Hallo liebe Leute,

soeben durfte ich wiederholt durch das BKA erfahren welch kriminelle Taten ich so vollbringe.
Dieser Trojaner ist bei mir am 13.8.2011 das erste Mal aufgetaucht und ich dachte, ich hätte ihn mit der Hilfe dieses Forums besiegt. Die letzten Wochen lief mein Laptop (Windows Vista) super, keine Verzögerungen oder irgendwelche Signale von Avira. Vermutlich hätte ich öfter mal einen Scan durchlaufen lassen sollen :/
Nunja jetzt ist es passiert und ich bitte euch noch einmal um Hilfe.

Im Moment lass ich Malwarebytes einen Quickscan durchführen, log bekommt ihr dann.

Ich danke im Vorraus
Hier der Link zur letzten Bearbeitung.
http://www.trojaner-board.de/102477-...eseitigen.html


Grüße, me pure

zuletzt hatte ich noch diesen Thread erstellt, weiß nicht, ob er was mit dem PRoblem zu tun hat aber er ist kurz nach meinem Benutzerkontowechsel aufgetaucht.
http://www.trojaner-board.de/102812-...geloescht.html

hier der scanlog

Malwarebytes' Anti-Malware 1.51.1.1800
Malwarebytes : Free anti-malware, anti-virus and spyware removal download

Database version: 7631

Windows 6.0.6002 Service Pack 2 (Safe Mode)
Internet Explorer 9.0.8112.16421

01.09.2011 22:10:20
mbam-log-2011-09-01 (22-10-20).txt

Scan type: Quick scan
Objects scanned: 165374
Time elapsed: 3 minute(s), 36 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\avupdate (Rootkit.0Access.XGen) -> Value: avupdate -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
c:\Users\Nicole2\AppData\Roaming\jashla.exe (Rootkit.0Access.XGen) -> Quarantined and deleted successfully.

Kann es sein, dass der Trojaner "automatisch" auf dem neuen Konto auftaucht, weil ich ihn nur von meinem ersten und einzigen Benutzerkonto und nicht vom PC bzw System entfernt habe??

Hallo,

was hast du nach der erfolgten Bereingung gemacht?
Bist du den allgemein hier gängigen Empehlungen auch nachgegangen und hast sie umgesetzt? Sprich: Du hast danach Betriebssystem, alle Browser, Java RE, Flashplayer und PDF-Reader samt Plugins AKTUALISIERT?

Naja also ich hab aktualisiert was ich in die Finger bekommen habe. Ich weiß nicht, ob alles auf dem neusten Stand soweit ist. Was ich gemacht habe ist ne schwierige Frage..in welchem Bereich meinst du das? Welche Downloads usw.?

CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

• Starte bitte die OTL.exe.
  Vista und Win7 User mit Rechtsklick "als Administrator starten"
• Kopiere nun den Inhalt in die Textbox.

netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT
         

• Schliesse bitte nun alle Programme. (Wichtig)
• Klicke nun bitte auf den Quick Scan Button.
• Klick auf .
• Kopiere nun den Inhalt aus OTL.txt hier in Deinen Thread

Ok hier sind die Scanlogs

OTL Logfile:

OTL logfile created on: 02.09.2011 09:31:55 - Run 1
OTL by OldTimer - Version 3.2.27.0     Folder = C:\Users\Nicole2\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,99 Gb Total Physical Memory | 2,09 Gb Available Physical Memory | 69,81% Memory free
6,20 Gb Paging File | 5,25 Gb Available in Paging File | 84,68% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 222,88 Gb Total Space | 156,57 Gb Free Space | 70,25% Space Free | Partition Type: NTFS
 
Computer Name: ADMIN-PC | User Name: Nicole2 | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2011.09.02 09:29:18 | 000,581,120 | ---- | M] (OldTimer Tools) -- C:\Users\Nicole2\Desktop\OTL.exe
PRC - [2011.08.12 01:38:07 | 000,116,608 | ---- | M] (SUPERAntiSpyware.com) -- C:\Programme\SUPERAntiSpyware\SASCore.exe
PRC - [2011.07.05 20:01:32 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe
PRC - [2011.06.01 14:44:54 | 002,337,144 | ---- | M] (TeamViewer GmbH) -- C:\Programme\TeamViewer\Version6\TeamViewer_Service.exe
PRC - [2011.03.28 20:31:16 | 000,193,920 | ---- | M] (Microsoft Corp.) -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
PRC - [2011.03.28 20:31:14 | 001,713,536 | ---- | M] (Microsoft Corp.) -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
PRC - [2011.03.28 16:15:17 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe
PRC - [2011.03.28 16:15:04 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\sched.exe
PRC - [2011.03.28 16:14:56 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe
PRC - [2009.04.11 08:28:03 | 001,233,920 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Sidebar\sidebar.exe
PRC - [2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2008.05.22 17:33:54 | 000,688,128 | ---- | M] (SAMSUNG Electronics) -- C:\Programme\SamSung\Easy Display Manager\dmhkcore.exe
PRC - [2008.04.25 21:31:34 | 000,565,248 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Programme\SamSung\EasySpeedUpManager\EasySpeedUpManager.exe
PRC - [2008.04.17 20:50:00 | 006,111,232 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe
PRC - [2008.04.17 15:26:46 | 000,352,256 | ---- | M] (SAMSUNG Electronics co., LTD.) -- C:\Programme\SamSung\EBM\EasyBatteryMgr3.exe
PRC - [2008.01.21 04:23:33 | 000,192,000 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wsqmcons.exe
PRC - [2008.01.21 04:23:32 | 001,008,184 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Defender\MSASCui.exe
PRC - [2007.07.05 07:41:42 | 000,045,056 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Programme\SamSung\Samsung Magic Doctor\MagicDoctorKbdHk.exe
PRC - [2007.04.03 18:50:00 | 001,603,152 | ---- | M] (CANON INC.) -- C:\Programme\Canon\MyPrinter\BJMYPRT.EXE
 
 
========== Modules (No Company Name) ==========
 
MOD - [2007.08.14 13:59:54 | 006,365,184 | ---- | M] () -- C:\Programme\Common Files\LightScribe\QtGui4.dll
MOD - [2007.07.12 13:55:52 | 000,131,072 | ---- | M] () -- C:\Programme\Common Files\LightScribe\plugins\imageformats\qjpeg4.dll
MOD - [2007.07.12 13:55:28 | 001,581,056 | ---- | M] () -- C:\Programme\Common Files\LightScribe\QtCore4.dll
MOD - [2006.08.12 12:48:40 | 000,049,152 | ---- | M] () -- C:\Programme\SamSung\Samsung Magic Doctor\HookDllPS2.dll
MOD - [2006.08.12 12:48:40 | 000,049,152 | ---- | M] () -- C:\Programme\SamSung\EasySpeedUpManager\HookDllPS2.dll
MOD - [2006.08.12 12:48:40 | 000,049,152 | ---- | M] () -- C:\Programme\SamSung\Easy Display Manager\HookDllPS2.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - [2011.08.12 01:38:07 | 000,116,608 | ---- | M] (SUPERAntiSpyware.com) [Auto | Running] -- C:\Program Files\SUPERAntiSpyware\SASCORE.EXE -- (!SASCORE)
SRV - [2011.07.05 20:01:32 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011.06.01 14:44:54 | 002,337,144 | ---- | M] (TeamViewer GmbH) [Auto | Running] -- C:\Programme\TeamViewer\Version6\TeamViewer_Service.exe -- (TeamViewer6)
SRV - [2011.03.28 16:15:04 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2008.05.13 08:47:20 | 000,077,480 | ---- | M] () [Auto | Stopped] -- C:\Program Files\Samsung\Samsung Update Plus\SLUBackgroundService.exe -- (Samsung Update Plus)
SRV - [2008.01.21 04:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
 
