [Okukamabimo] C:\Users\Edgar\AppData\Local\ratdsns.dll (NETGEAR Corporation.)
O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutorun = 0
O8 - Extra context menu item: Free YouTube Download - C:\Users\Edgar\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()
O8 - Extra context menu item: Save YouTube Video as MP3 - C:\Program Files\Common Files\DVDVideoSoft\Dll\IEContextMenuY.dll (DVSTeam)
O9 - Extra Button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files\ICQ7.5\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files\ICQ7.5\ICQ.exe (ICQ, LLC.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000010 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} hxxp://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab (NVIDIA Smart Scan)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} hxxp://icq.oberon-media.com/Gameshell/GameHost/1.0/OberonGameHost.cab (Oberon Flash Game Host)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: ZapLive.tv Publisher hxxp://www.zaplive.tv/flixpub/plugins/zaplivetv_publisher.CAB (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2005.09.11 17:18:54 | 000,000,340 | -HS- | M] () - D:\AUTOMODE -- [ NTFS ]
O33 - MountPoints2\{13352517-0b5e-11e0-9c79-001e37b60c33}\Shell - "" = AutoRun
O33 - MountPoints2\{13352517-0b5e-11e0-9c79-001e37b60c33}\Shell\AutoRun\command - "" = F:\MI.exe
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - File not found
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found
 
MsConfig - StartUpReg: Adobe ARM - hkey= - key= - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
MsConfig - StartUpReg: Adobe Reader Speed Launcher - hkey= - key= - C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
MsConfig - StartUpReg: ArcSoft Connection Service - hkey= - key= - File not found
MsConfig - StartUpReg: DivXUpdate - hkey= - key= - C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
MsConfig - StartUpReg: LightScribe Control Panel - hkey= - key= - C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe (Hewlett-Packard Company)
MsConfig - StartUpReg: SMSERIAL - hkey= - key= - C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe (Motorola Inc.)
MsConfig - StartUpReg: SunJavaUpdateSched - hkey= - key= - C:\Program Files\Common Files\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
MsConfig - StartUpReg: TkBellExe - hkey= - key= - C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
MsConfig - StartUpReg: YouCam Mirror Tray icon - hkey= - key= - C:\Program Files\CyberLink\YouCam\YouCamTray.exe (CyberLink Corp.)
MsConfig - State: "services" - 2
MsConfig - State: "startup" - 2
 
