Was ist los?

McAffee hatte einen Fund in einer ca. 622 MB großen Zip-Datei auf der DVD PC-Praxis 12/11 gemeldet. Diese habe ich nicht genutzt, weil dies alles Programme für eine Stick sind. Auf Grund der Rechercheergebnisse habe ich die SVCHOST bei VirusTotal (VT) checken lassen. Ein Fund des Win32.TrojanHorse von einem der Virenscanner. Bei Chip habe ich Nachgefragt unter dem Titel: McAffee findet W32/YahLover.worm. Leider erhalte ich seit ca. 2 Tagen keine Antwort mehr, obwohl der "Bearbeiter" aktiv ist. Deshalb habe ich mich dort aus dem Thread abgemeldet und stelle mein Problem hier vor.

Habe weiter nach Lösungen und Informationen gesucht und deshalb auch Programme wie Netmeter oder whireshark installiert. Leider komme ich damit kaum, bis gar nicht zu recht.


Aktuelle Schwierigkeiten:

McAffee Echtzeit-Scan lässt sich nicht einschalten. Manueller - Scan lässt sich zwar anschalten, zeigt aber keine untersuchte Datei, auch die Prozentanzeige verändert sich nicht. Malwarbites, Adaware finden mit den Standardeinstellungen nichts. Gestern ging Windows-Defender nicht. Nun liefert der Schnelldurchlauf keinen Fund.

Firefox leitet alle, auch google, Seiten auf eine Seite mit chinesischem (?) Schriftsatz um. In der OTL.exe und der SVCHOST.exe werden durch VT diese Funde angezeigt:


SVCHOST.EXE

eSafe 7.0.17.0 2011.12.11 Win32.TrojanHorse

MD5 : 54a47f6b5e09a77e61649109c6a08866
SHA1 : 4af001b3c3816b860660cf2de2c0fd3c1dfb4878
SHA256: 121118a0f5e0e8c933efd28c9901e54e42792619a8a3a6d11e1f0025a7324bc2

OTL.exe

Antiy-AVL 2.0.3.7 2011.12.12 Trojan/win32.agent.gen
ByteHero 1.0.0.1 2011.12.07 Trojan.Win32.Heur.087
ClamAV 0.97.3.0 2011.12.12 PUA.Packed.PECompact-1
eSafe 7.0.17.0 2011.12.11 Suspicious File
Jiangmin 13.0.900 2011.12.12 Trojan/Swisyn.see

MD5 : 3270cb86f79b3e23720bafc2e48be3be
SHA1 : 590bf47c71b26cd01d70b34c567c75f9613341ac
SHA256: 851a1822872f6c47711ff5377f46d3063c4ac94422fb83d38226b8d080f7a044


Defogger.exe lief nicht durch. Lt. TaskManager war der Prozeß ohne Aktivität.Nach ca. 30 min. ohne Aktivität habe ich das System manuell rebeootet. Der Log sieht so aus:

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 19:06 on 12/12/2011 (Ghost)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...

-=E.O.F=-


OTL - eine Extra.txt wurde nicht erstellt.

OTL.txt
OTL Logfile:

OTL logfile created on: 12.12.2011 21:09:05 - Run 6
OTL by OldTimer - Version 3.2.31.0     Folder = C:\Users\Ghost\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
7,98 Gb Total Physical Memory | 6,00 Gb Available Physical Memory | 75,26% Memory free
15,95 Gb Paging File | 13,68 Gb Available in Paging File | 85,76% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 111,69 Gb Total Space | 37,70 Gb Free Space | 33,76% Space Free | Partition Type: NTFS
Drive D: | 224,61 Gb Total Space | 206,68 Gb Free Space | 92,02% Space Free | Partition Type: NTFS
Drive E: | 241,15 Gb Total Space | 190,42 Gb Free Space | 78,96% Space Free | Partition Type: NTFS
Drive G: | 465,64 Gb Total Space | 381,59 Gb Free Space | 81,95% Space Free | Partition Type: FAT32
 