 
========== Driver Services (SafeList) ==========
 
DRV - [2011.07.22 18:27:02 | 000,012,880 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Programme\SUPERAntiSpyware\sasdifsv.sys -- (SASDIFSV)
DRV - [2011.07.12 23:55:22 | 000,067,664 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Programme\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)
DRV - [2011.07.06 19:52:42 | 000,041,272 | ---- | M] (Malwarebytes Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\mbamswissarmy.sys -- (MBAMSwissArmy)
DRV - [2011.07.05 20:01:32 | 000,138,192 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2011.07.05 20:01:32 | 000,066,616 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2011.06.18 19:33:20 | 000,165,376 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\atksgt.sys -- (atksgt)
DRV - [2011.06.18 19:33:10 | 000,018,048 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\lirsgt.sys -- (lirsgt)
DRV - [2010.06.17 15:27:02 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2008.06.09 16:23:00 | 007,522,624 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2008.04.05 23:56:26 | 000,242,560 | ---- | M] (Vimicro Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\vmc302.sys -- (VMC302)
DRV - [2007.09.14 00:17:58 | 000,755,712 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr)
DRV - [2006.11.14 09:11:54 | 000,013,312 | ---- | M] (SAMSUNG ELECTRONICS CO., LTD.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\KMDFMEMIO.sys -- (KMDFMEMIO)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
 
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://de-de.facebook.com/"
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.09.01 02:45:00 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
 
[2011.09.01 18:52:25 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Nicole2\AppData\Roaming\mozilla\Extensions
[2011.09.01 19:23:59 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Nicole2\AppData\Roaming\mozilla\Firefox\Profiles\2cazqile.default\extensions
[2011.09.01 19:23:59 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\Nicole2\AppData\Roaming\mozilla\Firefox\Profiles\2cazqile.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2011.09.01 19:23:57 | 000,000,000 | ---D | M] (Awesome screenshot: Capture and Annotate) -- C:\Users\Nicole2\AppData\Roaming\mozilla\Firefox\Profiles\2cazqile.default\extensions\jid0-GXjLLfbCoAx0LcltEdFrEkQdQPI@jetpack
[2011.09.01 19:23:58 | 000,000,000 | ---D | M] (Collusion) -- C:\Users\Nicole2\AppData\Roaming\mozilla\Firefox\Profiles\2cazqile.default\extensions\jid1-F9UJ2thwoAm5gQ@jetpack
[2011.07.09 12:15:31 | 000,005,212 | ---- | M] () -- C:\Users\Nicole2\AppData\Roaming\Mozilla\Firefox\Profiles\2cazqile.default\searchplugins\ecosia.xml
[2011.08.13 21:29:59 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
() (No name found) -- C:\USERS\NICOLE2\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2CAZQILE.DEFAULT\EXTENSIONS\{0545B830-F0AA-4D7E-8820-50A4629A56FE}.XPI
() (No name found) -- C:\USERS\NICOLE2\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2CAZQILE.DEFAULT\EXTENSIONS\{D04B0B40-3DAB-4F0B-97A6-04EC3EDDBFB0}.XPI
() (No name found) -- C:\USERS\NICOLE2\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2CAZQILE.DEFAULT\EXTENSIONS\PERSONAS@CHRISTOPHER.BEARD.XPI
() (No name found) -- C:\USERS\NICOLE2\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2CAZQILE.DEFAULT\EXTENSIONS\UNDOCLOSEDTABSBUTTON@SUPERNOVA00.BIZ.XPI
[2011.06.10 07:34:29 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION
[2011.09.01 02:45:00 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2010.01.01 10:00:00 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2010.01.01 10:00:00 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2010.01.01 10:00:00 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2010.01.01 10:00:00 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
 
O1 HOSTS File: ([2011.08.13 21:01:57 | 000,000,098 | ---- | M]) - C:\Windows\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1       localhost
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2 - BHO: (Yontoo Layers) - {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - C:\Programme\Yontoo Layers Runtime\YontooIEClient.dll (Yontoo LLC)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)
O4 - HKLM..\Run: [LanguageShortcut] C:\Program Files\CyberLink\PowerDVD\Language\Language.exe ()
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [ICQ] C:\Program Files\ICQ7.5\ICQ.exe (ICQ, LLC.)
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - C:\Programme\Microsoft Office\Office10\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Programme\ICQ7.5\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Programme\ICQ7.5\ICQ.exe (ICQ, LLC.)
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1BDD2728-A256-4E01-BC58-70958279A0D9}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{7ED3B0A6-2D3E-4CF9-A70F-D0E7D6BAF9EE}: DhcpNameServer = 192.168.178.1
O18 - Protocol\Handler\cdo {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Programme\Common Files\microsoft shared\Web Folders\PKMCDO.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Common Files\microsoft shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Programme\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL - C:\Programme\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img24.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img24.jpg
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Programme\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
 