SafeBootMin: AppMgmt - Service
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: NTDS - File not found
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vmms - Service
SafeBootMin: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet: AppMgmt - Service
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: NTDS - File not found
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vmms - Service
SafeBootNet: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Macromedia Shockwave Flash
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.i420 - C:\Windows\System32\i420vfw.dll (www.helixcommunity.org)
Drivers32: vidc.iv31 - C:\Windows\System32\ir32_32.dll (Intel(R) Corporation)
Drivers32: vidc.iv32 - C:\Windows\System32\ir32_32.dll (Intel(R) Corporation)
Drivers32: wave - C:\Windows\System32\serwvdrv.dll (Microsoft Corporation)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.08.13 13:14:22 | 000,000,000 | ---D | C] -- C:\Users\Edgar\Desktop\Neuer Ordner
[2011.08.13 10:13:28 | 000,000,000 | ---D | C] -- C:\Users\Edgar\AppData\Roaming\Malwarebytes
[2011.08.13 10:13:21 | 000,041,272 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2011.08.13 10:13:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011.08.13 10:13:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2011.08.13 10:13:17 | 000,022,712 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2011.08.13 10:13:16 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2011.08.11 18:51:03 | 000,000,000 | ---D | C] -- C:\Users\Edgar\AppData\Roaming\DVDVideoSoft
[2011.08.11 16:36:49 | 000,000,000 | ---D | C] -- C:\ProgramData\fB13602FlHjA13602
[2011.08.11 16:30:05 | 000,000,000 | ---D | C] -- C:\Users\Edgar\AppData\Local\{781B095F-4E38-4FD9-9F36-F406D15C60A3}
[2011.07.17 18:17:50 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\3D-Fahrschule Demo
[2011.07.17 18:17:39 | 000,000,000 | ---D | C] -- C:\Program Files\3D-Fahrschule Demo
[2011.05.07 12:47:20 | 000,249,856 | ---- | C] (O2Micro) -- C:\Users\Edgar\AppData\Local\oguyikov.dll
[2011.05.07 12:47:20 | 000,114,688 | ---- | C] (NETGEAR Corporation.) -- C:\Users\Edgar\AppData\Local\ratdsns.dll
[2009.06.29 10:48:06 | 000,239,616 | ---- | C] ( ) -- C:\Windows\System32\rsnp2uvc.dll
[2009.02.16 10:32:38 | 000,196,608 | ---- | C] ( ) -- C:\Windows\System32\csnp2uvc.dll
[2007.07.04 20:05:50 | 116,686,064 | ---- | C] ( ) -- C:\Users\Edgar\AppData\Roaming\YouCam3_Setup.exe
[3 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[3 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[2 C:\*.tmp files -> C:\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2011.08.13 13:08:15 | 000,054,016 | ---- | M] () -- C:\Windows\System32\drivers\nyhl.sys
[2011.08.13 12:55:02 | 000,001,096 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011.08.13 10:13:21 | 000,001,031 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.08.13 09:55:56 | 000,013,232 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011.08.13 09:55:56 | 000,013,232 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011.08.13 09:49:12 | 000,000,000 | ---- | M] () -- C:\Users\Edgar\AppData\Local\Mfiwehocozisiji.bin
[2011.08.13 09:49:11 | 000,000,120 | ---- | M] () -- C:\Users\Edgar\AppData\Local\Qyividuha.dat
[2011.08.13 09:48:45 | 000,001,092 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011.08.13 09:48:29 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011.08.13 09:48:22 | 1609,375,744 | -HS- | M] () -- C:\hiberfil.sys
[2011.08.12 15:37:09 | 000,664,634 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2011.08.12 15:37:09 | 000,624,776 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011.08.12 15:37:09 | 000,134,770 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2011.08.12 15:37:09 | 000,110,414 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011.08.12 14:59:31 | 005,143,638 | ---- | M] () -- C:\Users\Edgar\Desktop\facebook dialog.bmp
[2011.08.10 16:01:41 | 000,091,071 | ---- | M] () -- C:\Users\Edgar\Desktop\P100811_15.14.JPG
[2011.08.10 16:01:35 | 000,798,369 | ---- | M] () -- C:\Users\Edgar\Desktop\P100811_15.15.JPG
[2011.08.10 16:01:15 | 000,991,667 | ---- | M] () -- C:\Users\Edgar\Desktop\P100811_15.14[01].JPG
[2011.08.07 20:26:30 | 002,837,448 | ---- | M] () -- C:\Users\Edgar\Desktop\introerdwurm93.wmv
[2011.08.07 18:33:51 | 000,072,822 | ---- | M] () -- C:\Windows\System32\ieuinit.inf
[2011.08.05 17:00:27 | 000,001,859 | ---- | M] () -- C:\Users\Public\Desktop\CDBurnerXP.lnk
[3 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[3 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[2 C:\*.tmp files -> C:\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2011.08.13 13:08:15 | 000,054,016 | ---- | C] () -- C:\Windows\System32\drivers\nyhl.sys
[2011.08.13 10:13:21 | 000,001,031 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.08.12 14:59:30 | 005,143,638 | ---- | C] () -- C:\Users\Edgar\Desktop\facebook dialog.bmp
[2011.08.11 19:40:52 | 000,000,000 | ---- | C] () -- C:\Users\Edgar\AppData\Local\Mfiwehocozisiji.bin
[2011.08.11 19:40:51 | 000,000,120 | ---- | C] () -- C:\Users\Edgar\AppData\Local\Qyividuha.dat