Computer Name: GHOST-PC | User Name: Ghost | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2011.12.12 16:47:13 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Ghost\Desktop\OTL.exe
PRC - [2011.11.03 19:25:09 | 002,358,656 | ---- | M] (TeamViewer GmbH) -- C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe
PRC - [2011.10.28 19:35:26 | 002,152,152 | ---- | M] (Lavasoft Limited) -- D:\Program Files (x86)\Lavasoft\Ad-Aware\AAWService.exe
PRC - [2011.10.28 19:35:26 | 001,187,072 | ---- | M] (Lavasoft Limited) -- D:\Program Files (x86)\Lavasoft\Ad-Aware\AAWTray.exe
PRC - [2011.08.31 17:00:48 | 000,366,152 | ---- | M] (Malwarebytes Corporation) -- d:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2011.06.06 12:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2011.04.29 23:32:54 | 000,013,592 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
PRC - [2011.04.29 23:32:50 | 000,284,440 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
PRC - [2010.12.07 15:32:24 | 001,097,344 | ---- | M] (ASUSTeK Computer Inc.) -- C:\Program Files (x86)\ASUS\AI Suite II\TurboV EVO\TurboVHelp.exe
PRC - [2010.12.02 09:37:22 | 001,425,536 | ---- | M] (ASUSTeK Computer Inc.) -- C:\Program Files (x86)\ASUS\AI Suite II\AI Suite II.exe
PRC - [2010.12.02 03:15:14 | 000,915,584 | R--- | M] () -- C:\Program Files (x86)\ASUS\AAHM\1.00.13\aaHMSvc.exe
PRC - [2010.11.26 20:50:04 | 002,931,328 | ---- | M] (ASUSTeK Computer Inc.) -- C:\Program Files (x86)\ASUS\AI Suite II\AsRoutineController.exe
PRC - [2010.11.17 02:53:16 | 000,113,288 | ---- | M] (Renesas Electronics Corporation) -- C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
PRC - [2010.11.16 09:38:22 | 000,654,464 | ---- | M] (ASUSTeK Computer Inc.) -- C:\Program Files (x86)\ASUS\AI Suite II\ASUS Mobilink\iPhone Simulator\pnSvc.exe
PRC - [2010.11.10 10:23:44 | 001,204,656 | ---- | M] (ASUSTeK Computer Inc.) -- C:\Program Files (x86)\ASUS\AI Suite II\EPU\EPUHelp.exe
PRC - [2010.11.09 09:34:26 | 002,529,920 | R--- | M] (ASUSTeK Computer Inc.) -- C:\Program Files (x86)\ASUS\AI Suite II\ASUS Mobilink\Simulator\EC Simulator.exe
PRC - [2010.11.03 10:30:14 | 000,918,144 | R--- | M] () -- C:\Program Files (x86)\ASUS\AXSP\1.00.13\atkexComSvc.exe
PRC - [2010.10.21 10:52:26 | 000,586,880 | R--- | M] () -- C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.11\AsSysCtrlService.exe
PRC - [2010.10.12 15:39:50 | 001,115,776 | ---- | M] (ASUSTeK Computer Inc.) -- C:\Program Files (x86)\ASUS\AI Suite II\DIGI+ VRM\VRMHelp.exe
PRC - [2010.09.28 14:47:10 | 000,252,544 | R--- | M] (ASUSTeK Computer Inc.) -- C:\Program Files (x86)\ASUS\AI Suite II\ASUS Mobilink\Simulator\AsShellProcess.exe
PRC - [2010.09.24 20:29:32 | 001,115,776 | ---- | M] (ASUSTeK Computer Inc.) -- C:\Program Files (x86)\ASUS\AI Suite II\Sensor\AlertHelper\AlertHelper.exe
PRC - [2010.06.30 15:46:32 | 000,121,456 | ---- | M] () -- C:\Program Files (x86)\Common Files\Portrait Displays\Shared\DTSRVC.exe
PRC - [2010.06.30 15:46:30 | 001,264,240 | ---- | M] (Portrait Displays, Inc) -- C:\Program Files (x86)\Acer Display\eDisplay Management\DTHtml.exe
PRC - [2010.06.30 15:46:08 | 000,129,648 | ---- | M] () -- C:\Program Files (x86)\Common Files\Portrait Displays\Plugins\AM\dtsslsrv.exe
PRC - [2010.05.13 15:34:48 | 000,711,792 | ---- | M] () -- C:\Program Files (x86)\Portrait Displays\Pivot Pro Plugin\floater.exe
PRC - [2010.05.13 15:34:42 | 000,674,928 | ---- | M] () -- C:\Program Files (x86)\Portrait Displays\Pivot Pro Plugin\wpctrl.exe
PRC - [2010.04.16 14:34:34 | 000,109,168 | ---- | M] (Portrait Displays, Inc.) -- C:\Program Files (x86)\Common Files\Portrait Displays\Drivers\pdisrvc.exe
PRC - [2010.02.23 10:01:28 | 000,329,168 | ---- | M] () -- C:\Program Files (x86)\Verbindungsassistent\WTGService.exe
PRC - [2010.01.15 13:49:20 | 000,255,536 | ---- | M] (McAfee, Inc.) -- C:\Program Files (x86)\McAfee Security Scan\2.0.181\SSScheduler.exe
PRC - [2010.01.08 13:15:24 | 001,118,208 | ---- | M] (Realtek Semiconductor Corp.) -- C:\Program Files (x86)\Realtek\RTL8187 Wireless LAN Utility\RtWlan.exe
PRC - [2009.12.07 12:49:24 | 000,040,960 | ---- | M] (Realtek) -- C:\Program Files (x86)\Realtek\RTL8187 Wireless LAN Utility\RtlService.exe
PRC - [2009.03.05 16:07:20 | 002,260,480 | RHS- | M] (Safer-Networking Ltd.) -- D:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe
PRC - [2009.01.26 15:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) -- D:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
PRC - [2009.01.16 11:12:28 | 000,221,184 | ---- | M] () -- C:\Windows\system\cm106eye.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2011.10.29 14:29:11 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\b2622080e047040fa044dd21a04ff10d\System.Runtime.Remoting.ni.dll
MOD - [2011.10.29 14:29:11 | 000,014,336 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorCommon\33cecc66284ef59208b639ec72b0f565\IAStorCommon.ni.dll
MOD - [2011.10.29 14:29:10 | 003,347,968 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\d7a64c28cf0c90e6c48af4f7d6f9ed41\WindowsBase.ni.dll
MOD - [2011.10.29 14:29:09 | 000,492,544 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\e8339b699235ebf2f904ccb8383de342\IAStorUtil.ni.dll
MOD - [2011.10.29 14:29:08 | 012,433,408 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\6e592e424a204aafeadbe22b6b31b9db\System.Windows.Forms.ni.dll
MOD - [2011.10.29 14:29:04 | 001,587,200 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\3b2cfd85528a27eb71dc41d8067359a1\System.Drawing.ni.dll
MOD - [2011.10.29 14:28:50 | 005,453,312 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\130ad4d9719e566ca933ac7158a04203\System.Xml.ni.dll
MOD - [2011.10.29 14:28:48 | 007,963,648 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\abab08afa60a6f06bdde0fcc9649c379\System.ni.dll
MOD - [2011.10.29 14:28:48 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\2d5bcbeb9475ef62189f605bcca1cec6\System.Configuration.ni.dll
MOD - [2011.10.29 14:28:44 | 011,490,304 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\a1a82db68b3badc7c27ea1f6579d22c5\mscorlib.ni.dll
MOD - [2011.04.12 08:43:06 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Runtime.Remoting.resources\2.0.0.0_de_b77a5c561934e089\System.Runtime.Remoting.resources.dll
MOD - [2010.12.03 15:12:48 | 001,027,072 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\Probe_II\ProbeII.dll
MOD - [2010.12.02 16:28:36 | 000,143,360 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\AssistFunc.dll
MOD - [2010.12.01 11:33:32 | 001,244,672 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\MyLogo\MyLogo.dll
MOD - [2010.11.19 09:55:00 | 001,246,208 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\Settings\Settings.dll
MOD - [2010.11.19 09:53:34 | 000,963,584 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\BarGadget\BarGadget.dll
MOD - [2010.11.16 09:37:20 | 000,086,016 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\ASUS Mobilink\iPhone Simulator\AsNetlib.dll
MOD - [2010.11.13 00:26:08 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll
MOD - [2010.11.11 02:09:26 | 000,703,488 | R--- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\ASUS Mobilink\Simulator\CpuFreq.dll
MOD - [2010.10.15 16:40:30 | 001,031,680 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\ASUS Update\Update.dll
MOD - [2010.09.27 19:51:16 | 001,607,168 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\Sensor Graph\SensorGraph.dll
MOD - [2010.09.27 19:51:12 | 000,881,664 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\Sensor\Sensor.dll
MOD - [2010.09.19 20:52:50 | 000,094,208 | ---- | M] () -- C:\Windows\SysWOW64\IccLibDll.dll
MOD - [2010.08.23 03:17:40 | 000,662,016 | R--- | M] () -- C:\Program Files (x86)\ASUS\AAHM\1.00.13\aaHMLib.dll
MOD - [2010.08.06 17:13:48 | 000,886,272 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\TabGadget\TabGadget.dll
MOD - [2010.08.06 17:11:20 | 000,850,944 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\Splitter\Splitter.dll
MOD - [2010.07.30 10:28:32 | 000,670,208 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\ASUS Mobilink\iPhone Simulator\asacpiEx.dll
MOD - [2010.07.15 19:04:40 | 000,661,504 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\ASUS Mobilink\iPhone Simulator\aaHMLib.dll
MOD - [2010.07.15 19:04:40 | 000,253,952 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\ASUS Mobilink\iPhone Simulator\pngio.dll
MOD - [2010.07.15 19:04:40 | 000,208,896 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\ASUS Mobilink\iPhone Simulator\ImageHelper.dll
MOD - [2010.06.30 15:46:26 | 000,084,592 | ---- | M] () -- C:\Program Files (x86)\Common Files\Portrait Displays\Plugins\CC\gui.dll
MOD - [2010.06.30 15:37:38 | 000,172,032 | ---- | M] () -- C:\Program Files (x86)\Common Files\Portrait Displays\Shared\PresetsCOM.dll
MOD - [2010.06.23 04:54:36 | 000,114,688 | R--- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\ASUS Mobilink\Simulator\AssistFunc.dll
MOD - [2010.06.21 14:21:22 | 000,208,896 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\Sensor\AlertHelper\ImageHelper.dll
MOD - [2010.06.21 14:21:22 | 000,208,896 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\ImageHelper.dll
MOD - [2010.05.13 15:34:48 | 000,711,792 | ---- | M] () -- C:\Program Files (x86)\Portrait Displays\Pivot Pro Plugin\floater.exe
MOD - [2010.05.13 15:34:42 | 000,674,928 | ---- | M] () -- C:\Program Files (x86)\Portrait Displays\Pivot Pro Plugin\wpctrl.exe
MOD - [2010.02.24 09:56:40 | 000,661,504 | R--- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\ASUS Mobilink\Simulator\aaHMLib.dll
MOD - [2009.08.12 19:15:52 | 000,253,952 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\pngio.dll
MOD - [2009.05.21 09:14:14 | 000,253,952 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\TurboV EVO\pngio.dll
MOD - [2009.05.21 03:14:14 | 000,053,248 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\TurboV EVO\HookKey32.dll
MOD - [2009.01.16 11:12:28 | 000,221,184 | ---- | M] () -- C:\Windows\system\cm106eye.exe
MOD - [2007.10.31 10:51:00 | 000,061,440 | R--- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\ASUS Mobilink\Simulator\AsMultiLang.dll
MOD - [2006.09.13 06:08:00 | 000,491,520 | ---- | M] () -- C:\Windows\system\cmau106.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - [2011.10.26 03:00:58 | 000,204,288 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)
SRV:64bit: - [2011.10.18 17:01:08 | 000,502,032 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files\McAfee\VirusScan\mcods.exe -- (McODS)
SRV:64bit: - [2011.10.18 14:32:28 | 000,161,168 | ---- | M] (McAfee, Inc.) [Unknown | Running] -- C:\Windows\SysNative\mfevtps.exe -- (mfevtp)
SRV:64bit: - [2011.10.18 14:23:24 | 000,208,536 | ---- | M] () [Unknown | Running] -- C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe -- (mfefire)
SRV:64bit: - [2011.10.18 14:23:06 | 000,199,272 | ---- | M] () [Unknown | Running] -- C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe -- (McShield)
SRV:64bit: - [2011.01.27 18:28:20 | 000,249,936 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe -- (MSK80Service)
SRV:64bit: - [2011.01.27 18:28:20 | 000,249,936 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe -- (McProxy)
SRV:64bit: - [2011.01.27 18:28:20 | 000,249,936 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe -- (McNASvc)
SRV:64bit: - [2011.01.27 18:28:20 | 000,249,936 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe -- (McNaiAnn)
SRV:64bit: - [2011.01.27 18:28:20 | 000,249,936 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe -- (mcmscsvc)
SRV:64bit: - [2011.01.27 18:28:20 | 000,249,936 | ---- | M] (McAfee, Inc.) [Unknown | Running] -- C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe -- (McMPFSvc)
SRV - [2011.12.08 18:39:32 | 000,419,624 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2011.11.03 19:25:09 | 002,358,656 | ---- | M] (TeamViewer GmbH) [Auto | Running] -- C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe -- (TeamViewer6)
SRV - [2011.10.28 19:35:26 | 002,152,152 | ---- | M] (Lavasoft Limited) [Auto | Running] -- D:\Program Files (x86)\Lavasoft\Ad-Aware\AAWService.exe -- (Lavasoft Ad-Aware Service)
SRV - [2011.08.31 17:00:48 | 000,366,152 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- d:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2011.06.08 12:02:00 | 000,633,856 | ---- | M] (Nokia) [On_Demand | Stopped] -- C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
SRV - [2011.06.06 12:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2011.04.29 23:32:54 | 000,013,592 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc) Intel(R)
SRV - [2011.03.21 16:19:16 | 001,845,248 | ---- | M] (Locktime Software) [Auto | Running] -- D:\Program Files\NetLimiter 3\nlsvc.exe -- (nlsvc)
SRV - [2010.12.02 03:15:14 | 000,915,584 | R--- | M] () [Auto | Running] -- C:\Program Files (x86)\ASUS\AAHM\1.00.13\aaHMSvc.exe -- (asHmComSvc)
SRV - [2010.11.03 10:30:14 | 000,918,144 | R--- | M] () [Auto | Running] -- C:\Program Files (x86)\ASUS\AXSP\1.00.13\atkexComSvc.exe -- (asComSvc)
SRV - [2010.10.27 15:18:52 | 000,052,896 | ---- | M] (Atheros Commnucations) [Auto | Running] -- C:\Program Files (x86)\Bluetooth Suite\adminservice.exe -- (AtherosSvc)
SRV - [2010.10.21 10:52:26 | 000,586,880 | R--- | M] () [Auto | Running] -- C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.11\AsSysCtrlService.exe -- (AsSysCtrlService)
SRV - [2010.06.30 15:46:32 | 000,121,456 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Common Files\Portrait Displays\Shared\DTSRVC.exe -- (DTSRVC)
SRV - [2010.06.30 15:46:08 | 000,129,648 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Common Files\Portrait Displays\Plugins\AM\dtsslsrv.exe -- (Asset Management Daemon)
SRV - [2010.06.25 18:07:20 | 000,117,264 | ---- | M] (CACE Technologies, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\WinPcap\rpcapd.exe -- (rpcapd) Remote Packet Capture Protocol v.0 (experimental)
SRV - [2010.04.16 14:34:34 | 000,109,168 | ---- | M] (Portrait Displays, Inc.) [Auto | Running] -- C:\Program Files (x86)\Common Files\Portrait Displays\Drivers\pdisrvc.exe -- (PdiService)
SRV - [2010.03.18 12:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010.02.23 10:01:28 | 000,329,168 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Verbindungsassistent\WTGService.exe -- (WTGService)
SRV - [2010.01.15 13:49:20 | 000,227,232 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe -- (McComponentHostService)
SRV - [2009.12.07 12:49:24 | 000,040,960 | ---- | M] (Realtek) [Auto | Running] -- C:\Program Files (x86)\Realtek\RTL8187 Wireless LAN Utility\RtlService.exe -- (Realtek87B)
SRV - [2009.07.13 18:15:38 | 000,093,848 | ---- | M] (SiSoftware) [On_Demand | Stopped] -- d:\Program Files\SiSoftware\SiSoftware Sandra Lite 2011.SP4\RpcAgentSrv.exe -- (SandraAgentSrv)
SRV - [2009.06.10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2009.01.26 15:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) [Auto | Running] -- D:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe -- (SBSDWSCService)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2011.12.06 11:40:33 | 000,230,864 | ---- | M] (TrueCrypt Foundation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\truecrypt.sys -- (truecrypt)
DRV:64bit: - [2011.10.28 19:35:28 | 000,069,376 | ---- | M] (Lavasoft AB) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\Lbd.sys -- (Lbd)
DRV:64bit: - [2011.10.26 04:05:10 | 010,496,512 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag)
DRV:64bit: - [2011.10.26 02:21:58 | 000,326,656 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap)
DRV:64bit: - [2011.10.15 13:16:16 | 000,647,080 | ---- | M] (McAfee, Inc.) [Kernel | Unknown | Running] -- C:\Windows\SysNative\drivers\mfehidk.sys -- (mfehidk)
DRV:64bit: - [2011.10.15 13:16:16 | 000,481,768 | ---- | M] (McAfee, Inc.) [Kernel | Unknown | Running] -- C:\Windows\SysNative\drivers\mfefirek.sys -- (mfefirek)
DRV:64bit: - [2011.10.15 13:16:16 | 000,284,648 | ---- | M] (McAfee, Inc.) [Kernel | Unknown | Running] -- C:\Windows\SysNative\drivers\mfewfpk.sys -- (mfewfpk)
DRV:64bit: - [2011.10.15 13:16:16 | 000,229,528 | ---- | M] (McAfee, Inc.) [Kernel | Unknown | Running] -- C:\Windows\SysNative\drivers\mfeavfk.sys -- (mfeavfk)
DRV:64bit: - [2011.10.15 13:16:16 | 000,160,280 | ---- | M] (McAfee, Inc.) [Kernel | Unknown | Running] -- C:\Windows\SysNative\drivers\mfeapfk.sys -- (mfeapfk)
DRV:64bit: - [2011.10.15 13:16:16 | 000,100,912 | ---- | M] (McAfee, Inc.) [Kernel | Unknown | Stopped] -- C:\Windows\SysNative\drivers\mferkdet.sys -- (mferkdet)
DRV:64bit: - [2011.10.15 13:16:16 | 000,075,808 | ---- | M] (McAfee, Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\mfenlfk.sys -- (mfenlfk)
DRV:64bit: - [2011.10.15 13:16:16 | 000,065,264 | ---- | M] (McAfee, Inc.) [Kernel | Unknown | Running] -- C:\Windows\SysNative\drivers\cfwids.sys -- (cfwids)
DRV:64bit: - [2011.08.31 17:00:50 | 000,025,416 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)
DRV:64bit: - [2011.08.01 14:59:06 | 000,045,416 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\point64.sys -- (Point64)
DRV:64bit: - [2011.07.19 09:39:45 | 000,116,864 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ewusbmdm.sys -- (hwdatacard)
DRV:64bit: - [2011.07.19 09:39:45 | 000,116,224 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ewusbfake.sys -- (hwusbfake)
DRV:64bit: - [2011.07.19 09:39:45 | 000,112,896 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ewsercd.sys -- (ewsercd)
DRV:64bit: - [2011.06.10 06:34:52 | 000,539,240 | ---- | M] (Realtek                                            ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2011.06.06 23:07:00 | 000,231,440 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtihdW76.sys -- (AtiHDAudioService)
DRV:64bit: - [2011.04.26 10:07:36 | 000,557,848 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:64bit: - [2011.03.21 16:44:30 | 000,033,416 | ---- | M] (Locktime Software) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nlndis.sys -- (NLNdisPT)
DRV:64bit: - [2011.03.21 16:44:30 | 000,033,416 | ---- | M] (Locktime Software) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nlndis.sys -- (NLNdisMP)
DRV:64bit: - [2011.03.11 07:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 07:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010.12.10 06:50:36 | 000,181,248 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nusb3xhc.sys -- (nusb3xhc)
DRV:64bit: - [2010.12.10 06:50:36 | 000,080,384 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nusb3hub.sys -- (nusb3hub)
DRV:64bit: - [2010.11.22 08:09:06 | 000,303,408 | ---- | M] (Marvell Semiconductor, Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\mv91xx.sys -- (mv91xx)
DRV:64bit: - [2010.11.21 04:24:33 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.11.21 04:23:48 | 000,032,768 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbser.sys -- (usbser)
DRV:64bit: - [2010.11.21 04:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.21 04:23:47 | 000,031,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD)
DRV:64bit: - [2010.10.27 14:50:28 | 000,301,680 | ---- | M] (Atheros) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btath_a2dp.sys -- (BTATH_A2DP)
DRV:64bit: - [2010.10.27 14:50:28 | 000,279,152 | ---- | M] (Atheros) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btfilter.sys -- (BtFilter)
DRV:64bit: - [2010.10.27 14:50:28 | 000,203,624 | ---- | M] (Atheros) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btath_hcrp.sys -- (BTATH_HCRP)
DRV:64bit: - [2010.10.27 14:50:28 | 000,156,520 | ---- | M] (Atheros) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btath_rcp.sys -- (BTATH_RCP)
DRV:64bit: - [2010.10.27 14:50:28 | 000,058,992 | ---- | M] (Atheros) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btath_lwflt.sys -- (BTATH_LWFLT)
DRV:64bit: - [2010.10.27 14:50:28 | 000,055,336 | ---- | M] (Windows (R) Win 7 DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\AthDfu.sys -- (ATHDFU)
DRV:64bit: - [2010.10.27 14:50:28 | 000,038,248 | ---- | M] (Atheros) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btath_flt.sys -- (AthBTPort)
DRV:64bit: - [2010.10.27 14:50:28 | 000,031,080 | ---- | M] (Atheros) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btath_bus.sys -- (BTATH_BUS)
DRV:64bit: - [2010.10.19 15:34:26 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (MEIx64) Intel(R)
DRV:64bit: - [2010.08.17 18:28:32 | 000,026,136 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ICCWDT.sys -- (ICCWDT) Intel(R) Watchdog Timer Driver (Intel(R) WDT)
DRV:64bit: - [2010.06.25 18:07:26 | 000,035,344 | ---- | M] (CACE Technologies, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\npf.sys -- (NPF)
DRV:64bit: - [2010.04.16 14:34:06 | 000,020,592 | ---- | M] (Portrait Displays, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\PdiPorts.sys -- (PdiPorts)
DRV:64bit: - [2010.01.07 10:20:22 | 000,448,512 | ---- | M] (Realtek Semiconductor Corporation                           ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\rtl8187.sys -- (RTL8187)
DRV:64bit: - [2009.10.01 11:04:54 | 001,307,648 | ---- | M] (C-Media Electronics Inc) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CM10664.sys -- (USBMULCD)
DRV:64bit: - [2009.07.14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.07.14 01:35:32 | 000,012,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\serscan.sys -- (StillCam)
DRV:64bit: - [2009.06.10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2008.08.28 11:44:42 | 000,025,600 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\pccsmcfdx64.sys -- (pccsmcfd)
DRV - [2011.12.03 14:37:48 | 000,017,152 | ---- | M] () [Kernel | On_Demand | Running] -- D:\Program Files (x86)\Lavasoft\Ad-Aware\kernexplorer64.sys -- (Lavasoft Kernexplorer)
DRV - [2011.07.22 09:43:25 | 000,116,224 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\ewusbfake.sys -- (hwusbfake)
DRV - [2011.07.22 09:43:25 | 000,112,896 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\ewsercd.sys -- (ewsercd)
DRV - [2011.03.21 16:44:28 | 000,088,200 | ---- | M] (Locktime Software) [Kernel | System | Running] -- D:\Program Files\NetLimiter 3\nltdi.sys -- (nltdi)
DRV - [2009.08.07 22:46:56 | 000,023,112 | ---- | M] (SiSoftware) [Kernel | On_Demand | Stopped] -- d:\Program Files\SiSoftware\SiSoftware Sandra Lite 2011.SP4\WNt500x64\sandra.sys -- (SANDRA)
DRV - [2009.07.14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
DRV - [2008.12.13 10:28:20 | 000,116,864 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\ewusbmdm.sys -- (hwdatacard)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 5C 38 7E 4F A1 6C CC 01  [binary data]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultengine: "Search-Results"
FF - prefs.js..browser.search.defaultenginename: "Search-Results"
FF - prefs.js..browser.search.order.1: "Search-Results"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "www.google.de"
FF - prefs.js..keyword.URL: "hxxp://websearch.search-results.com/redirect?client=ff&src=kw&tb=STC-SRS&o=41648033&locale=de_DE&apn_uid=27585E9B-37D2-4465-BA12-110E4DBA700F&apn_ptnrs=96&apn_sauid=C6E5D6B3-9E65-46E4-9D52-6E7458A9F170&apn_dtid=YYYYYYYYDE&q="
FF - prefs.js..network.proxy.ftp: "46.249.35.176"
FF - prefs.js..network.proxy.ftp_port: 80
FF - prefs.js..network.proxy.http: "46.249.35.176"
FF - prefs.js..network.proxy.http_port: 80
FF - prefs.js..network.proxy.socks: "46.249.35.176"
FF - prefs.js..network.proxy.socks_port: 80
FF - prefs.js..network.proxy.ssl: "46.249.35.176"
FF - prefs.js..network.proxy.ssl_port: 80
FF - prefs.js..network.proxy.type: 1
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_1_102.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF:64bit: - HKLM\Software\MozillaPlugins\@mcafee.com/MSC,version=10: c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL ()
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@mcafee.com/MSC,version=10: c:\progra~2\mcafee\msc\npmcsn~1.dll ()
FF - HKLM\Software\MozillaPlugins\@mcafee.com/MVT: C:\Program Files (x86)\McAfee\Supportability\MVT\npmvtplugin.dll (McAfee, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Ghost\AppData\Local\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Ghost\AppData\Local\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{D19CA586-DD6C-4a0a-96F8-14644F340D60}: C:\Program Files (x86)\Common Files\McAfee\SystemCore [2011.11.22 20:20:50 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011.12.12 08:16:13 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011.12.09 18:06:36 | 000,000,000 | ---D | M]
 