SafeBootMin: !SASCORE - C:\Program Files\SUPERAntiSpyware\SASCORE.EXE (SUPERAntiSpyware.com)
SafeBootMin: AppMgmt - Service
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: NTDS -  File not found
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet: !SASCORE - C:\Program Files\SUPERAntiSpyware\SASCORE.EXE (SUPERAntiSpyware.com)
SafeBootNet: AppMgmt - Service
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: NTDS -  File not found
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootNet: WudfPf - Driver
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - 
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - 
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Webordner
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Shockwave Flash
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
Drivers32: msacm.clmp3enc - C:\Programme\CyberLink\Power2Go\CLMP3Enc.ACM (CyberLink Corp.)
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3codecp - C:\Windows\System32\l3codecp.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.09.02 09:29:15 | 000,581,120 | ---- | C] (OldTimer Tools) -- C:\Users\Nicole2\Desktop\OTL.exe
[2011.09.02 00:56:54 | 000,000,000 | ---D | C] -- C:\Users\Nicole2\AppData\Roaming\SUPERAntiSpyware.com
[2011.09.02 00:25:00 | 000,000,000 | ---D | C] -- C:\Users\Nicole2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Einstein
[2011.09.02 00:25:00 | 000,000,000 | ---D | C] -- C:\Program Files\Einstein
[2011.09.01 22:11:17 | 000,000,000 | ---D | C] -- C:\Users\Nicole2\AppData\Local\VirtualStore
[2011.09.01 21:55:01 | 000,000,000 | ---D | C] -- C:\Users\Nicole2\AppData\Roaming\Malwarebytes
[2011.09.01 21:06:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ICQ7.5
[2011.09.01 21:05:39 | 000,000,000 | ---D | C] -- C:\Users\Nicole2\AppData\Roaming\ICQ
[2011.09.01 21:05:33 | 000,000,000 | ---D | C] -- C:\Program Files\ICQ7.5
[2011.09.01 19:53:03 | 000,000,000 | ---D | C] -- C:\Users\Nicole2\AppData\Roaming\vlc
[2011.09.01 19:21:00 | 000,000,000 | ---D | C] -- C:\Users\Nicole2\AppData\Roaming\Macromedia
[2011.09.01 18:53:27 | 000,000,000 | ---D | C] -- C:\Users\Nicole2\AppData\Local\Adobe
[2011.09.01 18:52:19 | 000,000,000 | ---D | C] -- C:\Users\Nicole2\AppData\Roaming\Mozilla
[2011.09.01 18:52:19 | 000,000,000 | ---D | C] -- C:\Users\Nicole2\AppData\Local\Mozilla
[2011.09.01 18:50:35 | 000,000,000 | ---D | C] -- C:\Users\Nicole2\AppData\Roaming\Adobe
[2011.09.01 18:50:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Picasa 3
[2011.09.01 18:50:05 | 000,000,000 | ---D | C] -- C:\Users\Nicole2\AppData\Local\Google
[2011.09.01 18:49:53 | 000,000,000 | ---D | C] -- C:\Program Files\Google
[2011.08.31 11:21:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft
[2011.08.31 11:21:19 | 000,000,000 | ---D | C] -- C:\Users\Nicole2\Documents\DVDVideoSoft
[2011.08.31 11:21:19 | 000,000,000 | ---D | C] -- C:\Program Files\DVDVideoSoft
[2011.08.31 11:21:19 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\DVDVideoSoft
[2011.08.31 01:30:39 | 000,000,000 | ---D | C] -- C:\Program Files\Yontoo Layers Runtime
[2011.08.31 01:30:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Tarma Installer
[2011.08.29 16:50:44 | 000,000,000 | R--D | C] -- C:\Users\Nicole2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
[2011.08.29 16:50:44 | 000,000,000 | R--D | C] -- C:\Users\Nicole2\Searches
[2011.08.29 16:50:44 | 000,000,000 | R--D | C] -- C:\Users\Nicole2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
[2011.08.29 16:50:37 | 000,000,000 | ---D | C] -- C:\Users\Nicole2\AppData\Roaming\Identities
[2011.08.29 16:50:35 | 000,000,000 | R--D | C] -- C:\Users\Nicole2\Contacts
[2011.08.29 16:50:28 | 000,000,000 | --SD | C] -- C:\Users\Nicole2\AppData\Roaming\Microsoft
[2011.08.29 16:50:28 | 000,000,000 | R--D | C] -- C:\Users\Nicole2\Videos
[2011.08.29 16:50:28 | 000,000,000 | R--D | C] -- C:\Users\Nicole2\Saved Games
[2011.08.29 16:50:28 | 000,000,000 | R--D | C] -- C:\Users\Nicole2\Pictures
[2011.08.29 16:50:28 | 000,000,000 | R--D | C] -- C:\Users\Nicole2\Music
[2011.08.29 16:50:28 | 000,000,000 | R--D | C] -- C:\Users\Nicole2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
[2011.08.29 16:50:28 | 000,000,000 | R--D | C] -- C:\Users\Nicole2\Links
[2011.08.29 16:50:28 | 000,000,000 | R--D | C] -- C:\Users\Nicole2\Favorites
[2011.08.29 16:50:28 | 000,000,000 | R--D | C] -- C:\Users\Nicole2\Downloads
[2011.08.29 16:50:28 | 000,000,000 | R--D | C] -- C:\Users\Nicole2\Documents
[2011.08.29 16:50:28 | 000,000,000 | R--D | C] -- C:\Users\Nicole2\Desktop
[2011.08.29 16:50:28 | 000,000,000 | R--D | C] -- C:\Users\Nicole2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
[2011.08.29 16:50:28 | 000,000,000 | -HSD | C] -- C:\Users\Nicole2\Vorlagen
[2011.08.29 16:50:28 | 000,000,000 | -HSD | C] -- C:\Users\Nicole2\AppData\Local\Verlauf
[2011.08.29 16:50:28 | 000,000,000 | -HSD | C] -- C:\Users\Nicole2\AppData\Local\Temporary Internet Files
[2011.08.29 16:50:28 | 000,000,000 | -HSD | C] -- C:\Users\Nicole2\Startmenü
[2011.08.29 16:50:28 | 000,000,000 | -HSD | C] -- C:\Users\Nicole2\SendTo
[2011.08.29 16:50:28 | 000,000,000 | -HSD | C] -- C:\Users\Nicole2\Recent
[2011.08.29 16:50:28 | 000,000,000 | -HSD | C] -- C:\Users\Nicole2\Netzwerkumgebung
[2011.08.29 16:50:28 | 000,000,000 | -HSD | C] -- C:\Users\Nicole2\Lokale Einstellungen
[2011.08.29 16:50:28 | 000,000,000 | -HSD | C] -- C:\Users\Nicole2\Documents\Eigene Videos
[2011.08.29 16:50:28 | 000,000,000 | -HSD | C] -- C:\Users\Nicole2\Documents\Eigene Musik
[2011.08.29 16:50:28 | 000,000,000 | -HSD | C] -- C:\Users\Nicole2\Eigene Dateien
[2011.08.29 16:50:28 | 000,000,000 | -HSD | C] -- C:\Users\Nicole2\Documents\Eigene Bilder
[2011.08.29 16:50:28 | 000,000,000 | -HSD | C] -- C:\Users\Nicole2\Druckumgebung
[2011.08.29 16:50:28 | 000,000,000 | -HSD | C] -- C:\Users\Nicole2\Cookies
[2011.08.29 16:50:28 | 000,000,000 | -HSD | C] -- C:\Users\Nicole2\AppData\Local\Anwendungsdaten
[2011.08.29 16:50:28 | 000,000,000 | -HSD | C] -- C:\Users\Nicole2\Anwendungsdaten
[2011.08.29 16:50:28 | 000,000,000 | ---D | C] -- C:\Users\Nicole2\AppData\Local\Temp
[2011.08.29 16:50:28 | 000,000,000 | ---D | C] -- C:\Users\Nicole2\AppData\Local\Microsoft
[2011.08.29 16:50:28 | 000,000,000 | ---D | C] -- C:\Users\Nicole2\AppData\Roaming\Media Center Programs
[2011.08.29 16:50:28 | 000,000,000 | ---D | C] -- C:\Users\Nicole2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink DVD Suite
[2011.08.29 16:50:28 | 000,000,000 | ---D | C] -- C:\Users\Nicole2\AppData
[2011.08.28 23:45:20 | 000,000,000 | ---D | C] -- C:\Users\Nicole2\Documents\StolzundVorurteil
[2011.08.28 22:11:09 | 000,000,000 | ---D | C] -- C:\ProgramData\CyberLink
[2011.08.28 22:11:06 | 000,000,000 | ---D | C] -- C:\Users\Nicole2\Documents\CyberLink
[2011.08.26 22:23:04 | 000,000,000 | ---D | C] -- C:\Users\Nicole2\Documents\PC_Link_Manager_es1
[2011.08.26 21:55:27 | 000,000,000 | ---D | C] -- C:\ProgramData\InstallShield
[2011.08.26 21:55:21 | 000,000,000 | ---D | C] -- C:\Program Files\PC Sync Manager
[2011.08.25 18:24:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Einstein
[2011.08.23 19:57:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PhotoScape
[2011.08.23 19:57:05 | 000,000,000 | ---D | C] -- C:\Program Files\PhotoScape
[2011.08.23 19:56:09 | 017,327,195 | ---- | C] (Mooii) -- C:\Users\Nicole2\Desktop\PhotoScapeSetup_V3.5.exe
[2011.08.23 19:40:39 | 000,000,000 | ---D | C] -- C:\Users\Nicole2\Documents\Gutscheine
[2011.08.21 18:40:51 | 000,000,000 | ---D | C] -- C:\Users\Nicole2\Documents\AFS schüler
[2011.08.17 23:44:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware
[2011.08.17 23:44:12 | 000,000,000 | ---D | C] -- C:\ProgramData\SUPERAntiSpyware.com
[2011.08.17 23:44:12 | 000,000,000 | ---D | C] -- C:\Program Files\SUPERAntiSpyware
[2011.08.17 23:40:15 | 012,483,776 | ---- | C] (SUPERAntiSpyware.com) -- C:\Program Files\SUPERAntiSpyware.exe
[2011.08.17 19:39:47 | 040,623,512 | ---- | C] (Adobe Systems Incorporated) -- C:\Program Files\AdbeRdr1010_de_DE.exe
[2011.08.17 17:35:22 | 000,000,000 | ---D | C] -- C:\$WINDOWS.~BT
[2011.08.16 00:51:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Kaspersky Lab Setup Files
[2011.08.15 22:11:47 | 124,539,416 | ---- | C] (Kaspersky Lab) -- C:\Users\Nicole2\Desktop\pure9.1.0.124de.exe
[2011.08.14 13:39:22 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2011.08.14 13:38:34 | 003,447,576 | ---- | C] (Piriform Ltd) -- C:\Program Files\ccsetup309.exe
[2011.08.13 21:01:57 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2011.08.13 16:03:25 | 000,000,000 | ---D | C] -- C:\Program Files\ESET
[2011.08.13 15:01:11 | 000,100,864 | ---- | C] (GMER) -- C:\aglorpod.sys
[2011.08.11 20:20:51 | 019,075,976 | ---- | C] (Skype Technologies S.A.) -- C:\Program Files\SkypeSetup_4.2.0.187.exe
[2011.08.11 19:22:43 | 001,081,480 | ---- | C] (Skype Technologies S.A.) -- C:\Program Files\SkypeSetup.exe
[2011.08.11 19:22:03 | 000,000,000 | R--D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools
[2011.08.11 19:06:03 | 000,000,000 | R--D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2011.08.11 19:02:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SamSung
[2011.08.11 19:02:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer
[2011.08.11 18:58:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
[2011.08.11 18:58:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Atheros WLAN Client
[2011.08.11 16:51:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011.08.09 21:22:59 | 009,466,208 | ---- | C] (Malwarebytes Corporation                                    ) -- C:\Program Files\mbam-setup-1.51.1.1800.exe
[2011.08.09 17:59:55 | 000,041,272 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2011.08.09 17:59:52 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2011.08.09 17:59:37 | 000,022,712 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2011.08.09 17:59:36 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2011.08.09 17:28:42 | 000,000,000 | ---D | C] -- C:\ProgramData\WindowsSearch
[2011.08.09 13:43:41 | 000,000,000 | ---D | C] -- C:\Users\Nicole2\Documents\BaFög
[2011.08.03 16:50:52 | 000,000,000 | ---D | C] -- C:\Users\Nicole2\Documents\2011_08_03
[2011.08.03 16:44:13 | 000,000,000 | ---D | C] -- C:\ProgramData\CanonBJ
[2011.08.03 16:31:19 | 000,000,000 | ---D | C] -- C:\Program Files\Canon
[2006.11.24 23:14:44 | 000,139,264 | ---- | C] ( ) -- C:\Windows\System32\MACSSDK_wiz.dll
[2006.11.24 23:14:44 | 000,126,976 | ---- | C] ( ) -- C:\Windows\System32\MACSSDK.dll
 