[2011.08.10 16:01:39 | 000,091,071 | ---- | C] () -- C:\Users\Edgar\Desktop\P100811_15.14.JPG
[2011.08.10 16:01:19 | 000,798,369 | ---- | C] () -- C:\Users\Edgar\Desktop\P100811_15.15.JPG
[2011.08.10 16:00:56 | 000,991,667 | ---- | C] () -- C:\Users\Edgar\Desktop\P100811_15.14[01].JPG
[2011.08.07 20:26:11 | 002,837,448 | ---- | C] () -- C:\Users\Edgar\Desktop\introerdwurm93.wmv
[2011.08.07 18:33:51 | 000,072,822 | ---- | C] () -- C:\Windows\System32\ieuinit.inf
[2011.08.05 17:00:27 | 000,001,859 | ---- | C] () -- C:\Users\Public\Desktop\CDBurnerXP.lnk
[2010.11.27 17:39:48 | 000,018,944 | ---- | C] () -- C:\Windows\eraser.exe
[2010.11.27 14:21:45 | 000,524,288 | ---- | C] () -- C:\Windows\System32\xvidcore.dll
[2010.11.27 14:21:45 | 000,139,264 | ---- | C] () -- C:\Windows\System32\xvidvfw.dll
[2010.11.20 21:30:59 | 000,017,408 | ---- | C] () -- C:\Users\Edgar\AppData\Local\WebpageIcons.db
[2010.11.07 13:31:00 | 000,000,093 | ---- | C] () -- C:\Users\Edgar\AppData\Local\fusioncache.dat
[2010.08.05 12:43:59 | 000,033,792 | ---- | C] () -- C:\Windows\System32\drivers\libusb0.sys
[2010.07.11 14:41:25 | 000,002,572 | ---- | C] () -- C:\Windows\WAVEMIX.INI
[2010.07.10 17:46:12 | 000,245,504 | ---- | C] () -- C:\Windows\PI.EXE
[2010.07.10 16:55:27 | 000,045,568 | ---- | C] () -- C:\Windows\UniFish3.exe
[2010.03.22 19:23:07 | 000,027,648 | ---- | C] () -- C:\Windows\System32\AVSredirect.dll
[2010.03.08 22:34:35 | 000,794,408 | ---- | C] () -- C:\Windows\System32\pbsvc.exe
[2010.01.31 22:58:11 | 000,053,248 | ---- | C] () -- C:\Windows\System32\CommonDL.dll
[2010.01.31 22:58:11 | 000,002,412 | ---- | C] () -- C:\Windows\System32\lgAxconfig.ini
[2010.01.30 18:23:41 | 000,007,597 | ---- | C] () -- C:\Users\Edgar\AppData\Local\Resmon.ResmonCfg
[2010.01.27 18:04:17 | 000,120,200 | ---- | C] () -- C:\Windows\System32\DLLDEV32i.dll
[2010.01.27 18:03:27 | 000,007,103 | ---- | C] () -- C:\Windows\mgxoschk.ini
[2009.12.06 15:13:14 | 000,162,304 | ---- | C] () -- C:\Windows\System32\ztvunrar36.dll
[2009.12.06 15:13:14 | 000,077,312 | ---- | C] () -- C:\Windows\System32\ztvunace26.dll
[2009.11.21 13:47:00 | 000,178,176 | ---- | C] () -- C:\Windows\System32\unrar.dll
[2009.11.01 20:20:46 | 001,051,136 | ---- | C] () -- C:\Windows\System32\drivers\CAMTHWDM.sys
[2009.10.31 20:45:40 | 000,138,968 | ---- | C] () -- C:\Windows\System32\drivers\PnkBstrK.sys
[2009.10.31 20:45:40 | 000,138,056 | ---- | C] () -- C:\Users\Edgar\AppData\Roaming\PnkBstrK.sys
[2009.10.31 20:45:13 | 000,214,592 | ---- | C] () -- C:\Windows\System32\PnkBstrB.exe
[2009.10.31 20:45:10 | 002,407,792 | ---- | C] () -- C:\Windows\System32\pbsvc_heroes.exe
[2009.10.31 20:45:10 | 000,075,064 | ---- | C] () -- C:\Windows\System32\PnkBstrA.exe
[2009.10.30 15:05:57 | 000,026,624 | ---- | C] () -- C:\Users\Edgar\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009.10.26 13:45:40 | 000,019,894 | ---- | C] () -- C:\Users\Edgar\AppData\Roaming\UserTile.png
[2009.10.23 21:57:48 | 000,005,100 | ---- | C] () -- C:\ProgramData\mtbjfghn.xbe
[2009.07.14 10:47:43 | 000,664,634 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2009.07.14 10:47:43 | 000,295,922 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2009.07.14 10:47:43 | 000,134,770 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2009.07.14 10:47:43 | 000,038,104 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2009.07.14 06:57:37 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009.07.14 06:33:53 | 000,472,680 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2009.07.14 04:05:48 | 000,624,776 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2009.07.14 04:05:48 | 000,291,294 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2009.07.14 04:05:48 | 000,110,414 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2009.07.14 04:05:48 | 000,031,548 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2009.07.14 04:05:05 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2009.07.14 04:04:11 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2009.07.14 02:55:09 | 000,587,776 | ---- | C] () -- C:\Windows\System32\hpotscl1.dll
[2009.07.14 01:55:01 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009.07.14 01:51:43 | 000,073,728 | ---- | C] () -- C:\Windows\System32\BthpanContextHandler.dll
[2009.07.14 01:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\System32\BWContextHandler.dll
[2009.06.10 23:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2009.05.20 08:15:32 | 003,485,952 | ---- | C] () -- C:\Windows\System32\drivers\snp2uvc.sys
[2008.12.29 09:13:30 | 000,028,544 | ---- | C] () -- C:\Windows\System32\drivers\sncduvc.sys
[2006.05.19 03:39:58 | 000,015,497 | ---- | C] () -- C:\Windows\snp2uvc.ini
[2006.03.09 16:58:00 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll
[2005.08.30 01:00:00 | 000,781,312 | ---- | C] () -- C:\Windows\System32\RGSS102J.dll
[2005.08.30 01:00:00 | 000,778,752 | ---- | C] () -- C:\Windows\System32\RGSS102E.dll
[2005.08.30 01:00:00 | 000,771,584 | ---- | C] () -- C:\Windows\System32\RGSS100J.dll
[2002.03.13 13:15:06 | 000,057,344 | ---- | C] () -- C:\Windows\System32\mupkernps11.dll
 