[2011.12.04 16:10:47 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Ghost\AppData\Roaming\mozilla\Extensions
[2011.12.11 17:27:01 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Ghost\AppData\Roaming\mozilla\Firefox\Profiles\gcl7g18u.default\extensions
[2011.10.24 21:23:31 | 000,000,000 | ---D | M] (Screenshot Pimp) -- C:\Users\Ghost\AppData\Roaming\mozilla\Firefox\Profiles\gcl7g18u.default\extensions\{056d0610-e44d-11df-bccf-0800200c9a66}
[2011.11.25 22:43:52 | 000,000,000 | ---D | M] (Flagfox) -- C:\Users\Ghost\AppData\Roaming\mozilla\Firefox\Profiles\gcl7g18u.default\extensions\{1018e4d6-728f-4b20-ad56-37578a4de76b}
[2011.12.08 23:04:46 | 000,000,000 | ---D | M] (Personas Rotator) -- C:\Users\Ghost\AppData\Roaming\mozilla\Firefox\Profiles\gcl7g18u.default\extensions\{6e73f6b7-b9ab-44b8-b744-6393e3c2e351}
[2011.11.19 09:42:32 | 000,000,000 | ---D | M] (WOT) -- C:\Users\Ghost\AppData\Roaming\mozilla\Firefox\Profiles\gcl7g18u.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2011.11.20 15:41:38 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\Ghost\AppData\Roaming\mozilla\Firefox\Profiles\gcl7g18u.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2011.12.03 20:48:36 | 000,000,000 | ---D | M] (BitDefender QuickScan) -- C:\Users\Ghost\AppData\Roaming\mozilla\Firefox\Profiles\gcl7g18u.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}
[2011.11.05 12:53:06 | 000,000,000 | ---D | M] (Ghostery) -- C:\Users\Ghost\AppData\Roaming\mozilla\Firefox\Profiles\gcl7g18u.default\extensions\firefox@ghostery.com
[2011.11.26 22:22:36 | 000,000,000 | ---D | M] (Low Quality Flash) -- C:\Users\Ghost\AppData\Roaming\mozilla\Firefox\Profiles\gcl7g18u.default\extensions\low_quality_flash@pie2k.com
[2011.12.07 22:55:27 | 000,000,000 | ---D | M] (samfind Bookmarks Bar) -- C:\Users\Ghost\AppData\Roaming\mozilla\Firefox\Profiles\gcl7g18u.default\extensions\sam@samfind.com
[2011.07.27 14:46:02 | 000,000,000 | ---D | M] (startup.service) -- C:\Users\Ghost\AppData\Roaming\mozilla\Firefox\Profiles\gcl7g18u.default\extensions\startup.service@mozilla.com
[2011.12.12 08:16:13 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2011.11.13 18:37:08 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files (x86)\mozilla firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2011.10.06 15:38:28 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA}
[2011.12.09 17:46:22 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA}
[2011.11.22 20:20:50 | 000,000,000 | ---D | M] (McAfee ScriptScan for Firefox) -- C:\PROGRAM FILES (X86)\COMMON FILES\MCAFEE\SYSTEMCORE
() (No name found) -- C:\USERS\GHOST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GCL7G18U.DEFAULT\EXTENSIONS\{1280606B-2510-4FE0-97EF-9B5A22EAFE30}.XPI
() (No name found) -- C:\USERS\GHOST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GCL7G18U.DEFAULT\EXTENSIONS\{1A2D0EC4-75F5-4C91-89C4-3656F6E44B68}.XPI
() (No name found) -- C:\USERS\GHOST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GCL7G18U.DEFAULT\EXTENSIONS\{37E4D8EA-8BDA-4831-8EA1-89053939A250}.XPI
() (No name found) -- C:\USERS\GHOST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GCL7G18U.DEFAULT\EXTENSIONS\{3D7EB24F-2740-49DF-8937-200B1CC08F8A}.XPI
() (No name found) -- C:\USERS\GHOST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GCL7G18U.DEFAULT\EXTENSIONS\{477C4C36-24EB-11DA-94D4-00E08161165F}.XPI
() (No name found) -- C:\USERS\GHOST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GCL7G18U.DEFAULT\EXTENSIONS\{7C9AE782-DB21-4E40-81FB-AD8A53A6233A}.XPI
() (No name found) -- C:\USERS\GHOST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GCL7G18U.DEFAULT\EXTENSIONS\{CE6E6E3B-84DD-4CAC-9F63-8D2AE4F30A4B}.XPI
() (No name found) -- C:\USERS\GHOST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GCL7G18U.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
() (No name found) -- C:\USERS\GHOST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GCL7G18U.DEFAULT\EXTENSIONS\{D40F5E7B-D2CF-4856-B441-CC613EEFFBE3}.XPI
() (No name found) -- C:\USERS\GHOST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GCL7G18U.DEFAULT\EXTENSIONS\{D4DD63FA-01E4-46A7-B6B1-EDAB7D6AD389}.XPI
() (No name found) -- C:\USERS\GHOST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GCL7G18U.DEFAULT\EXTENSIONS\{DDC359D1-844A-42A7-9AA1-88A850A938A8}.XPI
() (No name found) -- C:\USERS\GHOST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GCL7G18U.DEFAULT\EXTENSIONS\{E10A6337-382E-4FE6-96DE-936ADC34DD04}.XPI
() (No name found) -- C:\USERS\GHOST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GCL7G18U.DEFAULT\EXTENSIONS\ADBLOCKPOPUPS@JESSEHAKANEN.NET.XPI
() (No name found) -- C:\USERS\GHOST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GCL7G18U.DEFAULT\EXTENSIONS\ADDON@MUSIC-CLIPS.NET.XPI
() (No name found) -- C:\USERS\GHOST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GCL7G18U.DEFAULT\EXTENSIONS\ADONIS.CUHK@GMAIL.COM.XPI
() (No name found) -- C:\USERS\GHOST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GCL7G18U.DEFAULT\EXTENSIONS\ANTICONTAINER@DOWNTHEMALL.NET.XPI
() (No name found) -- C:\USERS\GHOST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GCL7G18U.DEFAULT\EXTENSIONS\AUTOPAGER@MOZILLA.ORG.XPI
() (No name found) -- C:\USERS\GHOST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GCL7G18U.DEFAULT\EXTENSIONS\INFO@CONVERT2MP3.NET.XPI
() (No name found) -- C:\USERS\GHOST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GCL7G18U.DEFAULT\EXTENSIONS\INFO@YOUTUBE-MP3.ORG.XPI
() (No name found) -- C:\USERS\GHOST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GCL7G18U.DEFAULT\EXTENSIONS\PERSONAS@CHRISTOPHER.BEARD.XPI
[2011.11.21 05:21:43 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2011.04.14 13:01:38 | 000,024,376 | ---- | M] (McAfee, Inc.) -- C:\Program Files (x86)\mozilla firefox\components\Scriptff.dll
[2011.12.09 17:46:17 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2011.07.11 22:48:12 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npwachk.dll
[2011.11.21 02:17:49 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011.11.21 02:09:48 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2011.11.21 02:17:49 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2011.11.21 02:17:49 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2011.09.11 11:28:14 | 000,002,503 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\SearchResults.xml
[2011.11.21 02:17:49 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2011.11.21 02:17:49 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Ghost\AppData\Local\Google\Chrome\Application\15.0.874.121\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
CHR - plugin: Java Deployment Toolkit 6.0.290.11 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java(TM) Platform SE 6 U29 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrl.dll
CHR - plugin: Microsoft\u00AE Windows Media Player Firefox Plugin (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\np-mswmp.dll
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\Ghost\AppData\Local\Google\Chrome\Application\15.0.874.121\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Disabled) = C:\Users\Ghost\AppData\Local\Google\Chrome\Application\15.0.874.121\pdf.dll
CHR - plugin: BitDefender QuickScan (Enabled) = C:\Users\Ghost\AppData\Local\Google\Chrome\User Data\Default\Extensions\pdnkcidphdcakpkheohlhocaicfamjie\0.9.9.100_0\npqscan.dll
CHR - plugin: Winamp Application Detector (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npwachk.dll
CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll
CHR - plugin: McAfee Virtual Technician (Enabled) = C:\Program Files (x86)\McAfee\Supportability\MVT\npmvtplugin.dll
CHR - plugin: McAfee SecurityCenter (Enabled) = c:\progra~2\mcafee\msc\npmcsn~1.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
CHR - Extension: WOT = C:\Users\Ghost\AppData\Local\Google\Chrome\User Data\Default\Extensions\bhmmomiinigofkjcapegjjndpbikblnp\1.2.9_0\
CHR - Extension: BitDefender QuickScan = C:\Users\Ghost\AppData\Local\Google\Chrome\User Data\Default\Extensions\pdnkcidphdcakpkheohlhocaicfamjie\0.9.9.100_0\
 
O1 HOSTS File: ([2009.06.10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (no name) - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - No CLSID value found.
O2:64bit: - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2:64bit: - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Programme\Common Files\McAfee\SystemCore\ScriptSn.20111122201814.dll (McAfee, Inc.)
O2:64bit: - BHO: (no name) - {9D717F81-9148-4f12-8568-69135F087DB0} - No CLSID value found.
O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (AC-Pro) - {0FB6A909-6086-458F-BD92-1F8EE10042A0} - C:\Program Files (x86)\AutocompletePro\AutocompletePro.dll (SimplyGen)
O2 - BHO: (McAfee Phishing Filter) - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\Programme\McAfee\MSK\mskapbho.dll ()
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~3\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files (x86)\Common Files\McAfee\SystemCore\ScriptSn.20111122201814.dll (McAfee, Inc.)
O2 - BHO: (CIESpeechBHO Class) - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations)
O2 - BHO: (no name) - {9D717F81-9148-4f12-8568-69135F087DB0} - No CLSID value found.
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~3\Office14\URLREDIR.DLL (Microsoft Corporation)
O3:64bit: - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {99079a25-328f-4bd4-be04-00955acaa0a7} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O4:64bit: - HKLM..\Run: [Cm106Sound] C:\Windows\Syswow64\cm106.dll (C-Media Corporation)
O4:64bit: - HKLM..\Run: [IntelliPoint] C:\Program Files\Microsoft IntelliPoint\ipoint.exe (Microsoft Corporation)
O4 - HKLM..\Run: [ASUS ShellProcess Execute] C:\Program Files (x86)\ASUS\AI Suite II\ASUS Mobilink\Simulator\AsShellProcess.exe (ASUSTeK Computer Inc.)
O4 - HKLM..\Run: [DT ACR] C:\Program Files (x86)\Common Files\Portrait Displays\Shared\DT_startup.exe ()
O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
O4 - HKLM..\Run: [mcui_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
O4 - HKLM..\Run: [NUSB3MON] C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (Renesas Electronics Corporation)
O4 - HKLM..\Run: [PivotSoftware] C:\Program Files (x86)\Portrait Displays\Pivot Pro Plugin\Pivot_startup.exe ()
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKCU..\Run: [ccleaner] C:\Program Files\CCleaner\CCleaner64.exe (Piriform Ltd)
O4 - HKCU..\Run: [NetLimiter] D:\Program Files\NetLimiter 3\NLClientApp.exe (Locktime Software)
O4 - HKCU..\Run: [SpybotSD TeaTimer] d:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8:64bit: - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~3\Office14\ONBttnIE.dll/105 File not found
O8:64bit: - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~3\Office14\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~3\Office14\ONBttnIE.dll/105 File not found
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~3\Office14\EXCEL.EXE/3000 File not found
O9:64bit: - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9:64bit: - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9:64bit: - Extra 'Tools' menuitem : Send by Bluetooth to - {7815BE26-237D-41A8-A98F-F7BD75F71086} - Reg Error: Value error. File not found
O9:64bit: - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9:64bit: - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Send by Bluetooth to - {7815BE26-237D-41A8-A98F-F7BD75F71086} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: internet ([]about in Trusted sites)
O15 - HKCU\..Trusted Domains: mcafee.com ([]http in Trusted sites)
O15 - HKCU\..Trusted Domains: mcafee.com ([]https in Trusted sites)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{6C802738-AE9D-4E6D-A478-99D6D0B66991}: DhcpNameServer = 192.168.2.1
O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\0x00000001 - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\oledb - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18:64bit: - Protocol\Filter\application/x-mfe-ipt {3EF5086B-5478-4598-A054-786C45D75692} - c:\Programme\McAfee\MSC\McSnIePl64.dll (McAfee, Inc.)
O18:64bit: - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)
O18 - Protocol\Filter\application/x-mfe-ipt {3EF5086B-5478-4598-A054-786C45D75692} - c:\progra~2\mcafee\msc\mcsniepl.dll (McAfee, Inc.)
O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\WIA6EB~1\Datamngr\x64\datamngr.dll) -  File not found
O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\WIA6EB~1\Datamngr\x64\IEBHO.dll) -  File not found
O20 - AppInit_DLLs: (C:\PROGRA~2\WIA6EB~1\Datamngr\datamngr.dll) - File not found
O20 - AppInit_DLLs: (C:\PROGRA~2\WIA6EB~1\Datamngr\IEBHO.dll) - File not found
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) -C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: GinaDLL - (C:\Windows\SYSTEM32\RtlGina\RtlGina.DLL) - File not found
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O28:64bit: - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MICROS~3\Office14\GROOVEEX.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.02.09 14:59:36 | 000,000,000 | RH-D | M] - G:\autorun -- [ FAT32 ]
O32 - AutoRun File - [2002.10.17 09:56:50 | 000,000,036 | RH-- | M] () - G:\Autorun.inf.bak -- [ FAT32 ]
O33 - MountPoints2\{80b033ea-b1e1-11e0-909f-f46d049c99d9}\Shell - "" = AutoRun
O33 - MountPoints2\{80b033ea-b1e1-11e0-909f-f46d049c99d9}\Shell\AutoRun\command - "" = H:\.\Autorun.exe AUTORUN=1
O33 - MountPoints2\{fb99ba64-b1d1-11e0-9f0c-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{fb99ba64-b1d1-11e0-9f0c-806e6f6e6963}\Shell\AutoRun\command - "" = F:\.\Bin\ASSETUP.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (lsdelete)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
ActiveX:64bit: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework
ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Webordner
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
 
MsConfig:64bit - StartUpFolder: C:^Users^Ghost^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.3.lnk - D:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe - ()
MsConfig:64bit - StartUpFolder: C:^Users^Ghost^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^WISO Mein Steuer-Sparbuch heute.lnk - C:\PROGRA~2\WISO\STEUER~1\MSHAKT~1.EXE - ()
MsConfig:64bit - StartUpReg: *D7 - hkey= - key= - C:\Windows\SysNative\cmd.exe (Microsoft Corporation)
MsConfig:64bit - StartUpReg: AthBtTray - hkey= - key= - C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe (Atheros Commnucations)
MsConfig:64bit - StartUpReg: AtherosBtStack - hkey= - key= - C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe (Atheros Communications)
MsConfig:64bit - StartUpReg: BCSSync - hkey= - key= - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe (Microsoft Corporation)
MsConfig:64bit - StartUpReg: d: - hkey= - key= - Reg Error: Value error. File not found
MsConfig:64bit - StartUpReg: Google Update - hkey= - key= - C:\Users\Ghost\AppData\Local\Google\Update\GoogleUpdate.exe (Google Inc.)
MsConfig:64bit - StartUpReg: HP Software Update - hkey= - key= - C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe (Hewlett-Packard)
MsConfig:64bit - StartUpReg: Malwarebytes' Anti-Malware - hkey= - key= - d:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
MsConfig:64bit - StartUpReg: OfficeSyncProcess - hkey= - key= - C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE (Microsoft Corporation)
MsConfig:64bit - StartUpReg: RtHDVCpl - hkey= - key= - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
MsConfig:64bit - StartUpReg: StartCCC - hkey= - key= - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
MsConfig:64bit - StartUpReg: Steam - hkey= - key= - C:\Program Files (x86)\Steam\Steam.exe (Valve Corporation)
MsConfig:64bit - StartUpReg: WinampAgent - hkey= - key= - D:\Program Files (x86)\Winamp\winampa.exe (Nullsoft, Inc.)
MsConfig:64bit - State: "services" - Reg Error: Key error.
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.12.12 20:51:50 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\Ghost\Desktop\OTL.exe
[2011.12.12 20:07:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee
[2011.12.12 07:34:21 | 000,000,000 | ---D | C] -- C:\Users\Ghost\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HiJackThis
[2011.12.12 07:33:32 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Trend Micro
[2011.12.11 21:54:10 | 000,000,000 | ---D | C] -- C:\Program Files\HashTab Shell Extension
[2011.12.10 20:45:16 | 000,000,000 | ---D | C] -- C:\Users\Ghost\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\EVEMon
[2011.12.10 12:43:56 | 000,000,000 | ---D | C] -- C:\ProgramData\ATI
[2011.12.10 12:36:53 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AMD APP
[2011.12.10 12:36:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Catalyst Control Center
[2011.12.10 12:25:54 | 000,000,000 | ---D | C] -- C:\ATI
[2011.12.10 12:10:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TweakNow PowerPack 2011
[2011.12.10 12:08:43 | 000,000,000 | ---D | C] -- C:\Users\Ghost\AppData\Roaming\TweakNow PowerPack 2011
[2011.12.09 21:39:31 | 000,000,000 | ---D | C] -- C:\Users\Ghost\AppData\Local\Locktime
[2011.12.09 21:36:46 | 000,000,000 | ---D | C] -- C:\Users\Ghost\AppData\Roaming\Wireshark
[2011.12.09 21:24:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinPcap
[2011.12.09 21:24:02 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\WinPcap
[2011.12.09 21:12:34 | 000,000,000 | ---D | C] -- C:\Users\Ghost\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\NetLimiter 3
[2011.12.09 21:10:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Locktime
[2011.12.09 18:06:27 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Adobe
[2011.12.09 18:06:27 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Adobe
[2011.12.09 17:46:26 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java
[2011.12.09 16:56:48 | 000,000,000 | ---D | C] -- C:\Program Files\Java
[2011.12.07 19:27:15 | 000,000,000 | ---D | C] -- C:\Users\Ghost\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Audials USB 8
[2011.12.07 18:51:02 | 000,000,000 | ---D | C] -- C:\Users\Ghost\AppData\Local\CrashRpt
[2011.12.07 18:50:58 | 000,000,000 | ---D | C] -- C:\Users\Ghost\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Audials USB 9
[2011.12.07 18:36:54 | 000,000,000 | ---D | C] -- C:\Users\Ghost\AppData\Local\RapidSolution
[2011.12.06 11:41:11 | 000,000,000 | ---D | C] -- C:\Users\Ghost\AppData\Roaming\TrueCrypt
[2011.12.06 11:40:33 | 000,230,864 | ---- | C] (TrueCrypt Foundation) -- C:\Windows\SysNative\drivers\truecrypt.sys
[2011.12.06 11:40:24 | 000,000,000 | ---D | C] -- C:\Program Files\TrueCrypt
[2011.12.04 16:22:25 | 000,000,000 | ---D | C] -- C:\Users\Ghost\AppData\Roaming\Malwarebytes
[2011.12.04 16:21:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2011.12.04 16:21:00 | 000,025,416 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2011.12.04 12:21:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy
[2011.12.03 23:40:19 | 000,000,000 | ---D | C] -- C:\Users\Ghost\AppData\Roaming\QuickScan
[2011.12.03 23:32:40 | 000,000,000 | ---D | C] -- C:\Users\Ghost\AppData\Roaming\Opera
[2011.12.03 23:32:40 | 000,000,000 | ---D | C] -- C:\Users\Ghost\AppData\Local\Opera
[2011.12.03 23:32:29 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Opera
[2011.12.03 15:06:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Safer Networking
[2011.12.03 14:37:48 | 000,055,384 | ---- | C] (Sunbelt Software) -- C:\Windows\SysNative\drivers\SBREDrv.sys
[2011.12.03 14:36:18 | 000,069,376 | ---- | C] (Lavasoft AB) -- C:\Windows\SysNative\drivers\Lbd.sys
[2011.12.03 14:35:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Lavasoft
[2011.11.30 19:13:46 | 000,000,000 | ---D | C] -- C:\Users\Ghost\Documents\EVEMon_3264_2011-11-30
[2011.11.27 20:49:26 | 000,000,000 | ---D | C] -- C:\Users\Ghost\AppData\Roaming\NetSpeedMonitor
[2011.11.27 20:32:05 | 000,000,000 | ---D | C] -- C:\Users\Ghost\AppData\Roaming\NetMeter
[2011.11.27 20:31:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NetMeter
[2011.11.22 18:20:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth
[2011.11.20 15:44:25 | 000,000,000 | ---D | C] -- C:\Users\Ghost\dwhelper
[2011.11.18 18:31:31 | 000,000,000 | ---D | C] -- C:\Windows\pss
[2011.11.18 18:12:37 | 000,000,000 | ---D | C] -- C:\Users\Ghost\AppData\Roaming\TeamViewer
[2011.11.18 18:11:38 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\TeamViewer
[2011.11.18 16:44:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
[2011.11.18 16:44:38 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2011.11.18 16:39:54 | 000,131,072 | ---- | C] (FoolishIT.com) -- C:\Windows\goog.exe
[2011.11.18 16:22:55 | 000,000,000 | ---D | C] -- C:\Users\Ghost\AppData\Roaming\Booster
[2011.07.19 15:18:48 | 001,802,976 | ---- | C] (CCP hf.) -- C:\Program Files (x86)\EVE_Premium_Setup_246350.exe
[2011.07.19 15:13:16 | 003,504,060 | ---- | C] (battleclinic.com) -- C:\Program Files (x86)\EVEMon-install-1.3.4.2523.exe
 