========== Files - Modified Within 30 Days ==========
 
[2011.09.02 09:29:18 | 000,581,120 | ---- | M] (OldTimer Tools) -- C:\Users\Nicole2\Desktop\OTL.exe
[2011.09.02 09:07:07 | 000,000,374 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts.ics
[2011.09.02 09:06:50 | 000,042,237 | ---- | M] () -- C:\ProgramData\nvModes.001
[2011.09.02 09:06:40 | 000,042,237 | ---- | M] () -- C:\ProgramData\nvModes.dat
[2011.09.02 09:06:38 | 000,003,712 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011.09.02 09:06:38 | 000,003,712 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011.09.02 09:06:32 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011.09.02 09:06:21 | 3215,572,992 | -HS- | M] () -- C:\hiberfil.sys
[2011.09.02 00:28:41 | 000,001,670 | ---- | M] () -- C:\Users\Nicole2\Desktop\einstein - Verknüpfung.lnk
[2011.09.01 23:33:30 | 000,000,757 | ---- | M] () -- C:\Users\Nicole2\Desktop\ICQ - Verknüpfung.lnk
[2011.09.01 21:03:39 | 000,001,850 | ---- | M] () -- C:\Users\Nicole2\Desktop\PlayCamera - Verknüpfung.lnk
[2011.09.01 20:35:02 | 000,000,400 | ---- | M] () -- C:\Windows\ODBC.INI
[2011.09.01 19:52:34 | 000,000,145 | ---- | M] () -- C:\CD-Laufwerk - Verknüpfung (2).lnk
[2011.08.31 11:21:27 | 000,001,191 | ---- | M] () -- C:\Users\Nicole2\Desktop\Free YouTube to MP3 Converter.lnk
[2011.08.30 02:50:17 | 000,054,304 | ---- | M] () -- C:\Users\Nicole2\Documents\5WCf_photo.jpg
[2011.08.30 01:16:51 | 000,038,263 | ---- | M] () -- C:\Users\Nicole2\Documents\Snapshot_20110814_52.jpg
[2011.08.26 22:40:01 | 000,644,136 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2011.08.26 22:40:01 | 000,600,690 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011.08.26 22:40:01 | 000,131,388 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2011.08.26 22:40:01 | 000,108,572 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011.08.26 21:55:23 | 000,001,747 | ---- | M] () -- C:\Users\Public\Desktop\PC Sync Manager.lnk
[2011.08.25 19:47:28 | 019,578,910 | ---- | M] () -- C:\Users\Nicole2\Documents\facebook-nruiva.zip
[2011.08.23 20:09:16 | 000,001,878 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk
[2011.08.23 19:57:36 | 000,000,828 | ---- | M] () -- C:\Users\Nicole2\Desktop\PhotoScape.lnk
[2011.08.23 19:56:37 | 017,327,195 | ---- | M] (Mooii) -- C:\Users\Nicole2\Desktop\PhotoScapeSetup_V3.5.exe
[2011.08.23 16:09:04 | 010,209,365 | ---- | M] () -- C:\Users\Nicole2\Documents\PC_Link_Manager_es1.zip
[2011.08.18 22:51:43 | 000,252,888 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2011.08.18 07:33:56 | 000,000,186 | ---- | M] () -- C:\INTENSO (E) - Verknüpfung.lnk
[2011.08.18 07:33:56 | 000,000,145 | ---- | M] () -- C:\CD-Laufwerk - Verknüpfung.lnk
[2011.08.17 23:44:16 | 000,001,800 | ---- | M] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
[2011.08.17 23:40:47 | 012,483,776 | ---- | M] (SUPERAntiSpyware.com) -- C:\Program Files\SUPERAntiSpyware.exe
[2011.08.17 17:39:47 | 000,001,905 | ---- | M] () -- C:\Windows\diagwrn.xml
[2011.08.17 17:39:47 | 000,001,905 | ---- | M] () -- C:\Windows\diagerr.xml
[2011.08.17 17:34:39 | 000,000,204 | ---- | M] () -- C:\Users\Nicole2\Desktop\CD-Laufwerk - Verknüpfung.lnk
[2011.08.15 22:14:45 | 124,539,416 | ---- | M] (Kaspersky Lab) -- C:\Users\Nicole2\Desktop\pure9.1.0.124de.exe
[2011.08.14 13:39:23 | 000,000,804 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2011.08.14 13:38:36 | 003,447,576 | ---- | M] (Piriform Ltd) -- C:\Program Files\ccsetup309.exe
[2011.08.13 23:06:16 | 000,014,120 | ---- | M] () -- C:\Users\Nicole2\Documents\bookmarks-2011-08-13.json
[2011.08.13 21:26:55 | 000,000,040 | ---- | M] () -- C:\Users\Public\Documents\_rgpl
[2011.08.13 21:01:57 | 000,000,098 | ---- | M] () -- C:\Windows\System32\drivers\etc\Hosts
[2011.08.13 15:01:11 | 000,100,864 | ---- | M] (GMER) -- C:\aglorpod.sys
[2011.08.12 02:48:29 | 000,000,846 | ---- | M] () -- C:\Users\Nicole2\Desktop\firefox - Verknüpfung.lnk
[2011.08.11 20:25:47 | 000,000,056 | -H-- | M] () -- C:\Windows\System32\ezsidmv.dat
[2011.08.11 20:21:12 | 019,075,976 | ---- | M] (Skype Technologies S.A.) -- C:\Program Files\SkypeSetup_4.2.0.187.exe
[2011.08.11 19:23:10 | 001,081,480 | ---- | M] (Skype Technologies S.A.) -- C:\Program Files\SkypeSetup.exe
[2011.08.11 18:52:48 | 000,000,104 | ---- | M] () -- C:\Users\Nicole2\Desktop\Computer - Verknüpfung.lnk
[2011.08.11 16:51:38 | 000,000,906 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.08.09 20:28:06 | 009,466,208 | ---- | M] (Malwarebytes Corporation                                    ) -- C:\Program Files\mbam-setup-1.51.1.1800.exe
 