========== LOP Check ==========
 
[2011.07.05 19:50:32 | 000,000,000 | ---D | M] -- C:\Users\Edgar\AppData\Roaming\.minecraft
[2011.08.07 20:19:02 | 000,000,000 | ---D | M] -- C:\Users\Edgar\AppData\Roaming\Audacity
[2011.02.01 17:36:55 | 000,000,000 | ---D | M] -- C:\Users\Edgar\AppData\Roaming\Blender Foundation
[2009.10.23 21:37:07 | 000,000,000 | ---D | M] -- C:\Users\Edgar\AppData\Roaming\Blitware
[2010.12.19 20:16:41 | 000,000,000 | ---D | M] -- C:\Users\Edgar\AppData\Roaming\Canneverbe Limited
[2009.12.06 16:27:06 | 000,000,000 | ---D | M] -- C:\Users\Edgar\AppData\Roaming\DAEMON Tools Pro
[2011.08.11 18:51:09 | 000,000,000 | ---D | M] -- C:\Users\Edgar\AppData\Roaming\DVDVideoSoft
[2011.04.04 19:59:58 | 000,000,000 | ---D | M] -- C:\Users\Edgar\AppData\Roaming\DVDVideoSoftIEHelpers
[2010.09.29 21:15:54 | 000,000,000 | ---D | M] -- C:\Users\Edgar\AppData\Roaming\Electronic Arts
[2010.11.28 16:57:16 | 000,000,000 | ---D | M] -- C:\Users\Edgar\AppData\Roaming\FileZilla
[2010.03.22 19:14:55 | 000,000,000 | ---D | M] -- C:\Users\Edgar\AppData\Roaming\FreeVideoConverter
[2011.01.02 20:37:47 | 000,000,000 | ---D | M] -- C:\Users\Edgar\AppData\Roaming\gtk-2.0
[2011.08.13 13:30:02 | 000,000,000 | ---D | M] -- C:\Users\Edgar\AppData\Roaming\ICQ
[2010.01.24 21:30:48 | 000,000,000 | ---D | M] -- C:\Users\Edgar\AppData\Roaming\KPSA-home
[2010.02.01 21:16:16 | 000,000,000 | ---D | M] -- C:\Users\Edgar\AppData\Roaming\LG Electronics
[2011.02.05 15:49:28 | 000,000,000 | ---D | M] -- C:\Users\Edgar\AppData\Roaming\Local
[2010.01.24 21:29:25 | 000,000,000 | ---D | M] -- C:\Users\Edgar\AppData\Roaming\Logs
[2010.01.27 18:41:03 | 000,000,000 | ---D | M] -- C:\Users\Edgar\AppData\Roaming\MAGIX
[2009.11.15 22:35:43 | 000,000,000 | ---D | M] -- C:\Users\Edgar\AppData\Roaming\Octoshape
[2009.11.05 19:04:28 | 000,000,000 | ---D | M] -- C:\Users\Edgar\AppData\Roaming\Opera
[2010.11.27 14:15:57 | 000,000,000 | ---D | M] -- C:\Users\Edgar\AppData\Roaming\Pegasys Inc
[2010.09.18 19:21:30 | 000,000,000 | ---D | M] -- C:\Users\Edgar\AppData\Roaming\ProtectDISC
[2010.01.24 21:29:24 | 000,000,000 | ---D | M] -- C:\Users\Edgar\AppData\Roaming\SHD Kreative Planungs-Systeme
[2011.07.11 22:18:03 | 000,000,000 | ---D | M] -- C:\Users\Edgar\AppData\Roaming\Simfy
[2009.12.14 19:23:20 | 000,000,000 | ---D | M] -- C:\Users\Edgar\AppData\Roaming\Thunderbird
[2010.10.24 17:11:37 | 000,000,000 | ---D | M] -- C:\Users\Edgar\AppData\Roaming\TweetDeckFast.FFF259DC0CE2657847BBB4AFF0E62062EFC56543.1
[2009.12.15 21:13:01 | 000,000,000 | ---D | M] -- C:\Users\Edgar\AppData\Roaming\Ulead Systems
[2010.08.13 22:54:36 | 000,000,000 | ---D | M] -- C:\Users\Edgar\AppData\Roaming\Unity
[2009.11.01 20:22:52 | 000,000,000 | ---D | M] -- C:\Users\Edgar\AppData\Roaming\Webcammax
[2011.06.19 10:46:49 | 000,000,456 | ---- | M] () -- C:\Windows\Tasks\Driver Robot.job
[2011.08.03 12:25:09 | 000,032,640 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2011.07.05 19:50:32 | 000,000,000 | ---D | M] -- C:\Users\Edgar\AppData\Roaming\.minecraft
[2011.08.11 16:27:53 | 000,000,000 | ---D | M] -- C:\Users\Edgar\AppData\Roaming\Adobe
[2010.06.04 15:48:44 | 000,000,000 | ---D | M] -- C:\Users\Edgar\AppData\Roaming\Apple Computer
[2010.12.25 15:33:04 | 000,000,000 | ---D | M] -- C:\Users\Edgar\AppData\Roaming\ArcSoft
[2011.08.07 20:19:02 | 000,000,000 | ---D | M] -- C:\Users\Edgar\AppData\Roaming\Audacity
[2010.03.23 21:14:58 | 000,000,000 | ---D | M] -- C:\Users\Edgar\AppData\Roaming\Avira
[2011.02.01 17:36:55 | 000,000,000 | ---D | M] -- C:\Users\Edgar\AppData\Roaming\Blender Foundation
[2009.10.23 21:37:07 | 000,000,000 | ---D | M] -- C:\Users\Edgar\AppData\Roaming\Blitware
[2010.12.19 20:16:41 | 000,000,000 | ---D | M] -- C:\Users\Edgar\AppData\Roaming\Canneverbe Limited