========== Files - Modified Within 30 Days ==========
 
[2011.12.12 21:04:00 | 000,001,120 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2438057823-3161982914-410875986-1000UA.job
[2011.12.12 20:19:00 | 000,001,108 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011.12.12 20:19:00 | 000,001,104 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011.12.12 20:11:05 | 000,021,664 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011.12.12 20:11:05 | 000,021,664 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011.12.12 20:09:18 | 001,621,744 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2011.12.12 20:09:18 | 000,700,278 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2011.12.12 20:09:18 | 000,654,990 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2011.12.12 20:09:18 | 000,149,074 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2011.12.12 20:09:18 | 000,121,862 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2011.12.12 20:03:52 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011.12.12 20:03:51 | 2129,297,407 | -HS- | M] () -- C:\hiberfil.sys
[2011.12.12 19:34:38 | 000,437,312 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2011.12.12 19:06:54 | 000,000,000 | ---- | M] () -- C:\Users\Ghost\defogger_reenable
[2011.12.12 19:04:00 | 000,001,068 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2438057823-3161982914-410875986-1000Core.job
[2011.12.12 16:47:13 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Ghost\Desktop\OTL.exe
[2011.12.12 08:16:13 | 000,001,138 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2011.12.12 07:53:34 | 000,003,288 | ---- | M] () -- C:\bootsqm.dat
[2011.12.12 07:34:21 | 000,002,975 | ---- | M] () -- C:\Users\Ghost\Desktop\HiJackThis.lnk
[2011.12.11 17:00:08 | 000,000,440 | ---- | M] () -- C:\Windows\tasks\vtscheduletask.job
[2011.12.10 22:45:08 | 000,000,353 | ---- | M] () -- C:\Users\Ghost\AppData\Roaming\Network Meter_Settings.ini
[2011.12.10 21:30:05 | 000,071,786 | ---- | M] () -- C:\Users\Ghost\Documents\EVEMon_Settings_3290.xml.bak
[2011.12.10 20:45:11 | 000,071,849 | ---- | M] () -- C:\Users\Ghost\Documents\EVEMon_Settings_3289.xml.bak
[2011.12.10 14:38:58 | 000,000,064 | ---- | M] () -- C:\Windows\SysWow64\rp_stats.dat
[2011.12.10 14:38:58 | 000,000,044 | ---- | M] () -- C:\Windows\SysWow64\rp_rules.dat
[2011.12.10 12:10:45 | 000,000,912 | ---- | M] () -- C:\Users\Public\Desktop\TweakNow PowerPack 2011.lnk
[2011.12.10 12:04:02 | 000,011,296 | ---- | M] () -- C:\Users\Ghost\Documents\cc_20111210_120359.reg
[2011.12.10 11:17:44 | 000,001,476 | ---- | M] () -- C:\Users\Ghost\Desktop\AudialsOne 8 USB starten.lnk
[2011.12.10 10:46:48 | 000,000,000 | ---- | M] () -- C:\Windows\Path.idx
[2011.12.10 10:45:16 | 001,025,648 | ---- | M] () -- C:\Windows\PE_Rom.dll
[2011.12.10 10:33:07 | 000,000,128 | ---- | M] () -- C:\Users\Ghost\AppData\Roaming\Sandra.ldb
[2011.12.09 21:36:46 | 000,000,218 | ---- | M] () -- C:\Users\Ghost\.recently-used.xbel
[2011.12.09 21:31:04 | 000,000,164 | ---- | M] () -- C:\Users\Ghost\Documents\Whiresark_00001_20111209213058
[2011.12.09 21:30:50 | 000,000,033 | ---- | M] () -- C:\Users\Ghost\.gtk-bookmarks
[2011.12.09 18:06:36 | 000,002,019 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader X.lnk
[2011.12.09 17:34:10 | 000,000,035 | ---- | M] () -- C:\Users\Public\Documents\AtherosServiceConfig.ini
[2011.12.09 16:58:44 | 000,002,183 | ---- | M] () -- C:\Users\Ghost\Documents\Antwort auf Chip.com
[2011.12.07 18:50:59 | 000,001,476 | ---- | M] () -- C:\Users\Ghost\Desktop\AudialsOne 9 USB starten.lnk
[2011.12.06 11:40:33 | 000,230,864 | ---- | M] (TrueCrypt Foundation) -- C:\Windows\SysNative\drivers\truecrypt.sys
[2011.12.06 11:40:33 | 000,000,875 | ---- | M] () -- C:\Users\Ghost\Desktop\TrueCrypt.lnk
[2011.12.04 16:22:04 | 000,000,786 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.12.04 12:22:53 | 000,000,929 | ---- | M] () -- C:\Users\Ghost\Desktop\Spybot - Search & Destroy.lnk
[2011.12.04 11:08:20 | 000,039,344 | ---- | M] () -- C:\Users\Ghost\Documents\cc_20111204_110817.reg
[2011.12.03 23:32:35 | 000,001,829 | ---- | M] () -- C:\Users\Public\Desktop\Opera.lnk
[2011.12.03 23:30:40 | 000,881,077 | ---- | M] () -- C:\Users\Ghost\AppData\Local\census.cache
[2011.12.03 23:30:18 | 000,140,117 | ---- | M] () -- C:\Users\Ghost\AppData\Local\ars.cache
[2011.12.03 23:10:30 | 000,000,036 | ---- | M] () -- C:\Users\Ghost\AppData\Local\housecall.guid.cache
[2011.12.03 14:37:31 | 000,016,432 | ---- | M] () -- C:\Windows\SysNative\lsdelete.exe
[2011.12.03 14:37:27 | 000,055,384 | ---- | M] (Sunbelt Software) -- C:\Windows\SysNative\drivers\SBREDrv.sys
[2011.12.03 14:36:19 | 000,000,819 | ---- | M] () -- C:\Users\Public\Desktop\Ad-Aware.lnk
[2011.11.27 21:06:08 | 000,001,308 | ---- | M] () -- C:\Users\Ghost\Desktop\Tcpview - Verknüpfung.lnk
[2011.11.27 20:42:23 | 000,000,648 | ---- | M] () -- C:\Users\Public\Desktop\NetMeter.lnk
[2011.11.27 12:18:20 | 000,001,591 | ---- | M] () -- C:\Users\Ghost\Desktop\eve - Testserver.lnk
[2011.11.26 22:35:09 | 000,341,193 | ---- | M] () -- C:\Users\Ghost\Eve_PI_Diagrams_v1_4.pdf
[2011.11.26 20:58:22 | 000,005,168 | ---- | M] () -- C:\Users\Ghost\Documents\cc_20111126_205818.reg
[2011.11.25 20:32:10 | 000,121,331 | ---- | M] () -- C:\Users\Ghost\Anomalien_Eve.pdf
[2011.11.22 18:20:37 | 000,002,212 | ---- | M] () -- C:\Users\Public\Desktop\Google Earth.lnk
[2011.11.19 11:10:05 | 000,000,744 | ---- | M] () -- C:\Users\Ghost\Documents\Der ist es jetzt aber.trs
[2011.11.19 09:41:20 | 000,009,202 | ---- | M] () -- C:\Users\Ghost\Documents\cc_20111119_094117.reg
[2011.11.18 18:12:16 | 000,001,162 | ---- | M] () -- C:\Users\Public\Desktop\TeamViewer 6.lnk
[2011.11.18 17:51:22 | 000,000,942 | ---- | M] () -- C:\Windows\wiso.ini
[2011.11.18 17:15:33 | 000,100,352 | ---- | M] () -- C:\Users\Ghost\Documents\cc_20111118_171527.reg
[2011.11.18 16:44:41 | 000,000,822 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2011.11.18 16:39:41 | 000,131,072 | ---- | M] (FoolishIT.com) -- C:\Windows\goog.exe
[2011.11.18 16:39:20 | 000,024,576 | ---- | M] () -- C:\Windows\SysNative\FoolishEventLogMsgHelper.dll
 
========== Files Created - No Company Name ==========
 
[2011.12.12 19:34:33 | 000,437,312 | ---- | C] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2011.12.12 19:06:54 | 000,000,000 | ---- | C] () -- C:\Users\Ghost\defogger_reenable
[2011.12.12 11:27:21 | 001,624,553 | ---- | C] () -- C:\img35.jpg
[2011.12.12 08:16:13 | 000,001,150 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2011.12.12 08:16:13 | 000,001,138 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2011.12.12 07:53:34 | 000,003,288 | ---- | C] () -- C:\bootsqm.dat
[2011.12.12 07:34:21 | 000,002,975 | ---- | C] () -- C:\Users\Ghost\Desktop\HiJackThis.lnk
[2011.12.10 21:30:36 | 000,071,786 | ---- | C] () -- C:\Users\Ghost\Documents\EVEMon_Settings_3290.xml.bak
[2011.12.10 21:27:40 | 000,071,849 | ---- | C] () -- C:\Users\Ghost\Documents\EVEMon_Settings_3289.xml.bak
[2011.12.10 12:10:45 | 000,000,912 | ---- | C] () -- C:\Users\Public\Desktop\TweakNow PowerPack 2011.lnk
[2011.12.10 12:04:01 | 000,011,296 | ---- | C] () -- C:\Users\Ghost\Documents\cc_20111210_120359.reg
[2011.12.10 10:46:48 | 000,000,000 | ---- | C] () -- C:\Windows\Path.idx
[2011.12.10 10:33:05 | 000,000,128 | ---- | C] () -- C:\Users\Ghost\AppData\Roaming\Sandra.ldb
[2011.12.09 21:36:46 | 000,000,218 | ---- | C] () -- C:\Users\Ghost\.recently-used.xbel
[2011.12.09 21:30:58 | 000,000,164 | ---- | C] () -- C:\Users\Ghost\Documents\Whiresark_00001_20111209213058
[2011.12.09 21:30:50 | 000,000,033 | ---- | C] () -- C:\Users\Ghost\.gtk-bookmarks
[2011.12.09 21:23:05 | 000,000,679 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wireshark.lnk
[2011.12.09 20:38:27 | 000,016,432 | ---- | C] () -- C:\Windows\SysNative\lsdelete.exe
[2011.12.09 18:06:36 | 000,002,441 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
[2011.12.09 18:06:36 | 000,002,019 | ---- | C] () -- C:\Users\Public\Desktop\Adobe Reader X.lnk
[2011.12.09 17:03:33 | 000,000,064 | ---- | C] () -- C:\Windows\SysWow64\rp_stats.dat
[2011.12.09 17:03:33 | 000,000,044 | ---- | C] () -- C:\Windows\SysWow64\rp_rules.dat
[2011.12.09 16:23:14 | 000,002,183 | ---- | C] () -- C:\Users\Ghost\Documents\Antwort auf Chip.com
[2011.12.07 19:27:16 | 000,001,476 | ---- | C] () -- C:\Users\Ghost\Desktop\AudialsOne 8 USB starten.lnk
[2011.12.07 18:50:59 | 000,001,476 | ---- | C] () -- C:\Users\Ghost\Desktop\AudialsOne 9 USB starten.lnk
[2011.12.06 11:40:33 | 000,000,875 | ---- | C] () -- C:\Users\Ghost\Desktop\TrueCrypt.lnk
[2011.12.04 16:22:04 | 000,000,786 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.12.04 12:22:53 | 000,000,929 | ---- | C] () -- C:\Users\Ghost\Desktop\Spybot - Search & Destroy.lnk
[2011.12.04 11:08:18 | 000,039,344 | ---- | C] () -- C:\Users\Ghost\Documents\cc_20111204_110817.reg
[2011.12.03 23:32:35 | 000,001,841 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera.lnk
[2011.12.03 23:32:35 | 000,001,829 | ---- | C] () -- C:\Users\Public\Desktop\Opera.lnk
[2011.12.03 23:30:40 | 000,881,077 | ---- | C] () -- C:\Users\Ghost\AppData\Local\census.cache
[2011.12.03 23:30:18 | 000,140,117 | ---- | C] () -- C:\Users\Ghost\AppData\Local\ars.cache
[2011.12.03 23:10:30 | 000,000,036 | ---- | C] () -- C:\Users\Ghost\AppData\Local\housecall.guid.cache
[2011.12.03 14:36:19 | 000,000,819 | ---- | C] () -- C:\Users\Public\Desktop\Ad-Aware.lnk
[2011.11.27 21:06:30 | 000,001,308 | ---- | C] () -- C:\Users\Ghost\Desktop\Tcpview - Verknüpfung.lnk
[2011.11.27 20:42:23 | 000,000,648 | ---- | C] () -- C:\Users\Public\Desktop\NetMeter.lnk
[2011.11.27 12:17:13 | 000,001,591 | ---- | C] () -- C:\Users\Ghost\Desktop\eve - Testserver.lnk
[2011.11.26 22:35:09 | 000,341,193 | ---- | C] () -- C:\Users\Ghost\Eve_PI_Diagrams_v1_4.pdf
[2011.11.26 20:58:20 | 000,005,168 | ---- | C] () -- C:\Users\Ghost\Documents\cc_20111126_205818.reg
[2011.11.25 20:32:51 | 000,121,331 | ---- | C] () -- C:\Users\Ghost\Anomalien_Eve.pdf
[2011.11.22 18:20:37 | 000,002,212 | ---- | C] () -- C:\Users\Public\Desktop\Google Earth.lnk
[2011.11.19 09:41:18 | 000,009,202 | ---- | C] () -- C:\Users\Ghost\Documents\cc_20111119_094117.reg
[2011.11.18 18:12:16 | 000,001,174 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 6.lnk
[2011.11.18 18:12:16 | 000,001,162 | ---- | C] () -- C:\Users\Public\Desktop\TeamViewer 6.lnk
[2011.11.18 17:15:30 | 000,100,352 | ---- | C] () -- C:\Users\Ghost\Documents\cc_20111118_171527.reg
[2011.11.18 16:44:41 | 000,000,822 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2011.11.18 16:39:20 | 000,024,576 | ---- | C] () -- C:\Windows\SysNative\FoolishEventLogMsgHelper.dll
[2011.10.26 02:38:38 | 000,204,952 | ---- | C] () -- C:\Windows\SysWow64\ativvsvl.dat
[2011.10.26 02:38:38 | 000,157,144 | ---- | C] () -- C:\Windows\SysWow64\ativvsva.dat
[2011.10.25 21:21:48 | 000,056,832 | ---- | C] () -- C:\Windows\SysWow64\OpenVideo.dll
[2011.10.25 21:21:34 | 000,056,832 | ---- | C] () -- C:\Windows\SysWow64\OVDecoder.dll
[2011.09.16 21:27:56 | 000,000,275 | ---- | C] () -- C:\Users\Ghost\AppData\Local\HamsterVideoConverterSettings.cfg
[2011.09.12 23:06:16 | 000,003,917 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat
[2011.08.08 18:53:05 | 001,598,638 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2011.07.28 18:22:32 | 000,000,412 | ---- | C] () -- C:\Users\Ghost\AppData\Roaming\All CPU Meter_Settings.ini
[2011.07.28 17:42:14 | 000,000,353 | ---- | C] () -- C:\Users\Ghost\AppData\Roaming\Network Meter_Settings.ini
[2011.07.28 12:19:46 | 001,025,648 | ---- | C] () -- C:\Windows\PE_Rom.dll
[2011.07.28 12:10:12 | 000,094,208 | ---- | C] () -- C:\Windows\SysWow64\IccLibDll.dll
[2011.07.28 12:07:32 | 000,030,436 | ---- | C] () -- C:\Windows\Ascd_log.ini
[2011.07.28 12:07:12 | 000,013,440 | R--- | C] () -- C:\Windows\SysWow64\drivers\AsIO.sys
[2011.07.28 12:07:11 | 000,011,832 | ---- | C] () -- C:\Windows\SysWow64\drivers\AsInsHelp64.sys
[2011.07.23 20:25:01 | 000,143,360 | ---- | C] () -- C:\Windows\Vmix106.dll
[2011.07.23 20:24:45 | 000,000,604 | ---- | C] () -- C:\Windows\Cm106.ini.cfl
[2011.07.23 20:20:05 | 000,003,059 | ---- | C] () -- C:\Windows\Cm106.ini.cfg
[2011.07.23 20:20:05 | 000,001,085 | ---- | C] () -- C:\Windows\Cm106.ini.imi
[2011.07.22 13:31:56 | 000,000,942 | ---- | C] () -- C:\Windows\wiso.ini
[2011.07.20 20:40:34 | 000,000,400 | ---- | C] () -- C:\Windows\ODBC.INI
[2011.07.19 21:25:56 | 000,005,120 | ---- | C] () -- C:\Users\Ghost\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.07.19 16:50:27 | 011,137,024 | ---- | C] () -- C:\Users\Ghost\AppData\Roaming\Sandra.mdb
[2011.07.19 15:13:16 | 014,521,609 | ---- | C] () -- C:\Program Files (x86)\evepremiumpatch264377-267203_m.exe
[2011.07.19 09:49:05 | 000,451,072 | ---- | C] () -- C:\Windows\SysWow64\ISSRemoveSP.exe
[2011.07.19 09:31:35 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2011.07.19 08:47:02 | 000,007,432 | ---- | C] () -- C:\Windows\SysWow64\Machnm32.sys
[2011.07.19 07:50:37 | 000,001,769 | ---- | C] () -- C:\Windows\Language_trs.ini
[2011.07.19 07:50:32 | 000,027,946 | ---- | C] () -- C:\Windows\Ascd_tmp.ini
[2010.08.03 06:21:24 | 000,014,464 | R--- | C] () -- C:\Windows\SysWow64\drivers\AsUpIO.sys
[2010.07.08 11:10:32 | 000,000,964 | ---- | C] () -- C:\Windows\cm106.ini
[2010.06.25 18:03:12 | 000,053,299 | ---- | C] () -- C:\Windows\SysWow64\pthreadVC.dll
[2009.07.14 06:38:36 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009.07.14 03:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT
[2009.07.14 03:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat
[2009.07.14 01:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009.07.14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll
[2009.07.13 22:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2009.06.10 22:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat
[2009.04.02 13:30:14 | 000,010,296 | ---- | C] () -- C:\Windows\SysWow64\drivers\ASUSHWIO.SYS
[2008.01.04 06:34:42 | 000,010,216 | ---- | C] () -- C:\Windows\SysWow64\drivers\AsInsHelp32.sys
 