========== Files Created - No Company Name ==========
 
[2011.09.02 00:28:03 | 000,001,670 | ---- | C] () -- C:\Users\Nicole2\Desktop\einstein - Verknüpfung.lnk
[2011.09.01 23:33:30 | 000,000,757 | ---- | C] () -- C:\Users\Nicole2\Desktop\ICQ - Verknüpfung.lnk
[2011.09.01 22:11:04 | 3215,572,992 | -HS- | C] () -- C:\hiberfil.sys
[2011.09.01 19:52:34 | 000,000,145 | ---- | C] () -- C:\CD-Laufwerk - Verknüpfung (2).lnk
[2011.08.31 11:21:27 | 000,001,191 | ---- | C] () -- C:\Users\Nicole2\Desktop\Free YouTube to MP3 Converter.lnk
[2011.08.30 02:49:55 | 000,054,304 | ---- | C] () -- C:\Users\Nicole2\Documents\5WCf_photo.jpg
[2011.08.30 01:16:37 | 000,038,263 | ---- | C] () -- C:\Users\Nicole2\Documents\Snapshot_20110814_52.jpg
[2011.08.29 16:50:45 | 000,000,949 | ---- | C] () -- C:\Users\Nicole2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
[2011.08.29 16:50:44 | 000,000,944 | ---- | C] () -- C:\Users\Nicole2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
[2011.08.29 16:50:34 | 000,000,915 | ---- | C] () -- C:\Users\Nicole2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Mail.lnk
[2011.08.26 21:55:21 | 000,001,759 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PC Sync Manager.lnk
[2011.08.26 21:55:21 | 000,001,747 | ---- | C] () -- C:\Users\Public\Desktop\PC Sync Manager.lnk
[2011.08.25 19:47:05 | 019,578,910 | ---- | C] () -- C:\Users\Nicole2\Documents\facebook-nruiva.zip
[2011.08.23 20:09:16 | 000,001,878 | ---- | C] () -- C:\Users\Public\Desktop\Skype.lnk
[2011.08.23 19:57:36 | 000,000,828 | ---- | C] () -- C:\Users\Nicole2\Desktop\PhotoScape.lnk
[2011.08.23 16:09:03 | 010,209,365 | ---- | C] () -- C:\Users\Nicole2\Documents\PC_Link_Manager_es1.zip
[2011.08.18 19:36:07 | 000,001,850 | ---- | C] () -- C:\Users\Nicole2\Desktop\PlayCamera - Verknüpfung.lnk
[2011.08.18 07:33:56 | 000,000,186 | ---- | C] () -- C:\INTENSO (E) - Verknüpfung.lnk
[2011.08.18 07:33:56 | 000,000,145 | ---- | C] () -- C:\CD-Laufwerk - Verknüpfung.lnk
[2011.08.17 23:44:16 | 000,001,800 | ---- | C] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
[2011.08.17 17:34:39 | 000,000,204 | ---- | C] () -- C:\Users\Nicole2\Desktop\CD-Laufwerk - Verknüpfung.lnk
[2011.08.14 13:39:23 | 000,000,804 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2011.08.13 23:06:16 | 000,014,120 | ---- | C] () -- C:\Users\Nicole2\Documents\bookmarks-2011-08-13.json
[2011.08.13 21:26:55 | 000,000,040 | ---- | C] () -- C:\Users\Public\Documents\_rgpl
[2011.08.12 02:48:29 | 000,000,846 | ---- | C] () -- C:\Users\Nicole2\Desktop\firefox - Verknüpfung.lnk
[2011.08.11 20:25:47 | 000,000,056 | -H-- | C] () -- C:\Windows\System32\ezsidmv.dat
[2011.08.11 18:52:48 | 000,000,104 | ---- | C] () -- C:\Users\Nicole2\Desktop\Computer - Verknüpfung.lnk
[2011.08.11 16:51:38 | 000,000,906 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.08.09 17:22:59 | 000,504,657 | ---- | C] () -- C:\Program Files\unhide.exe
[2011.07.04 20:37:23 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat
[2011.06.18 19:33:20 | 000,165,376 | ---- | C] () -- C:\Windows\System32\drivers\atksgt.sys
[2011.06.18 19:33:10 | 000,018,048 | ---- | C] () -- C:\Windows\System32\drivers\lirsgt.sys
[2011.06.10 18:03:18 | 000,116,224 | ---- | C] () -- C:\Windows\System32\pdfcmnnt.dll
[2011.06.10 07:35:42 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2011.06.10 07:35:42 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2011.06.09 21:15:21 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2011.06.09 19:13:49 | 000,000,400 | ---- | C] () -- C:\Windows\ODBC.INI
[2011.06.09 18:44:14 | 000,000,684 | ---- | C] () -- C:\Windows\HotFixList.ini
[2011.06.09 18:40:46 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll
[2011.06.09 18:39:06 | 000,042,237 | ---- | C] () -- C:\ProgramData\nvModes.001
[2011.06.09 18:39:05 | 000,042,237 | ---- | C] () -- C:\ProgramData\nvModes.dat
[2011.06.09 18:25:49 | 000,000,135 | R--- | C] () -- C:\Windows\System32\lngEng.ini
[2011.06.09 18:25:49 | 000,000,117 | ---- | C] () -- C:\Windows\System32\lngKor.ini
[2011.06.09 18:16:42 | 000,040,960 | ---- | C] () -- C:\Windows\System32\IhDEV.exe
[2011.06.09 18:16:42 | 000,024,576 | ---- | C] () -- C:\Windows\System32\IhINF.exe
[2008.01.21 09:15:58 | 000,644,136 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2008.01.21 09:15:58 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2008.01.21 09:15:58 | 000,131,388 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2008.01.21 09:15:58 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2007.02.26 16:49:12 | 006,139,774 | ---- | C] () -- C:\Windows\System32\imagine digital freedom.dat
[2007.02.16 01:51:02 | 000,274,432 | ---- | C] () -- C:\Windows\System32\NDADLL.dll
[2006.11.30 02:00:30 | 000,045,056 | ---- | C] () -- C:\Windows\System32\MAWebControl.exe
[2006.11.30 02:00:28 | 000,307,200 | ---- | C] () -- C:\Windows\System32\LDBGenWizView.dll
[2006.11.02 14:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006.11.02 14:47:37 | 000,252,888 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006.11.02 12:33:01 | 000,600,690 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2006.11.02 12:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2006.11.02 12:33:01 | 000,108,572 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2006.11.02 12:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2006.11.02 12:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2006.11.02 10:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006.11.02 10:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006.11.02 09:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2006.10.09 19:01:28 | 000,061,440 | ---- | C] () -- C:\Windows\System32\AVSAudioWideStereoDMO.dll
 