[2009.11.08 13:43:57 | 000,000,000 | ---D | M] -- C:\Users\Edgar\AppData\Roaming\CyberLink
[2009.12.06 16:27:06 | 000,000,000 | ---D | M] -- C:\Users\Edgar\AppData\Roaming\DAEMON Tools Pro
[2011.02.11 18:53:50 | 000,000,000 | ---D | M] -- C:\Users\Edgar\AppData\Roaming\DivX
[2011.07.11 22:17:59 | 000,000,000 | ---D | M] -- C:\Users\Edgar\AppData\Roaming\dvdcss
[2011.08.11 18:51:09 | 000,000,000 | ---D | M] -- C:\Users\Edgar\AppData\Roaming\DVDVideoSoft
[2011.04.04 19:59:58 | 000,000,000 | ---D | M] -- C:\Users\Edgar\AppData\Roaming\DVDVideoSoftIEHelpers
[2010.09.29 21:15:54 | 000,000,000 | ---D | M] -- C:\Users\Edgar\AppData\Roaming\Electronic Arts
[2010.11.28 16:57:16 | 000,000,000 | ---D | M] -- C:\Users\Edgar\AppData\Roaming\FileZilla
[2010.03.22 19:14:55 | 000,000,000 | ---D | M] -- C:\Users\Edgar\AppData\Roaming\FreeVideoConverter
[2011.01.02 20:37:47 | 000,000,000 | ---D | M] -- C:\Users\Edgar\AppData\Roaming\gtk-2.0
[2011.08.13 13:30:02 | 000,000,000 | ---D | M] -- C:\Users\Edgar\AppData\Roaming\ICQ
[2009.10.23 19:15:19 | 000,000,000 | ---D | M] -- C:\Users\Edgar\AppData\Roaming\Identities
[2009.12.15 21:06:31 | 000,000,000 | ---D | M] -- C:\Users\Edgar\AppData\Roaming\InstallShield
[2010.01.24 21:30:48 | 000,000,000 | ---D | M] -- C:\Users\Edgar\AppData\Roaming\KPSA-home
[2010.02.01 21:16:16 | 000,000,000 | ---D | M] -- C:\Users\Edgar\AppData\Roaming\LG Electronics
[2011.02.05 15:49:28 | 000,000,000 | ---D | M] -- C:\Users\Edgar\AppData\Roaming\Local
[2010.01.24 21:29:25 | 000,000,000 | ---D | M] -- C:\Users\Edgar\AppData\Roaming\Logs
[2009.10.23 19:34:25 | 000,000,000 | ---D | M] -- C:\Users\Edgar\AppData\Roaming\Macromedia
[2010.01.27 18:41:03 | 000,000,000 | ---D | M] -- C:\Users\Edgar\AppData\Roaming\MAGIX
[2011.08.13 10:13:28 | 000,000,000 | ---D | M] -- C:\Users\Edgar\AppData\Roaming\Malwarebytes
[2009.07.14 10:56:41 | 000,000,000 | ---D | M] -- C:\Users\Edgar\AppData\Roaming\Media Center Programs
[2009.11.21 14:00:15 | 000,000,000 | ---D | M] -- C:\Users\Edgar\AppData\Roaming\Media Player Classic
[2011.05.19 16:33:10 | 000,000,000 | --SD | M] -- C:\Users\Edgar\AppData\Roaming\Microsoft
[2011.04.02 20:41:19 | 000,000,000 | ---D | M] -- C:\Users\Edgar\AppData\Roaming\Mozilla
[2009.11.15 22:35:43 | 000,000,000 | ---D | M] -- C:\Users\Edgar\AppData\Roaming\Octoshape
[2009.11.05 19:04:28 | 000,000,000 | ---D | M] -- C:\Users\Edgar\AppData\Roaming\Opera
[2010.11.27 14:15:57 | 000,000,000 | ---D | M] -- C:\Users\Edgar\AppData\Roaming\Pegasys Inc
[2010.09.18 19:21:30 | 000,000,000 | ---D | M] -- C:\Users\Edgar\AppData\Roaming\ProtectDISC
[2009.11.20 16:51:13 | 000,000,000 | ---D | M] -- C:\Users\Edgar\AppData\Roaming\Real
[2010.01.28 18:19:55 | 000,000,000 | ---D | M] -- C:\Users\Edgar\AppData\Roaming\Reallusion
[2010.01.24 21:29:24 | 000,000,000 | ---D | M] -- C:\Users\Edgar\AppData\Roaming\SHD Kreative Planungs-Systeme
[2011.07.11 22:18:03 | 000,000,000 | ---D | M] -- C:\Users\Edgar\AppData\Roaming\Simfy
[2011.08.12 17:07:03 | 000,000,000 | ---D | M] -- C:\Users\Edgar\AppData\Roaming\Skype
[2009.12.14 19:23:20 | 000,000,000 | ---D | M] -- C:\Users\Edgar\AppData\Roaming\Thunderbird
[2010.10.24 17:11:37 | 000,000,000 | ---D | M] -- C:\Users\Edgar\AppData\Roaming\TweetDeckFast.FFF259DC0CE2657847BBB4AFF0E62062EFC56543.1
[2009.12.15 21:13:01 | 000,000,000 | ---D | M] -- C:\Users\Edgar\AppData\Roaming\Ulead Systems
[2010.08.13 22:54:36 | 000,000,000 | ---D | M] -- C:\Users\Edgar\AppData\Roaming\Unity
[2011.08.12 17:08:32 | 000,000,000 | ---D | M] -- C:\Users\Edgar\AppData\Roaming\vlc
[2009.11.01 20:22:52 | 000,000,000 | ---D | M] -- C:\Users\Edgar\AppData\Roaming\Webcammax
[2009.10.24 15:13:38 | 000,000,000 | ---D | M] -- C:\Users\Edgar\AppData\Roaming\WinRAR
[2010.11.15 21:11:21 | 000,000,000 | ---D | M] -- C:\Users\Edgar\AppData\Roaming\Yahoo!
 