========== LOP Check ==========
 
[2011.09.16 16:40:00 | 000,000,000 | ---D | M] -- C:\Users\Ghost\AppData\Roaming\Ashampoo
[2011.11.18 16:22:55 | 000,000,000 | ---D | M] -- C:\Users\Ghost\AppData\Roaming\Booster
[2011.07.22 13:31:56 | 000,000,000 | ---D | M] -- C:\Users\Ghost\AppData\Roaming\Buhl Data Service
[2011.11.19 11:01:51 | 000,000,000 | ---D | M] -- C:\Users\Ghost\AppData\Roaming\Buhl Data Service GmbH
[2011.07.20 21:03:51 | 000,000,000 | ---D | M] -- C:\Users\Ghost\AppData\Roaming\DataDesign
[2011.07.19 08:48:04 | 000,000,000 | ---D | M] -- C:\Users\Ghost\AppData\Roaming\DisplayTune
[2011.12.02 20:27:45 | 000,000,000 | ---D | M] -- C:\Users\Ghost\AppData\Roaming\EveHQ
[2011.12.10 21:27:40 | 000,000,000 | ---D | M] -- C:\Users\Ghost\AppData\Roaming\EVEMon
[2011.11.18 17:13:18 | 000,000,000 | ---D | M] -- C:\Users\Ghost\AppData\Roaming\FileZilla
[2011.09.16 20:32:02 | 000,000,000 | ---D | M] -- C:\Users\Ghost\AppData\Roaming\FreeVideoConverter
[2011.11.09 22:26:56 | 000,000,000 | ---D | M] -- C:\Users\Ghost\AppData\Roaming\GHISLER
[2011.12.09 21:30:53 | 000,000,000 | ---D | M] -- C:\Users\Ghost\AppData\Roaming\gtk-2.0
[2011.10.16 13:46:54 | 000,000,000 | ---D | M] -- C:\Users\Ghost\AppData\Roaming\Indicium Technologies
[2011.12.02 23:05:55 | 000,000,000 | ---D | M] -- C:\Users\Ghost\AppData\Roaming\NetMeter
[2011.12.12 21:10:50 | 000,000,000 | ---D | M] -- C:\Users\Ghost\AppData\Roaming\NetSpeedMonitor
[2011.11.09 23:08:59 | 000,000,000 | ---D | M] -- C:\Users\Ghost\AppData\Roaming\Notepad++
[2011.09.29 16:17:00 | 000,000,000 | ---D | M] -- C:\Users\Ghost\AppData\Roaming\OpenOffice.org
[2011.12.03 23:32:40 | 000,000,000 | ---D | M] -- C:\Users\Ghost\AppData\Roaming\Opera
[2011.08.27 12:56:06 | 000,000,000 | ---D | M] -- C:\Users\Ghost\AppData\Roaming\PC Suite
[2011.12.11 23:57:25 | 000,000,000 | ---D | M] -- C:\Users\Ghost\AppData\Roaming\QuickScan
[2011.11.18 18:36:22 | 000,000,000 | ---D | M] -- C:\Users\Ghost\AppData\Roaming\TeamViewer
[2011.12.06 11:46:14 | 000,000,000 | ---D | M] -- C:\Users\Ghost\AppData\Roaming\TrueCrypt
[2011.11.19 14:43:56 | 000,000,000 | ---D | M] -- C:\Users\Ghost\AppData\Roaming\TS3Client
[2011.07.27 14:45:08 | 000,000,000 | ---D | M] -- C:\Users\Ghost\AppData\Roaming\ts3overlay
[2011.12.10 12:08:43 | 000,000,000 | ---D | M] -- C:\Users\Ghost\AppData\Roaming\TweakNow PowerPack 2011
[2011.07.31 10:27:53 | 000,000,000 | ---D | M] -- C:\Users\Ghost\AppData\Roaming\Verbindungsassistent
[2011.12.09 21:36:46 | 000,000,000 | ---D | M] -- C:\Users\Ghost\AppData\Roaming\Wireshark
[2011.11.27 12:02:17 | 000,032,640 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2011.12.11 17:00:08 | 000,000,440 | ---- | M] () -- C:\Windows\Tasks\vtscheduletask.job
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %SYSTEMDRIVE%\*. >
[2011.07.19 07:44:59 | 000,000,000 | -HSD | M] -- C:\$Recycle.Bin
[2011.10.19 19:13:32 | 000,000,000 | ---D | M] -- C:\Alexander
[2011.07.19 09:28:41 | 000,000,000 | ---D | M] -- C:\AMD
[2011.12.10 12:25:54 | 000,000,000 | ---D | M] -- C:\ATI
[2011.12.12 18:17:10 | 000,000,000 | -HSD | M] -- C:\Config.Msi
[2009.07.14 06:08:56 | 000,000,000 | -HSD | M] -- C:\Documents and Settings
[2011.07.19 07:44:53 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen
[2011.07.19 07:51:16 | 000,000,000 | ---D | M] -- C:\Intel
[2011.08.08 18:29:25 | 000,000,000 | RH-D | M] -- C:\MSOCache
[2009.07.14 04:20:08 | 000,000,000 | ---D | M] -- C:\PerfLogs
[2011.12.11 21:54:10 | 000,000,000 | R--D | M] -- C:\Program Files
[2011.12.12 07:33:32 | 000,000,000 | R--D | M] -- C:\Program Files (x86)
[2011.12.10 12:43:56 | 000,000,000 | -H-D | M] -- C:\ProgramData
[2011.07.19 07:44:53 | 000,000,000 | -HSD | M] -- C:\Programme
[2011.07.19 07:44:53 | 000,000,000 | -HSD | M] -- C:\Recovery
[2011.12.12 21:10:32 | 000,000,000 | -HSD | M] -- C:\System Volume Information
[2011.08.01 08:05:07 | 000,000,000 | ---D | M] -- C:\totalcmd
[2011.07.19 07:44:56 | 000,000,000 | R--D | M] -- C:\Users
[2011.12.12 20:03:52 | 000,000,000 | ---D | M] -- C:\Windows
 
< %PROGRAMFILES%\*.exe >
[2011.04.06 20:31:46 | 003,504,060 | ---- | M] (battleclinic.com) -- C:\Program Files (x86)\EVEMon-install-1.3.4.2523.exe
[2011.06.21 21:32:02 | 014,521,609 | ---- | M] () -- C:\Program Files (x86)\evepremiumpatch264377-267203_m.exe
[2011.04.06 17:48:04 | 001,802,976 | ---- | M] (CCP hf.) -- C:\Program Files (x86)\EVE_Premium_Setup_246350.exe
 
< %LOCALAPPDATA%\*.exe >
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.manifest /3 >
 
 
< MD5 for: AFD.SYS  >
[2010.11.21 04:24:08 | 000,499,712 | ---- | M] (Microsoft Corporation) MD5=D31DC7A16DEA4A9BAF179F3D6FBDB38C -- C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7601.17514_none_360e4801750ca991\afd.sys
[2011.04.25 03:34:03 | 000,499,200 | ---- | M] (Microsoft Corporation) MD5=D5B031C308A409A0A576BFF4CF083D30 -- C:\Windows\SysNative\drivers\afd.sys
[2011.04.25 03:34:03 | 000,499,200 | ---- | M] (Microsoft Corporation) MD5=D5B031C308A409A0A576BFF4CF083D30 -- C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7601.17603_none_3618198975057170\afd.sys
[2011.04.25 04:09:35 | 000,499,200 | ---- | M] (Microsoft Corporation) MD5=F4AD06143EAC303F55D0E86C40802976 -- C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7601.21712_none_3695e61e8e2c13d4\afd.sys
 
< MD5 for: EXPLORER.EXE  >
[2011.02.26 06:19:21 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe
[2011.02.25 07:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\explorer.exe
[2011.02.25 07:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe
[2011.02.26 07:14:34 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=3B69712041F3D63605529BD66DC00C48 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe
[2010.11.21 04:24:25 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe
[2011.02.25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\SysWOW64\explorer.exe
[2011.02.25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_b9fc4815c4e292b5\explorer.exe
[2010.11.21 04:24:11 | 002,872,320 | ---- | M] (Microsoft Corporation) MD5=AC4C51EB24AA95B77F705AB159189E24 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe
 
< MD5 for: REGEDIT.EXE  >
[2009.07.14 02:39:29 | 000,427,008 | ---- | M] (Microsoft Corporation) MD5=2E2C937846A0B8789E5E91739284D17A -- C:\Windows\winsxs\amd64_microsoft-windows-registry-editor_31bf3856ad364e35_6.1.7600.16385_none_5023a70bf589ad3e\regedit.exe
[2009.07.14 02:39:29 | 000,427,008 | ---- | M] (Microsoft Corporation) MD5=8A4883F5E7AC37444F23279239553878 -- C:\Windows\regedit.exe
[2009.07.14 02:14:30 | 000,398,336 | ---- | M] (Microsoft Corporation) MD5=8A4883F5E7AC37444F23279239553878 -- C:\Windows\SysWOW64\regedit.exe
[2009.07.14 02:14:30 | 000,398,336 | ---- | M] (Microsoft Corporation) MD5=8A4883F5E7AC37444F23279239553878 -- C:\Windows\winsxs\wow64_microsoft-windows-registry-editor_31bf3856ad364e35_6.1.7600.16385_none_5a78515e29ea6f39\regedit.exe
 
< MD5 for: USERINIT.EXE  >
[2010.11.21 04:23:55 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SysWOW64\userinit.exe
[2010.11.21 04:23:55 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2010.11.21 04:24:28 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\SysNative\userinit.exe
[2010.11.21 04:24:28 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe
 
< MD5 for: WININIT.EXE  >
[2009.07.14 02:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\SysNative\wininit.exe
[2009.07.14 02:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49\wininit.exe
[2009.07.14 02:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\SysWOW64\wininit.exe
[2009.07.14 02:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2010.11.21 04:24:29 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\SysNative\winlogon.exe
[2010.11.21 04:24:29 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe
 
< HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs >
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Required: DebugWindows [binary data]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Windows: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
 
< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >
 
< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >

< End of report >
         

--- --- ---



Ich freue mich, wenn mir jemand helfen kann, diesen Knoten zu lösen.

verrant

1. die beiden auf vt geprüften files sind sauber.
2. deinstaliere spybot es kann die reinigung stören außerdem nicht mehr sonders zeitgemäß, pc neustarten

3. öffne malwarebytes, logdateien, poste sie alle.
falls der windows defender funde hatte die ebenfalls posten
4.
combofix:

Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich
ziehen und eine Bereinigung der Infektion noch erschweren.

Bitte downloade dir Combofix.exe und speichere es unbedingt auf deinem Desktop.

• Besuche folgende Seite für Downloadlinks und Anweisungen für dieses
  Tool
  
  Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  
• Hinweis:
  Gehe sicher das all deine Anti Virus und Anti Malware Programme abgeschalten sind, damit diese Combofix nicht bei der Arbeit stören.
  
• Poste bitte die C:\Combofix.txt in deiner nächsten Antwort.

Zitat von markusg

1. die beiden auf vt geprüften files sind sauber.

Danke :-)

Zitat von markusg

2. deinstaliere spybot es kann die reinigung stören außerdem nicht mehr sonders zeitgemäß, pc neustarten

Über Windows deinstalliert und neu gestartet.

Zitat von markusg

3. öffne malwarebytes, logdateien, poste sie alle.
falls der windows defender funde hatte die ebenfalls posten

windows defender ohne Funde

Alle Malwarebite-Logs die ich habe:

Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Datenbank Version: 8308

Windows 6.1.7601 Service Pack 1
Internet Explorer 9.0.8112.16421

04.12.2011 16:23:59
mbam-log-2011-12-04 (16-23-59).txt

Art des Suchlaufs: Flash-Scan
Durchsuchte Objekte: 136096
Laufzeit: 20 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)


Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Datenbank Version: 8308

Windows 6.1.7601 Service Pack 1
Internet Explorer 9.0.8112.16421

04.12.2011 20:04:24
mbam-log-2011-12-04 (20-04-24).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|G:\|)
Durchsuchte Objekte: 391151
Laufzeit: 3 Stunde(n), 39 Minute(n), 58 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)



Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Datenbank Version: 8336

Windows 6.1.7601 Service Pack 1
Internet Explorer 9.0.8112.16421

09.12.2011 03:46:57
mbam-log-2011-12-09 (03-46-57).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|G:\|)
Durchsuchte Objekte: 405500
Laufzeit: 3 Stunde(n), 55 Minute(n), 39 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)



Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Datenbank Version: 8356

Windows 6.1.7601 Service Pack 1 (Safe Mode)
Internet Explorer 9.0.8112.16421

12.12.2011 08:36:30
mbam-log-2011-12-12 (08-36-30).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|G:\|)
Durchsuchte Objekte: 396394
Laufzeit: 9 Minute(n), 56 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)



Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Datenbank Version: 8358

Windows 6.1.7601 Service Pack 1
Internet Explorer 9.0.8112.16421

12.12.2011 22:23:12
mbam-log-2011-12-12 (22-23-12).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|G:\|)
Durchsuchte Objekte: 398502
Laufzeit: 12 Minute(n), 59 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)



Protection Log 2011-12-04.txt
16:23:27	Ghost	MESSAGE	Protection started successfully
16:23:31	Ghost	MESSAGE	IP Protection started successfully
18:29:35	Ghost	IP-BLOCK	77.95.231.41 (Type: outgoing, Port: 5352, Process: firefox.exe)
18:29:35	Ghost	IP-BLOCK	77.95.231.41 (Type: outgoing, Port: 5411, Process: firefox.exe)
18:32:07	Ghost	IP-BLOCK	77.95.231.41 (Type: outgoing, Port: 5486, Process: firefox.exe)
20:09:32	Ghost	MESSAGE	IP Protection stopped
20:09:34	Ghost	MESSAGE	Database updated successfully
20:09:34	Ghost	MESSAGE	IP Protection started successfully