========== LOP Check ==========
 
[2011.09.02 09:31:45 | 000,000,000 | ---D | M] -- C:\Users\Nicole2\AppData\Roaming\ICQ
[2011.09.02 01:02:16 | 000,032,572 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2011.09.02 09:16:35 | 000,000,000 | ---D | M] -- C:\Users\Nicole2\AppData\Roaming\Adobe
[2011.09.02 09:31:45 | 000,000,000 | ---D | M] -- C:\Users\Nicole2\AppData\Roaming\ICQ
[2011.08.29 16:50:37 | 000,000,000 | ---D | M] -- C:\Users\Nicole2\AppData\Roaming\Identities
[2011.09.01 19:21:00 | 000,000,000 | ---D | M] -- C:\Users\Nicole2\AppData\Roaming\Macromedia
[2011.09.01 21:55:02 | 000,000,000 | ---D | M] -- C:\Users\Nicole2\AppData\Roaming\Malwarebytes
[2006.11.02 14:37:34 | 000,000,000 | ---D | M] -- C:\Users\Nicole2\AppData\Roaming\Media Center Programs
[2011.09.01 20:35:06 | 000,000,000 | --SD | M] -- C:\Users\Nicole2\AppData\Roaming\Microsoft
[2011.09.01 18:52:25 | 000,000,000 | ---D | M] -- C:\Users\Nicole2\AppData\Roaming\Mozilla
[2011.09.02 00:56:54 | 000,000,000 | ---D | M] -- C:\Users\Nicole2\AppData\Roaming\SUPERAntiSpyware.com
[2011.09.01 19:53:09 | 000,000,000 | ---D | M] -- C:\Users\Nicole2\AppData\Roaming\vlc
 
< %APPDATA%\*.exe /s >
 
< %SYSTEMDRIVE%\*.exe >
 
 
< MD5 for: AGP440.SYS  >
[2008.01.21 04:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\drivers\AGP440.sys
[2008.01.21 04:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_51b95d75\AGP440.sys
[2008.01.21 04:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys
[2008.01.21 04:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys
[2008.01.21 04:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_bbfe6647bbd2a4c6\AGP440.sys
[2006.11.02 11:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009.04.11 08:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\drivers\atapi.sys
[2009.04.11 08:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_b12d8e84\atapi.sys
[2009.04.11 08:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys
[2008.01.21 04:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys
[2008.01.21 04:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys
[2006.11.02 11:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll
[2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll
 
< MD5 for: IASTOR.SYS  >
[2008.06.16 21:38:28 | 000,396,312 | ---- | M] (Intel Corporation) MD5=DB0C1076AB442C09D2A3AB0410DBEA0D -- C:\Program Files\Intel\Intel Matrix Storage Manager\driver64\IaStor.sys
[2008.06.16 21:38:10 | 000,318,488 | ---- | M] (Intel Corporation) MD5=F263A9036F8897FFA2AE54685E03AD60 -- C:\Program Files\Intel\Intel Matrix Storage Manager\driver\IaStor.sys
[2008.06.16 21:38:10 | 000,318,488 | ---- | M] (Intel Corporation) MD5=F263A9036F8897FFA2AE54685E03AD60 -- C:\Windows\System32\drivers\iaStor.sys
[2008.06.16 21:38:10 | 000,318,488 | ---- | M] (Intel Corporation) MD5=F263A9036F8897FFA2AE54685E03AD60 -- C:\Windows\System32\DriverStore\FileRepository\iaahci.inf_3506096f\iaStor.sys
 
< MD5 for: IASTORV.SYS  >
[2008.01.21 04:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\drivers\iaStorV.sys
[2008.01.21 04:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_c9df7691\iaStorV.sys
[2008.01.21 04:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys
[2006.11.02 11:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2009.04.11 08:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\System32\netlogon.dll
[2009.04.11 08:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_ffa3304f351bb3a3\netlogon.dll
[2008.01.21 04:24:05 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2006.11.02 11:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys
[2008.01.21 04:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\drivers\nvstor.sys
[2008.01.21 04:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys
[2008.01.21 04:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2008.01.21 04:24:50 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll
[2009.04.11 08:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\System32\scecli.dll
[2009.04.11 08:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e\scecli.dll
 
< MD5 for: USER32.DLL  >
[2008.01.21 04:24:21 | 000,627,200 | ---- | M] (Microsoft Corporation) MD5=B974D9F06DC7D1908E825DC201681269 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_cd386c416d5c7f32\user32.dll
[2009.04.11 08:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\user32.dll
[2009.04.11 08:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6002.18005_none_cf23e54d6a7e4a7e\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2008.01.21 04:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe
[2008.01.21 04:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe
 
< MD5 for: WININIT.EXE  >
[2008.01.21 04:23:42 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\System32\wininit.exe
[2008.01.21 04:23:42 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6001.18000_none_30f2b8cf0450a6a2\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2009.04.11 08:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\System32\winlogon.exe
[2009.04.11 08:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe
[2008.01.21 04:24:49 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2008.01.21 04:24:47 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\System32\drivers\ws2ifsl.sys
[2008.01.21 04:24:47 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6001.18000_none_4f86a0d4c7cda641\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
[2008.01.21 05:14:18 | 016,846,848 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV
[2008.01.21 05:14:08 | 000,106,496 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV
[2008.01.21 05:14:18 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV
[2006.11.02 12:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV
[2006.11.02 12:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
 
<           >

< End of report >
         

--- --- ---


OTL Logfile:

OTL Extras logfile created on: 02.09.2011 09:31:55 - Run 1
OTL by OldTimer - Version 3.2.27.0     Folder = C:\Users\Nicole2\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,99 Gb Total Physical Memory | 2,09 Gb Available Physical Memory | 69,81% Memory free
6,20 Gb Paging File | 5,25 Gb Available in Paging File | 84,68% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 222,88 Gb Total Space | 156,57 Gb Free Space | 70,25% Space Free | Partition Type: NTFS
 