< %APPDATA%\*.exe /s >
[2007.07.04 20:05:50 | 116,686,064 | ---- | M] ( ) -- C:\Users\Edgar\AppData\Roaming\YouCam3_Setup.exe
[2010.09.29 21:16:07 | 000,051,312 | ---- | M] (Electronic Arts) -- C:\Users\Edgar\AppData\Roaming\Electronic Arts\Game Face\1.0.0.18\uninstall.exe
[2010.09.18 05:53:58 | 005,073,240 | ---- | M] (Microsoft Corporation) -- C:\Users\Edgar\AppData\Roaming\Electronic Arts\Game Face\1.0.0.18\vcredist_x86.exe
[2011.07.11 22:17:28 | 000,053,632 | ---- | M] (Adobe Systems Inc.) -- C:\Users\Edgar\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
[2010.08.18 12:37:40 | 000,348,160 | ---- | M] (Octoshape ApS) -- C:\Users\Edgar\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\octoshape\octoshape.exe
[2011.02.03 17:50:02 | 000,010,134 | R--- | M] () -- C:\Users\Edgar\AppData\Roaming\Microsoft\Installer\{CAE7D1D9-3794-4169-B4DD-964ADBC534EE}\ARPPRODUCTICON.exe
[2006.05.16 12:58:14 | 001,708,856 | ---- | M] (Microsoft Corporation) -- C:\Users\Edgar\AppData\Roaming\Mozilla\Firefox\Profiles\maai0k70.default\extensions\{ab91efd4-6975-4081-8552-1b3922ed79e2}\plugins\instmsia.exe
[2006.05.16 12:58:16 | 001,822,520 | ---- | M] (Microsoft Corporation) -- C:\Users\Edgar\AppData\Roaming\Mozilla\Firefox\Profiles\maai0k70.default\extensions\{ab91efd4-6975-4081-8552-1b3922ed79e2}\plugins\instmsiw.exe
[2010.11.02 12:02:54 | 000,300,600 | ---- | M] (Hewlett-Packard Company ) -- C:\Users\Edgar\AppData\Roaming\Mozilla\Firefox\Profiles\maai0k70.default\extensions\{ab91efd4-6975-4081-8552-1b3922ed79e2}\plugins\setup.exe
[2010.08.20 00:46:28 | 001,312,120 | ---- | M] (EA Digital Illusions CE AB) -- C:\Users\Edgar\AppData\Roaming\Mozilla\Firefox\Profiles\maai0k70.default\extensions\battlefieldheroespatcher@ea.com\platform\WINNT_x86-msvc\plugins\BFHUpdater.exe
 
< %SYSTEMDRIVE%\*.exe >
[2007.11.07 09:03:18 | 000,562,688 | ---- | M] (Microsoft Corporation) -- C:\install.exe
[2 C:\*.tmp files -> C:\*.tmp -> ]
 
 
< MD5 for: AGP440.SYS >
[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\drivers\AGP440.sys
[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_x86_neutral_a97a2a0d0fbc6696\AGP440.sys
[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_b9e9435f20046eeb\AGP440.sys
[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_bc1a57271cf2f285\AGP440.sys
 