Protection Log 2011-12-05.txt

07:31:48	Ghost	MESSAGE	Protection started successfully
07:31:51	Ghost	MESSAGE	IP Protection started successfully
07:33:00	Ghost	MESSAGE	Scheduled update executed successfully
07:33:23	Ghost	MESSAGE	IP Protection stopped
07:33:24	Ghost	MESSAGE	Database updated successfully
07:33:24	Ghost	MESSAGE	IP Protection started successfully
11:17:09	Ghost	MESSAGE	Protection started successfully
11:17:12	Ghost	MESSAGE	IP Protection started successfully
22:43:05	Ghost	IP-BLOCK	77.95.231.41 (Type: outgoing, Port: 5703, Process: ccpbrowser.exe)
22:43:05	Ghost	IP-BLOCK	77.95.231.41 (Type: outgoing, Port: 5704, Process: ccpbrowser.exe)
22:47:37	Ghost	IP-BLOCK	77.95.231.41 (Type: outgoing, Port: 5724, Process: firefox.exe)
22:47:37	Ghost	IP-BLOCK	77.95.231.41 (Type: outgoing, Port: 5728, Process: firefox.exe)
22:47:37	Ghost	IP-BLOCK	77.95.231.41 (Type: outgoing, Port: 5729, Process: firefox.exe)
22:47:45	Ghost	IP-BLOCK	77.95.231.41 (Type: outgoing, Port: 5730, Process: firefox.exe)
22:47:45	Ghost	IP-BLOCK	77.95.231.41 (Type: outgoing, Port: 5731, Process: firefox.exe)
22:48:57	Ghost	IP-BLOCK	77.95.231.41 (Type: outgoing, Port: 5748, Process: ccpbrowser.exe)
22:48:57	Ghost	IP-BLOCK	77.95.231.41 (Type: outgoing, Port: 5749, Process: ccpbrowser.exe)
22:48:57	Ghost	IP-BLOCK	77.95.231.41 (Type: outgoing, Port: 5750, Process: ccpbrowser.exe)
22:48:57	Ghost	IP-BLOCK	77.95.231.41 (Type: outgoing, Port: 5751, Process: ccpbrowser.exe)
22:48:57	Ghost	IP-BLOCK	77.95.231.41 (Type: outgoing, Port: 5752, Process: ccpbrowser.exe)
22:48:57	Ghost	IP-BLOCK	77.95.231.41 (Type: outgoing, Port: 5753, Process: ccpbrowser.exe)
22:48:57	Ghost	IP-BLOCK	77.95.231.41 (Type: outgoing, Port: 5754, Process: ccpbrowser.exe)
22:48:57	Ghost	IP-BLOCK	77.95.231.41 (Type: outgoing, Port: 5755, Process: ccpbrowser.exe)
22:48:57	Ghost	IP-BLOCK	77.95.231.41 (Type: outgoing, Port: 5756, Process: ccpbrowser.exe)
22:48:57	Ghost	IP-BLOCK	77.95.231.41 (Type: outgoing, Port: 5758, Process: ccpbrowser.exe)
23:22:02	Ghost	IP-BLOCK	77.95.231.41 (Type: outgoing, Port: 5997, Process: ccpbrowser.exe)
23:22:02	Ghost	IP-BLOCK	77.95.231.41 (Type: outgoing, Port: 5998, Process: ccpbrowser.exe)
23:22:02	Ghost	IP-BLOCK	77.95.231.41 (Type: outgoing, Port: 5999, Process: ccpbrowser.exe)
23:22:02	Ghost	IP-BLOCK	77.95.231.41 (Type: outgoing, Port: 6000, Process: ccpbrowser.exe)
23:22:02	Ghost	IP-BLOCK	77.95.231.41 (Type: outgoing, Port: 6002, Process: ccpbrowser.exe)
23:22:02	Ghost	IP-BLOCK	77.95.231.41 (Type: outgoing, Port: 6005, Process: ccpbrowser.exe)
23:22:02	Ghost	IP-BLOCK	77.95.231.41 (Type: outgoing, Port: 6006, Process: ccpbrowser.exe)
23:22:02	Ghost	IP-BLOCK	77.95.231.41 (Type: outgoing, Port: 6007, Process: ccpbrowser.exe)
23:22:02	Ghost	IP-BLOCK	77.95.231.41 (Type: outgoing, Port: 6008, Process: ccpbrowser.exe)
23:22:02	Ghost	IP-BLOCK	77.95.231.41 (Type: outgoing, Port: 6009, Process: ccpbrowser.exe)



Protection Log 2011-12-06.txt
10:50:55	Ghost	MESSAGE	Protection started successfully
10:52:15	Ghost	MESSAGE	Scheduled update executed successfully
10:52:16	Ghost	MESSAGE	Database updated successfully
20:37:17	Ghost	MESSAGE	Protection started successfully


Protection Log 2011-12-07.txt
00:47:33	Ghost	MESSAGE	Scheduled update executed successfully
00:47:34	Ghost	MESSAGE	Database updated successfully
10:09:23	Ghost	MESSAGE	Protection started successfully


Protection Log 2011-12-08.txt
07:26:34	Ghost	MESSAGE	Protection started successfully
07:27:40	Ghost	MESSAGE	Scheduled update executed successfully
07:27:41	Ghost	MESSAGE	Database updated successfully
18:41:35	Ghost	MESSAGE	Protection started successfully
23:51:09	Ghost	MESSAGE	Database updated successfully



Protection Log 2011-12-09.txt
17:04:36	Ghost	MESSAGE	Protection started successfully
17:26:16	Ghost	MESSAGE	Protection started successfully
17:34:39	Ghost	MESSAGE	Protection started successfully


Protection Log 2011-12-10.txt
10:30:34	Ghost	MESSAGE	Scheduled update executed successfully

Protection Log 2011-12-11.txt
11:27:21	Ghost	MESSAGE	Scheduled update executed successfully


Protection Log 2011-12-12.txt
07:26:39	Ghost	MESSAGE	Scheduled update executed successfully

Protection Log 2011-12-13.txt
08:13:14	Ghost	MESSAGE	Scheduled update executed successfully
         

Zitat von markusg

4.combofix:

Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich
ziehen und eine Bereinigung der Infektion noch erschweren.

Bitte downloade dir Combofix.exe und speichere es unbedingt auf deinem Desktop.

• Besuche folgende Seite für Downloadlinks und Anweisungen für dieses
  Tool
  
  Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  
• Hinweis:
  Gehe sicher das all deine Anti Virus und Anti Malware Programme abgeschalten sind, damit diese Combofix nicht bei der Arbeit stören.
  
• Poste bitte die C:\Combofix.txt in deiner nächsten Antwort.

Die Downloaddatei ist eine .exe zum ausführen und nicht zum Installieren. Da ich aber an eine "Install.exe" glaubte, gibt es 3 Log-Files.


Habe ComboFix aus Chrome-Fußzeile zum Installieren gestartet. Programm lief sofort los. Also vor dem O.K.-Knopf von ComboFix noch AdAware und MCAffee deaktiviert. An Defender nicht gedacht und Notepadd++ als offenes Programm übersehen.

Combofix Logfile:

	
	