Computer Name: ADMIN-PC | User Name: Nicole2 | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-679186329-3352478774-2945693008-1000]
"EnableNotifications" = 0
"EnableNotificationsRef" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
"DoNotAllowExceptions" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0ADBA36C-E641-4E0B-91E4-F52954F52A2B}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{13251F6D-25E0-4221-9637-A62C4D4D30BD}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe | 
"{15146B19-FF7C-4855-B6A5-F90DF6178022}" = rport=137 | protocol=17 | dir=out | app=system | 
"{1556D602-93B9-4300-9751-14F06D0CE541}" = lport=53 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 
"{2A26A99E-F55F-4B15-9582-4EA040562D0D}" = lport=67 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 
"{3BFD8104-3A86-4E03-B26F-002F23B03C55}" = rport=445 | protocol=6 | dir=out | app=system | 
"{3EA02309-F11D-43D6-B8A2-9FD85A3D0379}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 
"{418FEDB7-73DA-4219-94CC-929D2A794FB1}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) | 
"{4E35DF6D-A8A9-4EF8-9069-5B3F33732498}" = rport=138 | protocol=17 | dir=out | app=system | 
"{616BE416-E9D8-41D4-99AC-5B435FA21864}" = lport=137 | protocol=17 | dir=in | app=system | 
"{68F19B96-B633-4690-B3D4-58A1AD7A55B5}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{6A0A9154-99C3-41EE-808F-4950353357CF}" = lport=547 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 
"{80BDE7CD-9EAC-4CC7-AF1D-CEA1687DDDAB}" = rport=139 | protocol=6 | dir=out | app=system | 
"{82B1649E-4EC5-4FDD-92AA-51586073F31E}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{8FF5DC36-0D3D-4C5D-923D-94345E33431D}" = lport=445 | protocol=6 | dir=in | app=system | 
"{96B24376-A280-4CF0-B713-7D33B7B00D0D}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) | 
"{A858AEEC-1AF3-4567-80C7-F74D8E781589}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 
"{B9E2BBE0-5FA5-46FD-A9D0-D063A19F6FA2}" = lport=138 | protocol=17 | dir=in | app=system | 
"{BAC83331-82BE-4637-A7EB-2FE71F8E45B5}" = lport=68 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 
"{C3B2B21E-8511-48BA-9950-8824CE9B6137}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{C9BAD1CC-2E9A-42AB-894A-946EC7BE733F}" = rport=2869 | protocol=6 | dir=out | app=system | 
"{CF281BBD-7CBA-463A-BF8F-48A1E6B189E0}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
"{D86575B9-5514-45B5-B955-9CC47207AE48}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{DE7966DE-3C54-4E2B-8A8F-5E0826D16F2C}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{E3209084-DED2-44B0-B131-517FED2C2BB4}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{EE17490A-453A-486B-B5C7-0465038C5149}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
"{F9B9108C-5B4F-4DEF-B0E0-C64DE3D2D4DC}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe | 
"{F9F82218-D3F2-4985-959E-0E1D83D6A671}" = lport=139 | protocol=6 | dir=in | app=system | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0C4058D6-466F-4DF1-8563-1B73AEE2D085}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | 
"{0C437E0D-541C-4A3E-9877-3CB2E2264674}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{0CC42F0B-CC1E-4F19-9CB2-2EE06B02D19B}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{1BEE355E-14A5-4746-BF13-EA3B60C96C5C}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{2108BD04-B816-4659-888A-A05815F9B6D7}" = protocol=17 | dir=in | app=c:\program files\teamviewer\version6\teamviewer_service.exe | 
"{236AB965-0E25-49E9-BB38-CAEA8AD11707}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{241813D0-BD8C-4D2E-B14E-573B85D04586}" = protocol=6 | dir=in | app=c:\program files\teamviewer\version6\teamviewer.exe | 
"{242D6C48-4222-4C19-9664-76D0D433963F}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{2AAED9A4-B04B-4EAE-83F7-0C647FF5A478}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{2B51C36C-4B96-4F79-ADBB-F2AF837D739C}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{317F13BB-C9FF-48A7-8247-4C91F90CC3EE}" = protocol=6 | dir=in | app=c:\program files\teamviewer\version6\teamviewer_service.exe | 
"{371F089A-29CE-4E27-91B0-CEFB40B05906}" = dir=out | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 
"{3B14ADAF-971E-47EB-9990-7D5BFF4730A9}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{41F6064F-8D35-4C3F-A596-71542603F6D1}" = protocol=17 | dir=in | app=c:\program files\icq7.5\icq.exe | 
"{452F5643-B50A-4ABE-A191-84E6726320D6}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{50EAF023-5BCC-44EC-852D-874FEBECA39F}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{515DAF4F-EA65-497A-A014-48D276D03453}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{55A87A74-1A9A-4D92-9EFB-F8AF3E176A5C}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{577E609D-0042-441B-9138-18B56DF9A621}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{58AE6270-AC3F-40BE-9B86-22460DBCC60C}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{599AE43F-C46B-4A7E-8D92-7BA6824C9663}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{5D54B558-6AB3-4876-BF74-FCFFCFAECE96}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{6BA6EBB8-462F-40EA-88C1-7CB1D1A90937}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{7C6BDC9A-7F9C-4A1B-9E2B-0137A77E2188}" = dir=in | app=c:\program files\windows live\contacts\wlcomm.exe | 
"{833CB862-9911-4101-B067-16A1BA9BE03F}" = protocol=58 | dir=in | name=@hnetcfg.dll,-148 | 
"{9D8FE41A-DCE3-4D9E-A33C-9E2F049ED668}" = dir=in | app=c:\program files\cyberlink\powerdirector\pdr.exe | 
"{A14B96E4-D585-4972-9EB2-F5E10006CFA8}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{ACCED9F2-1245-4269-AB9E-3674FFD9510B}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{AD7F6F1F-5F9F-46E7-953C-F1E77037A50D}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{AEE2E7C9-17AB-46EA-915F-DFDE265E690F}" = protocol=17 | dir=in | app=c:\program files\teamviewer\version6\teamviewer.exe | 
"{B0C7792B-9FEC-42DE-B083-52B028054523}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{B2DFFE5C-2B5D-4640-9E34-F9E7632263D1}" = protocol=17 | dir=in | app=c:\program files\icq7.5\icq.exe | 
"{B2ED03F3-4D9B-4E3C-A5FB-D554337F389F}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{B3A0AE9B-1CF5-4653-B159-6BC9BB0E3279}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{B426F91E-BB9F-40C5-808F-CAA63E1AF467}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{BDA0A150-C483-4122-ADD0-BCCC88C1B4BA}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{BECF143A-F351-4F69-B285-16B7370859C6}" = dir=in | app=c:\program files\skype\plugin manager\skypepm.exe | 
"{C4270F4E-A56A-4079-B84B-10EECEBABBB4}" = protocol=6 | dir=in | app=c:\program files\icq7.5\icq.exe | 
"{C6FFC124-EE7F-4C96-BFD3-39702B72F407}" = dir=in | app=c:\program files\cyberlink\powerdvd\powerdvd.exe | 
"{C8FB896D-9D11-41AC-91D8-02DFF4CAE0FC}" = protocol=6 | dir=in | app=c:\program files\icq7.5\icq.exe | 
"{E08B9F28-9A1B-4176-AF59-F366E0E6B6B5}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{EEC775BC-2A18-427C-A73F-787DA05CAC20}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{FDD100B9-ED24-45FB-A6A0-4F38A60195D5}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"TCP Query User{6B966A52-A656-44C7-9657-4F933945FC93}C:\program files\icq7.5\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq7.5\icq.exe | 
"TCP Query User{A51E600C-B375-49E0-91BB-0ACB096B7221}C:\program files\skype\phone\skype.exe" = protocol=6 | dir=in | app=c:\program files\skype\phone\skype.exe | 
"UDP Query User{69901D32-F6D1-4CC7-8085-8AF950869624}C:\program files\skype\phone\skype.exe" = protocol=17 | dir=in | app=c:\program files\skype\phone\skype.exe | 
"UDP Query User{873C3911-A7F4-4B1F-8E0B-7F3230495136}C:\program files\icq7.5\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq7.5\icq.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{004C5DA2-2051-4D25-94BA-51CF810C91EB}" = LightScribe System Software  1.12.37.1
"{00AF10C1-44BD-4862-9D7F-24E6BA3E87FD}" = imagine digital freedom - Samsung
"{04983D37-2202-4295-94A2-8B547C66133F}" = Atheros WLAN Client
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{145DE957-0679-4A2A-BB5C-1D3E9808FAB2}" = Samsung Recovery Solution III
"{17283B95-21A8-4996-97DA-547A48DB266F}" = Easy Display Manager
"{1BA1DBDC-5431-46FD-A66F-A17EB1C439EE}" = Windows Live Messenger
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = CyberLink DVD Suite
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{32D6A58F-9659-446C-BBFC-E6F2B41F24DC}" = Samsung Magic Doctor
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{36BEAD11-8577-49AD-9250-E06A50AE87B0}" = Microsoft SOAP Toolkit 2.0 SP2
"{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = CyberLink Power2Go
"{4EA8EA5D-8E46-4698-9BF7-2F2AD8E1C185}" = Easy Network Manager 3.0
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{58D68DF0-4E8B-4E9E-B425-670F9E37C1A8}" = TES Construction Set
"{5DD4FCBD-A3C1-4155-9E17-4161C70AAABA}" = Segoe UI
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{685707A4-911C-468D-BFC4-64A50E5E3A0C}" = Samsung Update Plus
"{6F730513-8688-4C3C-90A3-6B9792CE2EF3}" = Easy Battery Manager
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{71A51B09-E7D3-11DB-A386-005056C00008}" = Vimicro UVC Camera
"{7578ADEA-D65F-4C89-A249-B1C88B6FFC20}" = ICQ7.5
"{804F1285-8CBF-408D-8CDC-D4D40003B2E4}" = PlayCamera
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{889DF117-14D1-44EE-9F31-C5FB5D47F68B}" = Yontoo Layers Runtime 1.10.01
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{90110407-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Professional
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{955597D8-E5E1-474D-B647-60AC44566D24}" = Play AVStation
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AA59DDE4-B672-4621-A016-4C248204957A}" = Skype™ 5.5
"{AC76BA86-7AD7-1031-7B44-A81000000003}" = Adobe Reader 8.1.0 - Deutsch
"{B113D18C-67B0-4FB7-B329-E89B66194AE6}" = Windows Live Fotogalerie
"{B7A0CE06-068E-11D6-97FD-0050BACBF861}" = PowerProducer
"{BAE68339-B0F6-4D33-9554-5A3DB2DFF5DA}" = User Guide
"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common
"{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = LabelPrint
"{C6150D8A-86ED-41D3-87BB-F3BB51B0B77F}" = Windows Live ID Sign-in Assistant
"{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = PowerDirector
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{DDDDEDE3-1C38-4B1E-91D0-01954310A7CE}" = PC Sync Manager
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E4E88B54-4777-4659-967A-2EED1E6AFD83}" = Windows Live Movie Maker
"{E5B21F11-6933-4E0B-A25C-7963E3C07D11}" = Windows Live Messenger
"{EF367AA4-070B-493C-9575-85BE59D789C9}" = Easy SpeedUp Manager
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials
"{F9835182-794B-4F24-902A-E2CA9D43380F}" = NVIDIA PhysX
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"CanonMyPrinter" = Canon My Printer
"CCleaner" = CCleaner
"Easy-PhotoPrint EX" = Canon Utilities Easy-PhotoPrint EX
"Einstein" = Einstein Puzzle
"ESET Online Scanner" = ESET Online Scanner v3
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.10.8.815
"InstallShield_{4EA8EA5D-8E46-4698-9BF7-2F2AD8E1C185}" = Easy Network Manager 3.0
"InstallShield_{685707A4-911C-468D-BFC4-64A50E5E3A0C}" = Samsung Update Plus
"InstallShield_{955597D8-E5E1-474D-B647-60AC44566D24}" = Play AVStation
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware Version 1.51.1.1800
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Mozilla Firefox 6.0.1 (x86 de)" = Mozilla Firefox 6.0.1 (x86 de)
"MP Navigator EX 1.0" = Canon MP Navigator EX 1.0
"NVIDIA Drivers" = NVIDIA Drivers
"PhotoScape" = PhotoScape
"Picasa 3" = Picasa 3
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"TeamViewer 6" = TeamViewer 6
"VLC media player" = VLC media player 1.1.10
"WinLiveSuite" = Windows Live Essentials
"YDKJG3" = YOU DON'T KNOW JACK® 3 - Abwärts!
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 29.08.2011 16:30:00 | Computer Name = Admin-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 30.08.2011 07:06:15 | Computer Name = Admin-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 31.08.2011 05:08:55 | Computer Name = Admin-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 31.08.2011 12:48:52 | Computer Name = Admin-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 01.09.2011 08:42:32 | Computer Name = Admin-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 01.09.2011 14:24:47 | Computer Name = Admin-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 01.09.2011 15:54:25 | Computer Name = Admin-PC | Source = EventSystem | ID = 4609
Description = 
 