< MD5 for: ATAPI.SYS >
[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\drivers\atapi.sys
[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_x86_neutral_fab873f3e8a3315c\atapi.sys
[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_dd0e7e3d82dd640d\atapi.sys
[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_df3f92057fcbe7a7\atapi.sys
 
< MD5 for: CNGAUDIT.DLL >
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\System32\cngaudit.dll
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
 
< MD5 for: IASTORV.SYS >
[2011.03.11 07:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- C:\Windows\System32\drivers\iaStorV.sys
[2011.03.11 07:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_0bcee2057afcc090\iaStorV.sys
[2011.03.11 07:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_b0daddb9e6380745\iaStorV.sys
[2011.03.11 07:43:55 | 000,332,160 | ---- | M] (Intel Corporation) MD5=71F1A494FEDF4B33C02C4A6A28D6D9E9 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_aef580fde910b4b0\iaStorV.sys
[2011.03.11 07:28:00 | 000,332,160 | ---- | M] (Intel Corporation) MD5=778D0E6D7D9EBA0C403BADBAAD41DB20 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_b152a892ff64119f\iaStorV.sys
[2009.07.14 03:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_aee7a89be91b9000\iaStorV.sys
[2010.11.20 14:29:54 | 000,332,160 | ---- | M] (Intel Corporation) MD5=A3CAE5D281DB4CFF7CFF8233507EE5AD -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_668286aa35d55928\iaStorV.sys
[2010.11.20 14:29:54 | 000,332,160 | ---- | M] (Intel Corporation) MD5=A3CAE5D281DB4CFF7CFF8233507EE5AD -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_b118bc63e60a139a\iaStorV.sys
[2011.03.11 07:52:21 | 000,332,160 | ---- | M] (Intel Corporation) MD5=B9039A34C2F8769490DCC494E2402445 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_afae2d45020c148b\iaStorV.sys
 
< MD5 for: NETLOGON.DLL >
[2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\System32\netlogon.dll
[2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_ffbf212e963c0162\netlogon.dll
[2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_fd8e0d66994d7dc8\netlogon.dll
 
< MD5 for: NVSTOR.SYS >
[2011.03.11 07:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- C:\Windows\System32\drivers\nvstor.sys
[2011.03.11 07:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_0276fc3b3ea60d41\nvstor.sys
[2011.03.11 07:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_3ba44e691d6eb11d\nvstor.sys
[2011.03.11 07:44:01 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4520B63899E867F354EE012D34E11536 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_39bef1ad20475e88\nvstor.sys
[2011.03.11 07:28:10 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=66D468654A58594F5F3BA63D5AD5B1AF -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_3c1c1942369abb77\nvstor.sys
[2011.03.11 07:52:25 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=8A7583A3B58D3EEB28BB26626526BC91 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_3a779df43942be63\nvstor.sys
[2010.11.20 14:30:06 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=9283C58EBAA2618F93482EB5DABCEC82 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_dd659ed032d28a14\nvstor.sys
[2010.11.20 14:30:06 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=9283C58EBAA2618F93482EB5DABCEC82 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_3be22d131d40bd72\nvstor.sys
[2009.07.14 03:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_39b1194b205239d8\nvstor.sys
 
< MD5 for: SCECLI.DLL >
[2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_37e4387f3a6f0483\scecli.dll
[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\System32\scecli.dll
[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_3a154c47375d881d\scecli.dll
 
< MD5 for: USER32.DLL >
[2009.07.14 03:16:17 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=34B7E222E81FAFA885F0C5F2CFA56861 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_cd0ec264ceb014a3\user32.dll
[2010.11.20 14:21:33 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 -- C:\Windows\System32\user32.dll
[2010.11.20 14:21:33 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_cf3fd62ccb9e983d\user32.dll
 
< MD5 for: USERINIT.EXE >
[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\System32\userinit.exe
[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
 
< MD5 for: WININIT.EXE >
[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\System32\wininit.exe
[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe
 
< MD5 for: WINLOGON.EXE >
[2009.10.28 08:17:59 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_6fc699643622d177\winlogon.exe
[2009.10.28 07:52:08 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=3BABE6767C78FBF5FB8435FEED187F30 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_703394514f56f7c2\winlogon.exe
[2010.11.20 14:17:54 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\System32\winlogon.exe
[2010.11.20 14:17:54 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_71ca6b0233339500\winlogon.exe
[2009.07.14 03:14:45 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=8EC6A4AB12B8F3759E21F8E3A388F2CF -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_6f99573a36451166\winlogon.exe
 
< MD5 for: WS2IFSL.SYS >
[2009.07.14 01:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\System32\drivers\ws2ifsl.sys
[2009.07.14 01:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_4f5cf6f829213bb2\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
[2009.12.06 15:10:19 | 000,722,416 | ---- | M] () Unable to obtain MD5 -- C:\Windows\system32\drivers\sptd.sys
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
 
< >
 
< End of report >
--- --- ---


Ich hoffe ihr könnt damit was anfangen und mir helfen, dass ich diesen Mist wieder los werde.