ComboFix 11-12-12.02 - Ghost 13.12.2011  17:25:28.1.4 - x64
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.8169.6131 [GMT 1:00]
ausgeführt von:: d:\users\Ghost\Downloads\ComboFix.exe
AV: Lavasoft Ad-Watch Live! Anti-Virus *Disabled/Updated* {9FF26384-70D4-CE6B-3ECB-E759A6A40116}
AV: McAfee  Anti-Virus und Anti-Spyware *Disabled/Updated* {86355677-4064-3EA7-ABB3-1B136EB04637}
FW: McAfee  Firewall *Disabled* {BE0ED752-0A0B-3FFF-80EC-B2269063014C}
SP: Lavasoft Ad-Watch Live! *Disabled/Updated* {24938260-56EE-C1E5-047B-DC2BDD234BAB}
SP: McAfee  Anti-Virus und Anti-Spyware *Disabled/Updated* {3D54B793-665E-3129-9103-206115370C8A}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\AutocompletePro
c:\program files (x86)\AutocompletePro\AutocompletePro.dll
c:\program files (x86)\AutocompletePro\FireFoxExtension.exe
c:\program files (x86)\AutocompletePro\InstTracker.exe
c:\program files (x86)\AutocompletePro\support@predictad.com\chrome.manifest
c:\program files (x86)\AutocompletePro\support@predictad.com\chrome\content\browserOverlay.xul
c:\program files (x86)\AutocompletePro\support@predictad.com\chrome\content\options.js
c:\program files (x86)\AutocompletePro\support@predictad.com\chrome\content\options.xul
c:\program files (x86)\AutocompletePro\support@predictad.com\chrome\content\utils.js
c:\program files (x86)\AutocompletePro\support@predictad.com\defaults\preferences\predictad.js
c:\program files (x86)\AutocompletePro\support@predictad.com\install.rdf
c:\program files (x86)\AutocompletePro\unins000.dat
c:\program files (x86)\AutocompletePro\unins000.exe
c:\program files (x86)\EVE_Premium_Setup_246350.exe
c:\program files (x86)\EVEMon-install-1.3.4.2523.exe
c:\program files (x86)\evepremiumpatch264377-267203_m.exe
c:\windows\pkunzip.pif
c:\windows\pkzip.pif
.
.
(((((((((((((((((((((((   Dateien erstellt von 2011-11-13 bis 2011-12-13  ))))))))))))))))))))))))))))))
.
.
2011-12-13 16:28 . 2011-12-13 16:28	--------	d-----w-	c:\users\Default\AppData\Local\temp
2011-12-13 15:42 . 2011-12-13 15:42	69000	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{C8490BD8-AE91-4993-9E1D-1E9BC3D14938}\offreg.dll
2011-12-13 07:13 . 2011-11-30 01:21	8822856	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{C8490BD8-AE91-4993-9E1D-1E9BC3D14938}\mpengine.dll
2011-12-12 06:33 . 2011-12-12 06:33	388096	----a-r-	c:\users\Ghost\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-12-12 06:33 . 2011-12-12 06:33	--------	d-----w-	c:\program files (x86)\Trend Micro
2011-12-11 20:54 . 2011-12-11 20:54	--------	d-----w-	c:\program files\HashTab Shell Extension
2011-12-10 11:43 . 2011-12-10 11:43	--------	d-----w-	c:\programdata\ATI
2011-12-10 11:36 . 2011-12-10 11:36	--------	d-----w-	c:\program files (x86)\AMD APP
2011-12-10 11:25 . 2011-12-10 11:25	--------	d-----w-	C:\ATI
2011-12-10 11:08 . 2011-12-10 11:08	--------	d-----w-	c:\users\Ghost\AppData\Roaming\TweakNow PowerPack 2011
2011-12-09 20:39 . 2011-12-09 20:39	--------	d-----w-	c:\users\Ghost\AppData\Local\Locktime
2011-12-09 20:36 . 2011-12-09 20:36	--------	d-----w-	c:\users\Ghost\AppData\Roaming\Wireshark
2011-12-09 20:24 . 2011-12-09 20:24	--------	d-----w-	c:\program files (x86)\WinPcap
2011-12-09 20:10 . 2011-12-09 20:10	--------	d-----w-	c:\programdata\Locktime
2011-12-09 19:38 . 2011-12-03 13:37	16432	----a-w-	c:\windows\system32\lsdelete.exe
2011-12-09 17:06 . 2011-12-09 17:06	--------	d-----w-	c:\program files (x86)\Common Files\Adobe
2011-12-09 16:46 . 2011-12-09 16:46	--------	d-----w-	c:\program files (x86)\Common Files\Java
2011-12-09 15:56 . 2011-12-09 15:56	525544	----a-w-	c:\windows\system32\deployJava1.dll
2011-12-09 15:56 . 2011-12-09 15:56	--------	d-----w-	c:\program files\Java
2011-12-07 17:51 . 2011-12-07 17:51	--------	d-----w-	c:\users\Ghost\AppData\Local\CrashRpt
2011-12-07 17:36 . 2011-12-07 18:08	--------	d-----w-	c:\users\Ghost\AppData\Local\RapidSolution
2011-12-06 10:41 . 2011-12-06 10:46	--------	d-----w-	c:\users\Ghost\AppData\Roaming\TrueCrypt
2011-12-06 10:40 . 2011-12-06 10:40	230864	----a-w-	c:\windows\system32\drivers\truecrypt.sys
2011-12-06 10:40 . 2011-12-06 10:40	--------	d-----w-	c:\program files\TrueCrypt
2011-12-04 15:22 . 2011-12-04 15:22	--------	d-----w-	c:\users\Ghost\AppData\Roaming\Malwarebytes
2011-12-04 15:21 . 2011-12-04 15:21	--------	d-----w-	c:\programdata\Malwarebytes
2011-12-04 15:21 . 2011-08-31 16:00	25416	----a-w-	c:\windows\system32\drivers\mbam.sys
2011-12-04 11:21 . 2011-12-13 15:38	--------	d-----w-	c:\programdata\Spybot - Search & Destroy
2011-12-03 22:40 . 2011-12-11 22:57	--------	d-----w-	c:\users\Ghost\AppData\Roaming\QuickScan
2011-12-03 22:32 . 2011-12-03 22:32	--------	d-----w-	c:\users\Ghost\AppData\Local\Opera
2011-12-03 22:32 . 2011-12-07 22:07	--------	d-----w-	c:\program files (x86)\Opera
2011-12-03 13:37 . 2011-12-03 13:37	55384	----a-w-	c:\windows\system32\drivers\SBREDrv.sys
2011-12-03 13:36 . 2011-10-28 18:35	69376	----a-w-	c:\windows\system32\drivers\Lbd.sys
2011-12-03 13:35 . 2011-12-03 13:36	--------	d-----w-	c:\programdata\Lavasoft
2011-11-27 19:49 . 2011-12-13 16:27	--------	d-----w-	c:\users\Ghost\AppData\Roaming\NetSpeedMonitor
2011-11-27 19:32 . 2011-12-02 22:05	--------	d-----w-	c:\users\Ghost\AppData\Roaming\NetMeter
2011-11-22 19:18 . 2011-10-18 13:29	28760	----a-w-	c:\program files (x86)\Mozilla Firefox\ScriptFF.dll
2011-11-20 14:44 . 2011-11-20 14:44	--------	d-----w-	c:\users\Ghost\dwhelper
2011-11-18 17:12 . 2011-11-18 17:36	--------	d-----w-	c:\users\Ghost\AppData\Roaming\TeamViewer
2011-11-18 17:11 . 2011-11-18 17:11	--------	d-----w-	c:\program files (x86)\TeamViewer
2011-11-18 15:44 . 2011-12-04 09:06	--------	d-----w-	c:\program files\CCleaner
2011-11-18 15:39 . 2011-11-18 15:39	131072	----a-w-	c:\windows\goog.exe
2011-11-18 15:39 . 2011-11-18 15:39	24576	----a-w-	c:\windows\system32\FoolishEventLogMsgHelper.dll
2011-11-18 15:22 . 2011-11-18 15:22	--------	d-----w-	c:\users\Ghost\AppData\Roaming\Booster
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-12-10 09:45 . 2011-07-28 11:19	1025648	----a-w-	c:\windows\PE_Rom.dll
2011-12-09 16:46 . 2011-07-19 14:32	472808	----a-w-	c:\windows\SysWow64\deployJava1.dll
2011-12-09 16:04 . 2011-07-19 20:38	414368	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2011-11-15 13:29 . 2010-11-21 03:27	270720	------w-	c:\windows\system32\MpSigStub.exe
2011-10-26 03:05 . 2011-10-26 03:05	10496512	----a-w-	c:\windows\system32\drivers\atikmdag.sys
2011-10-26 02:16 . 2011-10-26 02:16	24866816	----a-w-	c:\windows\system32\atio6axx.dll
2011-10-26 02:06 . 2011-10-26 02:06	159744	----a-w-	c:\windows\system32\atiapfxx.exe
2011-10-26 02:05 . 2010-09-29 01:55	748544	----a-w-	c:\windows\SysWow64\aticfx32.dll
2011-10-26 02:04 . 2010-09-29 01:54	892416	----a-w-	c:\windows\system32\aticfx64.dll
2011-10-26 02:01 . 2011-10-26 02:01	466944	----a-w-	c:\windows\system32\ATIDEMGX.dll
2011-10-26 02:01 . 2011-10-26 02:01	517120	----a-w-	c:\windows\system32\atieclxx.exe
2011-10-26 02:00 . 2011-10-26 02:00	204288	----a-w-	c:\windows\system32\atiesrxx.exe
2011-10-26 01:59 . 2011-10-26 01:59	18757120	----a-w-	c:\windows\SysWow64\atioglxx.dll
2011-10-26 01:59 . 2011-10-26 01:59	120320	----a-w-	c:\windows\system32\atitmm64.dll
2011-10-26 01:59 . 2011-10-26 01:59	423424	----a-w-	c:\windows\system32\atipdl64.dll
2011-10-26 01:59 . 2010-09-29 01:49	356352	----a-w-	c:\windows\SysWow64\atipdlxx.dll
2011-10-26 01:59 . 2011-10-26 01:59	278528	----a-w-	c:\windows\SysWow64\Oemdspif.dll
2011-10-26 01:58 . 2011-10-26 01:58	21504	----a-w-	c:\windows\system32\atimuixx.dll
2011-10-26 01:58 . 2011-10-26 01:58	59392	----a-w-	c:\windows\system32\atiedu64.dll
2011-10-26 01:58 . 2011-10-26 01:58	43520	----a-w-	c:\windows\SysWow64\ati2edxx.dll
2011-10-26 01:55 . 2010-09-29 01:46	4292096	----a-w-	c:\windows\SysWow64\atidxx32.dll
2011-10-26 01:46 . 2010-09-29 01:37	5041664	----a-w-	c:\windows\system32\atidxx64.dll
2011-10-26 01:43 . 2011-10-26 01:43	1113088	----a-w-	c:\windows\system32\atiumd6v.dll
2011-10-26 01:43 . 2011-10-26 01:43	1828864	----a-w-	c:\windows\SysWow64\atiumdmv.dll
2011-10-26 01:43 . 2011-10-26 01:43	4044288	----a-w-	c:\windows\system32\atiumd6a.dll
2011-10-26 01:38 . 2011-10-26 01:38	51200	----a-w-	c:\windows\system32\aticalrt64.dll
2011-10-26 01:38 . 2011-10-26 01:38	46080	----a-w-	c:\windows\SysWow64\aticalrt.dll
2011-10-26 01:38 . 2011-10-26 01:38	44544	----a-w-	c:\windows\system32\aticalcl64.dll
2011-10-26 01:38 . 2011-10-26 01:38	44032	----a-w-	c:\windows\SysWow64\aticalcl.dll
2011-10-26 01:38 . 2011-10-26 01:38	9978880	----a-w-	c:\windows\system32\aticaldd64.dll
2011-10-26 01:35 . 2010-09-29 01:28	4353536	----a-w-	c:\windows\SysWow64\atiumdag.dll
2011-10-26 01:34 . 2011-10-26 01:34	8449024	----a-w-	c:\windows\SysWow64\aticaldd.dll
2011-10-26 01:32 . 2010-09-29 01:22	4189184	----a-w-	c:\windows\SysWow64\atiumdva.dll
2011-10-26 01:29 . 2011-10-26 01:29	5510144	----a-w-	c:\windows\system32\atiumd64.dll
2011-10-26 01:29 . 2010-09-29 01:23	58880	----a-w-	c:\windows\system32\coinst.dll
2011-10-26 01:22 . 2011-10-26 01:22	486912	----a-w-	c:\windows\system32\atiadlxx.dll
2011-10-26 01:22 . 2010-09-29 01:15	339968	----a-w-	c:\windows\SysWow64\atiadlxy.dll
2011-10-26 01:22 . 2011-10-26 01:22	17408	----a-w-	c:\windows\system32\atig6pxx.dll
2011-10-26 01:22 . 2011-10-26 01:22	14336	----a-w-	c:\windows\SysWow64\atiglpxx.dll
2011-10-26 01:22 . 2011-10-26 01:22	14336	----a-w-	c:\windows\system32\atiglpxx.dll
2011-10-26 01:22 . 2011-10-26 01:22	39936	----a-w-	c:\windows\system32\atig6txx.dll
2011-10-26 01:22 . 2011-10-26 01:22	32768	----a-w-	c:\windows\SysWow64\atigktxx.dll
2011-10-26 01:21 . 2011-10-26 01:21	326656	----a-w-	c:\windows\system32\drivers\atikmpag.sys
2011-10-26 01:21 . 2010-09-29 01:14	40960	----a-w-	c:\windows\system32\atiuxp64.dll
2011-10-26 01:21 . 2010-09-29 01:14	31744	----a-w-	c:\windows\SysWow64\atiuxpag.dll
2011-10-26 01:21 . 2011-10-26 01:21	38912	----a-w-	c:\windows\system32\atiu9p64.dll
2011-10-26 01:20 . 2010-09-29 01:13	29184	----a-w-	c:\windows\SysWow64\atiu9pag.dll
2011-10-26 01:20 . 2011-10-26 01:20	53248	----a-w-	c:\windows\system32\drivers\ati2erec.dll
2011-10-26 01:16 . 2011-10-26 01:16	54784	----a-w-	c:\windows\system32\atimpc64.dll
2011-10-26 01:16 . 2011-10-26 01:16	54784	----a-w-	c:\windows\system32\amdpcom64.dll
2011-10-26 01:15 . 2011-10-26 01:15	53760	----a-w-	c:\windows\SysWow64\atimpc32.dll
2011-10-26 01:15 . 2011-10-26 01:15	53760	----a-w-	c:\windows\SysWow64\amdpcom32.dll
2011-10-25 20:21 . 2011-10-25 20:21	66560	----a-w-	c:\windows\system32\OpenVideo64.dll
2011-10-25 20:21 . 2011-10-25 20:21	56832	----a-w-	c:\windows\SysWow64\OpenVideo.dll
2011-10-25 20:21 . 2011-10-25 20:21	66560	----a-w-	c:\windows\system32\OVDecoder64.dll
2011-10-25 20:21 . 2011-10-25 20:21	56832	----a-w-	c:\windows\SysWow64\OVDecoder.dll
2011-10-25 20:21 . 2011-10-25 20:21	16991744	----a-w-	c:\windows\system32\amdocl64.dll
2011-10-25 20:20 . 2011-10-25 20:20	13950464	----a-w-	c:\windows\SysWow64\amdocl.dll
2011-10-25 20:19 . 2011-10-25 20:19	51200	----a-w-	c:\windows\system32\OpenCL.dll
2011-10-25 20:19 . 2011-10-25 20:19	44032	----a-w-	c:\windows\SysWow64\OpenCL.dll
2011-10-18 13:32 . 2011-07-27 16:31	161168	----a-w-	c:\windows\system32\mfevtps.exe
2011-10-15 12:16 . 2011-07-27 17:17	10248	----a-w-	c:\windows\system32\drivers\mfeclnk.sys
2011-10-15 12:16 . 2011-07-27 17:17	75808	----a-w-	c:\windows\system32\drivers\mfenlfk.sys
2011-10-15 12:16 . 2011-07-27 17:17	65264	----a-w-	c:\windows\system32\drivers\cfwids.sys
2011-10-15 12:16 . 2011-07-27 17:17	481768	----a-w-	c:\windows\system32\drivers\mfefirek.sys
2011-10-15 12:16 . 2011-07-27 17:17	284648	----a-w-	c:\windows\system32\drivers\mfewfpk.sys
2011-10-15 12:16 . 2011-07-27 17:17	229528	----a-w-	c:\windows\system32\drivers\mfeavfk.sys
2011-10-15 12:16 . 2011-07-27 17:17	100912	----a-w-	c:\windows\system32\drivers\mferkdet.sys
2011-10-15 12:16 . 2011-03-13 09:20	647080	----a-w-	c:\windows\system32\drivers\mfehidk.sys
2011-10-15 12:16 . 2011-03-13 09:20	160280	----a-w-	c:\windows\system32\drivers\mfeapfk.sys
2011-10-06 17:40 . 2011-07-19 13:58	1092400	----a-w-	c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2011-09-29 16:29 . 2011-11-08 20:38	1923952	----a-w-	c:\windows\system32\drivers\tcpip.sys
2011-09-29 04:03 . 2011-11-08 20:38	3144704	----a-w-	c:\windows\system32\win32k.sys
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ccleaner"="c:\program files\CCleaner\CCleaner64.exe" [2011-11-28 4533056]
"NetLimiter"="d:\program files\NetLimiter 3\NLClientApp.exe" [2011-03-21 2910208]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-21 1475584]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"NUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2010-11-17 113288]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2011-04-29 284440]
"PivotSoftware"="c:\program files (x86)\Portrait Displays\Pivot Pro Plugin\Pivot_startup.exe" [2010-05-13 110192]
"DT ACR"="c:\program files (x86)\Common Files\Portrait Displays\Shared\DT_startup.exe" [2010-06-30 121456]
"mcui_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2011-09-16 1674896]
"ASUS ShellProcess Execute"="c:\program files (x86)\ASUS\AI Suite II\ASUS Mobilink\Simulator\AsShellProcess.exe" [2010-09-28 252544]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-10-25 343168]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
McAfee Security Scan Plus.lnk - c:\program files (x86)\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Google Update-Dienst (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-08-10 136176]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;d:\program files (x86)\Lavasoft\Ad-Aware\AAWService.exe [2011-10-28 2152152]
R3 ALSysIO;ALSysIO;c:\users\Ghost\AppData\Local\Temp\ALSysIO64.sys [x]
R3 ATHDFU;Atheros Valkyrie USB BootROM;c:\windows\system32\Drivers\AthDfu.sys [x]
R3 ewsercd;Huawei DataCard USB Serial Port;c:\windows\system32\DRIVERS\ewsercd.sys [2011-07-19 112896]
R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-08-10 136176]
R3 hwusbfake;Huawei DataCard USB Fake;c:\windows\system32\DRIVERS\ewusbfake.sys [2011-07-19 116224]
R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-01-15 227232]
R3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [x]
R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files (x86)\Microsoft Office\Office14\GROOVE.EXE [2011-06-12 31125880]
R3 NLNdisPT;NetLimiter Ndis Protocol Service;c:\windows\system32\DRIVERS\nlndis.sys [x]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
R3 Point64;Microsoft IntelliPoint Filter Driver;c:\windows\system32\DRIVERS\point64.sys [x]
R3 SandraAgentSrv;SiSoftware Deployment Agent Service;d:\program files\SiSoftware\SiSoftware Sandra Lite 2011.SP4\RpcAgentSrv.exe [2009-07-13 93848]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [x]
R3 X6va005;X6va005;c:\users\Ghost\AppData\Local\Temp\005A498.tmp [x]
S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys [x]
S0 mfewfpk;McAfee Inc. mfewfpk;c:\windows\system32\drivers\mfewfpk.sys [x]
S0 mv91xx;mv91xx;c:\windows\system32\DRIVERS\mv91xx.sys [x]
S1 AsUpIO;AsUpIO;SysWow64\drivers\AsUpIO.sys [x]
S1 mfenlfk;McAfee NDIS Light Filter;c:\windows\system32\DRIVERS\mfenlfk.sys [x]
S1 nltdi;nltdi;d:\program files\NetLimiter 3\nltdi.sys [2011-03-21 88200]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 asComSvc;ASUS Com Service;c:\program files (x86)\ASUS\AXSP\1.00.13\atkexComSvc.exe [2010-11-03 918144]
S2 asHmComSvc;ASUS HM Com Service;c:\program files (x86)\ASUS\AAHM\1.00.13\aaHMSvc.exe [2010-12-02 915584]
S2 AsSysCtrlService;ASUS System Control Service;c:\program files (x86)\ASUS\AsSysCtrlService\1.00.11\AsSysCtrlService.exe [2010-10-21 586880]
S2 AtherosSvc;AtherosSvc;c:\program files (x86)\Bluetooth Suite\adminservice.exe [2010-10-27 52896]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2011-04-29 13592]
S2 MBAMService;MBAMService;d:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-08-31 366152]
S2 McMPFSvc;McAfee Personal Firewall Service;c:\program files\Common Files\McAfee\McSvcHost\McSvHost.exe [2011-01-27 249936]
S2 McNaiAnn;McAfee VirusScan Announcer;c:\program files\Common Files\McAfee\McSvcHost\McSvHost.exe [2011-01-27 249936]
S2 mfefire;McAfee Firewall Core Service;c:\program files\Common Files\McAfee\SystemCore\\mfefire.exe [2011-10-18 208536]
S2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe [x]
S2 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [x]
S2 PdiService;Portrait Displays SDK Service;c:\program files (x86)\Common Files\Portrait Displays\Drivers\pdisrvc.exe [2010-04-16 109168]
S2 Realtek87B;Realtek87B;c:\program files (x86)\Realtek\RTL8187 Wireless LAN Utility\RtlService.exe [2009-12-07 40960]
S2 TeamViewer6;TeamViewer 6;c:\program files (x86)\TeamViewer\Version6\TeamViewer_Service.exe [2011-11-03 2358656]
S2 WTGService;WTGService;c:\program files (x86)\Verbindungsassistent\WTGService.exe [2010-02-23 329168]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]
S3 AthBTPort;Atheros Virtual Bluetooth Class;c:\windows\system32\DRIVERS\btath_flt.sys [x]
S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [x]
S3 BTATH_A2DP;Bluetooth A2DP Audio Driver;c:\windows\system32\drivers\btath_a2dp.sys [x]
S3 BTATH_BUS;Atheros Bluetooth Bus;c:\windows\system32\DRIVERS\btath_bus.sys [x]
S3 BTATH_HCRP;Bluetooth HCRP Server driver;c:\windows\system32\DRIVERS\btath_hcrp.sys [x]
S3 BTATH_LWFLT;Bluetooth LWFLT Device;c:\windows\system32\DRIVERS\btath_lwflt.sys [x]
S3 BTATH_RCP;Bluetooth AVRCP Device;c:\windows\system32\DRIVERS\btath_rcp.sys [x]
S3 BtFilter;BtFilter;c:\windows\system32\DRIVERS\btfilter.sys [x]
S3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys [x]
S3 ICCWDT;Intel(R) Watchdog Timer Driver (Intel(R) WDT);c:\windows\system32\DRIVERS\ICCWDT.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]
S3 MEIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [x]
S3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys [x]
S3 NLNdisMP;NLNdisMP;c:\windows\system32\DRIVERS\nlndis.sys [x]
S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys [x]
S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
S3 RTL8187;Realtek RTL8187 Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\rtl8187.sys [x]
S3 USBMULCD;USB Multi-Channel Audio Device Interface;c:\windows\system32\drivers\CM10664.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*Deregistered* - Lavasoft Kernexplorer
*Deregistered* - mfeavfk01
.
Inhalt des "geplante Tasks" Ordners
.
2011-12-13 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-08-10 20:03]
.
2011-12-13 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-08-10 20:03]
.
2011-12-12 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2438057823-3161982914-410875986-1000Core.job
- c:\users\Ghost\AppData\Local\Google\Update\GoogleUpdate.exe [2011-07-19 14:43]
.
2011-12-13 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2438057823-3161982914-410875986-1000UA.job
- c:\users\Ghost\AppData\Local\Google\Update\GoogleUpdate.exe [2011-07-19 14:43]
.
2011-12-13 c:\windows\Tasks\vtscheduletask.job
- c:\program files (x86)\McAfee\Supportability\MVT\MvtApp.exe [2011-07-27 12:25]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Cm106Sound"="c:\windows\Syswow64\cm106.dll" [2010-07-01 8151040]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2011-08-01 2417032]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x1
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = about:blank
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: An OneNote s&enden - c:\progra~2\MICROS~3\Office14\ONBttnIE.dll/105
IE: Nach Microsoft E&xcel exportieren - c:\progra~2\MICROS~3\Office14\EXCEL.EXE/3000
Trusted Zone: internet
Trusted Zone: mcafee.com
TCP: DhcpNameServer = 192.168.2.1
TCP: Interfaces\{6C802738-AE9D-4E6D-A478-99D6D0B66991}: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Ghost\AppData\Roaming\Mozilla\Firefox\Profiles\gcl7g18u.default\
FF - prefs.js: browser.startup.homepage - www.google.de
FF - prefs.js: keyword.URL - hxxp://websearch.search-results.com/redirect?client=ff&src=kw&tb=STC-SRS&o=41648033&locale=de_DE&apn_uid=27585E9B-37D2-4465-BA12-110E4DBA700F&apn_ptnrs=96&apn_sauid=C6E5D6B3-9E65-46E4-9D52-6E7458A9F170&apn_dtid=YYYYYYYYDE&q=
FF - prefs.js: network.proxy.ftp - 46.249.35.176
FF - prefs.js: network.proxy.ftp_port - 80
FF - prefs.js: network.proxy.http - 46.249.35.176
FF - prefs.js: network.proxy.http_port - 80
FF - prefs.js: network.proxy.socks - 46.249.35.176
FF - prefs.js: network.proxy.socks_port - 80
FF - prefs.js: network.proxy.ssl - 46.249.35.176
FF - prefs.js: network.proxy.ssl_port - 80
FF - prefs.js: network.proxy.type - 1
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-10 - (no file)
BHO-{9D717F81-9148-4f12-8568-69135F087DB0} - (no file)
Toolbar-10 - (no file)
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
AddRemove-AutocompletePro3_is1 - c:\program files (x86)\AutocompletePro\unins000.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\X6va005]
"ImagePath"="\??\c:\users\Ghost\AppData\Local\Temp\005A498.tmp"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10d.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil10d.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10d.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10d.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10d.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10d.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\McAfee]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
   00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0007\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0008\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2011-12-13  17:29:33
ComboFix-quarantined-files.txt  2011-12-13 16:29
.
Vor Suchlauf: 11 Verzeichnis(se), 39.244.009.472 Bytes frei
Nach Suchlauf: 16 Verzeichnis(se), 39.102.685.184 Bytes frei
.
- - End Of File - - 3A56BDF1423E2AEAE563EEF383D6B298
         
 
--- --- ---
         

Defender ist noch dabei, Notepad++ und Minianwendungen geschlossen:
Wegen Textgröße als txt.Datei angefügt.