Error - 01.09.2011 15:55:43 | Computer Name = Admin-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 01.09.2011 16:12:52 | Computer Name = Admin-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 02.09.2011 03:08:09 | Computer Name = Admin-PC | Source = WinMgmt | ID = 10
Description = 
 
[ Media Center Events ]
Error - 12.06.2011 02:10:16 | Computer Name = Admin-PC | Source = Media Center Guide | ID = 0
Description = Ereignisinformationen: ERROR: SqmApiWrapper.SqmFlushSession failed;
 Win32 GetLastError returned 0D  Prozess: DefaultDomain Objektname: Media Center Guide

 
[ System Events ]
Error - 10.06.2011 11:56:25 | Computer Name = Admin-PC | Source = HTTP | ID = 15016
Description = 
 
Error - 10.06.2011 11:56:52 | Computer Name = Admin-PC | Source = Service Control Manager | ID = 7000
Description = 
 
Error - 10.06.2011 12:32:36 | Computer Name = Admin-PC | Source = Service Control Manager | ID = 7000
Description = 
 
 
< End of report >
         

--- --- ---

Bitte nun dieses Tool von Kaspersky ausführen und das Log posten => http://www.trojaner-board.de/82358-t...entfernen.html

Das Tool so einstellen wie unten im Bild angegeben - also beide Haken setzen, auf Start scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.




Falls du durch die Infektion auf deine Dokumente/Eigenen Dateien nicht zugreifen kannst, Verknüpfungen auf dem Desktop oder im Startmenü unter "alle Programme" fehlen, bitte unhide ausführen:
Downloade dir bitte unhide.exe und speichere diese Datei auf deinem Desktop.
Starte das Tool und es sollten alle Dateien und Ordner wieder sichtbar sein. ( Könnte eine Weile dauern )
Windows-Vista und Windows-7-User müssen das Tool per Rechtsklick als Administrator ausführen!

Ok ich hab meinen Laptop von einem Profi bereinigen lassen Das hat mich zwar bisschen Geld aber dafür weniger Zeit als letztes Mal gekostet.

Trtozdem danke für eure Hilfe!