Viele Grüße

Edgar

Alt 15.08.2011, 21:38   #2
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Personal Shield Pro hat mich erwischt - Standard

Personal Shield Pro hat mich erwischt


Gibt es noch weitere Logs von Malwarebytes? Wenn ja bitte alle posten, die in Malwarebytes im Reiter Logdateien sichtbar sind.
__________________

__________________
Alt 16.08.2011, 16:20   #3
Erdwurm93
 
Personal Shield Pro hat mich erwischt - Standard

Personal Shield Pro hat mich erwischt


leider hab ich Malewarebyte erst nach der Infizierung installiert. Es gibt also keine weiteren Log Datein.
__________________
Alt 16.08.2011, 18:36   #4
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Personal Shield Pro hat mich erwischt - Standard

Personal Shield Pro hat mich erwischt


Führ bitte auch ESET aus, danach sehen wir weiter:


ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

__________________
Logfiles bitte immer in CODE-Tags posten

Antwort

Themen zu Personal Shield Pro hat mich erwischt
4d36e972-e325-11ce-bfc1-08002be10318, adobe, antivir, avira, bho, bonjour, c:\windows\system32\rundll32.exe, defender, desktop, error, exploit.drop.2, firefox, flash player, format, google earth, helper, home, langs, libusb0.sys, log file, logfile, mozilla thunderbird, mp3, netgear, nvlddmkm.sys, nvstor.sys, object, personal pro shield, plug-in, port, registry, rundll, scan, software, sptd.sys, start menu, studio, trojan.agent.ge, trojan.agent.u, trojan.ransom.gen, trojaner, trojaner board, vcredist, version=1.0, webcheck, wrapper


« Virenproblem | Sehr hohe CPU Auslastung, obwohl ich kaum was mache »


Ähnliche Themen: Personal Shield Pro hat mich erwischt


  1. Virus hat mich erwischt und mich Infiziert
    Plagegeister aller Art und deren Bekämpfung - 27.02.2013 (3)
  2. Problem Personal Shield Pro
    Plagegeister aller Art und deren Bekämpfung - 04.10.2011 (12)
  3. Personal shield pro
    Plagegeister aller Art und deren Bekämpfung - 22.09.2011 (17)
  4. Infizierung mit "Personal Shield Pro" und Rootkit.TDSS - System jetzt sauber?
    Log-Analyse und Auswertung - 11.09.2011 (21)
  5. Logfiles nach Personal Pro Shield Beseitigung
    Log-Analyse und Auswertung - 05.09.2011 (14)
  6. Personal Shield pro entfernung
    Plagegeister aller Art und deren Bekämpfung - 02.09.2011 (3)
  7. personal shield pro - mit malwarebytes entfernt und 24 funde!
    Log-Analyse und Auswertung - 29.08.2011 (32)
  8. Personal Shield Pro hat mich erwischt-.-
    Log-Analyse und Auswertung - 27.08.2011 (3)
  9. Personal Shield Pro.... Logfileposting
    Log-Analyse und Auswertung - 22.08.2011 (1)
  10. Personal Shield Pro v2.2 entfernt. Ist das System wieder sicher?
    Log-Analyse und Auswertung - 10.07.2011 (1)
  11. Personal Shield Pro
    Plagegeister aller Art und deren Bekämpfung - 03.07.2011 (1)
  12. Personal Shield Pro nicht komplett entfernt
    Log-Analyse und Auswertung - 23.06.2011 (12)
  13. Personal Shield Pro entfernen
    Anleitungen, FAQs & Links - 11.06.2011 (2)
  14. Mich hat's erwischt...
    Log-Analyse und Auswertung - 17.10.2008 (6)
  15. Mich hat's erwischt :(
    Log-Analyse und Auswertung - 15.12.2005 (2)
  16. Mich hat es erwischt! :-(
    Log-Analyse und Auswertung - 03.09.2005 (3)
  17. Hat es mich erwischt?
    Antiviren-, Firewall- und andere Schutzprogramme - 03.06.2003 (3)
Anleitungen und Tipps

- Für alle Hilfesuchenden! Was beachten?

- Anleitung: MyStartSearch.com entfernen

- Anleitung: WebSearches löschen

- Hilfe: iStartSurf entfernen – so gehts!

- Anleitung: Omiga Plus richtig entfernen

- Browser Viren entfernen


Zum Thema Personal Shield Pro hat mich erwischt - Hallo liebe Trojaner Board Nutzer! Ich hab mich hier neu registriert und das liegt nicht nur daran, dass ihr alle so sympathische Jungs und Mädels seid, sondern weil ich seit - Personal Shield Pro hat mich erwischt...
Archiv
Du betrachtest: Personal Shield Pro hat mich erwischt auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55