Combofix auf dem Desktop. Auch Defender ist aus - Puh

Combofix Logfile:

ComboFix 11-12-12.02 - Ghost 13.12.2011  17:44:35.3.4 - x64
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.8169.6054 [GMT 1:00]
ausgeführt von:: c:\users\Ghost\Desktop\ComboFix.exe
AV: Lavasoft Ad-Watch Live! Anti-Virus *Disabled/Updated* {9FF26384-70D4-CE6B-3ECB-E759A6A40116}
AV: McAfee  Anti-Virus und Anti-Spyware *Disabled/Updated* {86355677-4064-3EA7-ABB3-1B136EB04637}
FW: McAfee  Firewall *Disabled* {BE0ED752-0A0B-3FFF-80EC-B2269063014C}
SP: Lavasoft Ad-Watch Live! *Disabled/Updated* {24938260-56EE-C1E5-047B-DC2BDD234BAB}
SP: McAfee  Anti-Virus und Anti-Spyware *Disabled/Updated* {3D54B793-665E-3129-9103-206115370C8A}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((   Dateien erstellt von 2011-11-13 bis 2011-12-13  ))))))))))))))))))))))))))))))
.
.
2011-12-13 16:47 . 2011-12-13 16:47	--------	d-----w-	c:\users\Default\AppData\Local\temp
2011-12-13 07:13 . 2011-11-30 01:21	8822856	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{C8490BD8-AE91-4993-9E1D-1E9BC3D14938}\mpengine.dll
2011-12-12 06:33 . 2011-12-12 06:33	388096	----a-r-	c:\users\Ghost\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-12-12 06:33 . 2011-12-12 06:33	--------	d-----w-	c:\program files (x86)\Trend Micro
2011-12-11 20:54 . 2011-12-11 20:54	--------	d-----w-	c:\program files\HashTab Shell Extension
2011-12-10 11:43 . 2011-12-10 11:43	--------	d-----w-	c:\programdata\ATI
2011-12-10 11:36 . 2011-12-10 11:36	--------	d-----w-	c:\program files (x86)\AMD APP
2011-12-10 11:25 . 2011-12-10 11:25	--------	d-----w-	C:\ATI
2011-12-10 11:08 . 2011-12-10 11:08	--------	d-----w-	c:\users\Ghost\AppData\Roaming\TweakNow PowerPack 2011
2011-12-09 20:39 . 2011-12-09 20:39	--------	d-----w-	c:\users\Ghost\AppData\Local\Locktime
2011-12-09 20:36 . 2011-12-09 20:36	--------	d-----w-	c:\users\Ghost\AppData\Roaming\Wireshark
2011-12-09 20:24 . 2011-12-09 20:24	--------	d-----w-	c:\program files (x86)\WinPcap
2011-12-09 20:10 . 2011-12-09 20:10	--------	d-----w-	c:\programdata\Locktime
2011-12-09 19:38 . 2011-12-03 13:37	16432	----a-w-	c:\windows\system32\lsdelete.exe
2011-12-09 17:06 . 2011-12-09 17:06	--------	d-----w-	c:\program files (x86)\Common Files\Adobe
2011-12-09 16:46 . 2011-12-09 16:46	--------	d-----w-	c:\program files (x86)\Common Files\Java
2011-12-09 15:56 . 2011-12-09 15:56	525544	----a-w-	c:\windows\system32\deployJava1.dll
2011-12-09 15:56 . 2011-12-09 15:56	--------	d-----w-	c:\program files\Java
2011-12-07 17:51 . 2011-12-07 17:51	--------	d-----w-	c:\users\Ghost\AppData\Local\CrashRpt
2011-12-07 17:36 . 2011-12-07 18:08	--------	d-----w-	c:\users\Ghost\AppData\Local\RapidSolution
2011-12-06 10:41 . 2011-12-06 10:46	--------	d-----w-	c:\users\Ghost\AppData\Roaming\TrueCrypt
2011-12-06 10:40 . 2011-12-06 10:40	230864	----a-w-	c:\windows\system32\drivers\truecrypt.sys
2011-12-06 10:40 . 2011-12-06 10:40	--------	d-----w-	c:\program files\TrueCrypt
2011-12-04 15:22 . 2011-12-04 15:22	--------	d-----w-	c:\users\Ghost\AppData\Roaming\Malwarebytes
2011-12-04 15:21 . 2011-12-04 15:21	--------	d-----w-	c:\programdata\Malwarebytes
2011-12-04 15:21 . 2011-08-31 16:00	25416	----a-w-	c:\windows\system32\drivers\mbam.sys
2011-12-04 11:21 . 2011-12-13 15:38	--------	d-----w-	c:\programdata\Spybot - Search & Destroy
2011-12-03 22:40 . 2011-12-11 22:57	--------	d-----w-	c:\users\Ghost\AppData\Roaming\QuickScan
2011-12-03 22:32 . 2011-12-03 22:32	--------	d-----w-	c:\users\Ghost\AppData\Local\Opera
2011-12-03 22:32 . 2011-12-07 22:07	--------	d-----w-	c:\program files (x86)\Opera
2011-12-03 13:37 . 2011-12-03 13:37	55384	----a-w-	c:\windows\system32\drivers\SBREDrv.sys
2011-12-03 13:36 . 2011-10-28 18:35	69376	----a-w-	c:\windows\system32\drivers\Lbd.sys
2011-12-03 13:35 . 2011-12-03 13:36	--------	d-----w-	c:\programdata\Lavasoft
2011-11-27 19:49 . 2011-12-13 16:46	--------	d-----w-	c:\users\Ghost\AppData\Roaming\NetSpeedMonitor
2011-11-27 19:32 . 2011-12-02 22:05	--------	d-----w-	c:\users\Ghost\AppData\Roaming\NetMeter
2011-11-22 19:18 . 2011-10-18 13:29	28760	----a-w-	c:\program files (x86)\Mozilla Firefox\ScriptFF.dll
2011-11-20 14:44 . 2011-11-20 14:44	--------	d-----w-	c:\users\Ghost\dwhelper
2011-11-18 17:12 . 2011-11-18 17:36	--------	d-----w-	c:\users\Ghost\AppData\Roaming\TeamViewer
2011-11-18 17:11 . 2011-11-18 17:11	--------	d-----w-	c:\program files (x86)\TeamViewer
2011-11-18 15:44 . 2011-12-04 09:06	--------	d-----w-	c:\program files\CCleaner
2011-11-18 15:39 . 2011-11-18 15:39	131072	----a-w-	c:\windows\goog.exe
2011-11-18 15:39 . 2011-11-18 15:39	24576	----a-w-	c:\windows\system32\FoolishEventLogMsgHelper.dll
2011-11-18 15:22 . 2011-11-18 15:22	--------	d-----w-	c:\users\Ghost\AppData\Roaming\Booster
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-12-10 09:45 . 2011-07-28 11:19	1025648	----a-w-	c:\windows\PE_Rom.dll
2011-12-09 16:46 . 2011-07-19 14:32	472808	----a-w-	c:\windows\SysWow64\deployJava1.dll
2011-12-09 16:04 . 2011-07-19 20:38	414368	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2011-11-15 13:29 . 2010-11-21 03:27	270720	------w-	c:\windows\system32\MpSigStub.exe
2011-10-26 03:05 . 2011-10-26 03:05	10496512	----a-w-	c:\windows\system32\drivers\atikmdag.sys
2011-10-26 02:16 . 2011-10-26 02:16	24866816	----a-w-	c:\windows\system32\atio6axx.dll
2011-10-26 02:06 . 2011-10-26 02:06	159744	----a-w-	c:\windows\system32\atiapfxx.exe
2011-10-26 02:05 . 2010-09-29 01:55	748544	----a-w-	c:\windows\SysWow64\aticfx32.dll
2011-10-26 02:04 . 2010-09-29 01:54	892416	----a-w-	c:\windows\system32\aticfx64.dll
2011-10-26 02:01 . 2011-10-26 02:01	466944	----a-w-	c:\windows\system32\ATIDEMGX.dll
2011-10-26 02:01 . 2011-10-26 02:01	517120	----a-w-	c:\windows\system32\atieclxx.exe
2011-10-26 02:00 . 2011-10-26 02:00	204288	----a-w-	c:\windows\system32\atiesrxx.exe
2011-10-26 01:59 . 2011-10-26 01:59	18757120	----a-w-	c:\windows\SysWow64\atioglxx.dll
2011-10-26 01:59 . 2011-10-26 01:59	120320	----a-w-	c:\windows\system32\atitmm64.dll
2011-10-26 01:59 . 2011-10-26 01:59	423424	----a-w-	c:\windows\system32\atipdl64.dll
2011-10-26 01:59 . 2010-09-29 01:49	356352	----a-w-	c:\windows\SysWow64\atipdlxx.dll
2011-10-26 01:59 . 2011-10-26 01:59	278528	----a-w-	c:\windows\SysWow64\Oemdspif.dll
2011-10-26 01:58 . 2011-10-26 01:58	21504	----a-w-	c:\windows\system32\atimuixx.dll
2011-10-26 01:58 . 2011-10-26 01:58	59392	----a-w-	c:\windows\system32\atiedu64.dll
2011-10-26 01:58 . 2011-10-26 01:58	43520	----a-w-	c:\windows\SysWow64\ati2edxx.dll
2011-10-26 01:55 . 2010-09-29 01:46	4292096	----a-w-	c:\windows\SysWow64\atidxx32.dll
2011-10-26 01:46 . 2010-09-29 01:37	5041664	----a-w-	c:\windows\system32\atidxx64.dll
2011-10-26 01:43 . 2011-10-26 01:43	1113088	----a-w-	c:\windows\system32\atiumd6v.dll
2011-10-26 01:43 . 2011-10-26 01:43	1828864	----a-w-	c:\windows\SysWow64\atiumdmv.dll
2011-10-26 01:43 . 2011-10-26 01:43	4044288	----a-w-	c:\windows\system32\atiumd6a.dll
2011-10-26 01:38 . 2011-10-26 01:38	51200	----a-w-	c:\windows\system32\aticalrt64.dll
2011-10-26 01:38 . 2011-10-26 01:38	46080	----a-w-	c:\windows\SysWow64\aticalrt.dll
2011-10-26 01:38 . 2011-10-26 01:38	44544	----a-w-	c:\windows\system32\aticalcl64.dll
2011-10-26 01:38 . 2011-10-26 01:38	44032	----a-w-	c:\windows\SysWow64\aticalcl.dll
2011-10-26 01:38 . 2011-10-26 01:38	9978880	----a-w-	c:\windows\system32\aticaldd64.dll
2011-10-26 01:35 . 2010-09-29 01:28	4353536	----a-w-	c:\windows\SysWow64\atiumdag.dll
2011-10-26 01:34 . 2011-10-26 01:34	8449024	----a-w-	c:\windows\SysWow64\aticaldd.dll
2011-10-26 01:32 . 2010-09-29 01:22	4189184	----a-w-	c:\windows\SysWow64\atiumdva.dll
2011-10-26 01:29 . 2011-10-26 01:29	5510144	----a-w-	c:\windows\system32\atiumd64.dll
2011-10-26 01:29 . 2010-09-29 01:23	58880	----a-w-	c:\windows\system32\coinst.dll
2011-10-26 01:22 . 2011-10-26 01:22	486912	----a-w-	c:\windows\system32\atiadlxx.dll
2011-10-26 01:22 . 2010-09-29 01:15	339968	----a-w-	c:\windows\SysWow64\atiadlxy.dll
2011-10-26 01:22 . 2011-10-26 01:22	17408	----a-w-	c:\windows\system32\atig6pxx.dll
2011-10-26 01:22 . 2011-10-26 01:22	14336	----a-w-	c:\windows\SysWow64\atiglpxx.dll
2011-10-26 01:22 . 2011-10-26 01:22	14336	----a-w-	c:\windows\system32\atiglpxx.dll
2011-10-26 01:22 . 2011-10-26 01:22	39936	----a-w-	c:\windows\system32\atig6txx.dll
2011-10-26 01:22 . 2011-10-26 01:22	32768	----a-w-	c:\windows\SysWow64\atigktxx.dll
2011-10-26 01:21 . 2011-10-26 01:21	326656	----a-w-	c:\windows\system32\drivers\atikmpag.sys
2011-10-26 01:21 . 2010-09-29 01:14	40960	----a-w-	c:\windows\system32\atiuxp64.dll
2011-10-26 01:21 . 2010-09-29 01:14	31744	----a-w-	c:\windows\SysWow64\atiuxpag.dll
2011-10-26 01:21 . 2011-10-26 01:21	38912	----a-w-	c:\windows\system32\atiu9p64.dll
2011-10-26 01:20 . 2010-09-29 01:13	29184	----a-w-	c:\windows\SysWow64\atiu9pag.dll
2011-10-26 01:20 . 2011-10-26 01:20	53248	----a-w-	c:\windows\system32\drivers\ati2erec.dll
2011-10-26 01:16 . 2011-10-26 01:16	54784	----a-w-	c:\windows\system32\atimpc64.dll
2011-10-26 01:16 . 2011-10-26 01:16	54784	----a-w-	c:\windows\system32\amdpcom64.dll
2011-10-26 01:15 . 2011-10-26 01:15	53760	----a-w-	c:\windows\SysWow64\atimpc32.dll
2011-10-26 01:15 . 2011-10-26 01:15	53760	----a-w-	c:\windows\SysWow64\amdpcom32.dll
2011-10-25 20:21 . 2011-10-25 20:21	66560	----a-w-	c:\windows\system32\OpenVideo64.dll
2011-10-25 20:21 . 2011-10-25 20:21	56832	----a-w-	c:\windows\SysWow64\OpenVideo.dll
2011-10-25 20:21 . 2011-10-25 20:21	66560	----a-w-	c:\windows\system32\OVDecoder64.dll
2011-10-25 20:21 . 2011-10-25 20:21	56832	----a-w-	c:\windows\SysWow64\OVDecoder.dll
2011-10-25 20:21 . 2011-10-25 20:21	16991744	----a-w-	c:\windows\system32\amdocl64.dll
2011-10-25 20:20 . 2011-10-25 20:20	13950464	----a-w-	c:\windows\SysWow64\amdocl.dll
2011-10-25 20:19 . 2011-10-25 20:19	51200	----a-w-	c:\windows\system32\OpenCL.dll
2011-10-25 20:19 . 2011-10-25 20:19	44032	----a-w-	c:\windows\SysWow64\OpenCL.dll
2011-10-18 13:32 . 2011-07-27 16:31	161168	----a-w-	c:\windows\system32\mfevtps.exe
2011-10-15 12:16 . 2011-07-27 17:17	10248	----a-w-	c:\windows\system32\drivers\mfeclnk.sys
2011-10-15 12:16 . 2011-07-27 17:17	75808	----a-w-	c:\windows\system32\drivers\mfenlfk.sys
2011-10-15 12:16 . 2011-07-27 17:17	65264	----a-w-	c:\windows\system32\drivers\cfwids.sys
2011-10-15 12:16 . 2011-07-27 17:17	481768	----a-w-	c:\windows\system32\drivers\mfefirek.sys
2011-10-15 12:16 . 2011-07-27 17:17	284648	----a-w-	c:\windows\system32\drivers\mfewfpk.sys
2011-10-15 12:16 . 2011-07-27 17:17	229528	----a-w-	c:\windows\system32\drivers\mfeavfk.sys
2011-10-15 12:16 . 2011-07-27 17:17	100912	----a-w-	c:\windows\system32\drivers\mferkdet.sys
2011-10-15 12:16 . 2011-03-13 09:20	647080	----a-w-	c:\windows\system32\drivers\mfehidk.sys
2011-10-15 12:16 . 2011-03-13 09:20	160280	----a-w-	c:\windows\system32\drivers\mfeapfk.sys
2011-10-06 17:40 . 2011-07-19 13:58	1092400	----a-w-	c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2011-09-29 16:29 . 2011-11-08 20:38	1923952	----a-w-	c:\windows\system32\drivers\tcpip.sys
2011-09-29 04:03 . 2011-11-08 20:38	3144704	----a-w-	c:\windows\system32\win32k.sys
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ccleaner"="c:\program files\CCleaner\CCleaner64.exe" [2011-11-28 4533056]
"NetLimiter"="d:\program files\NetLimiter 3\NLClientApp.exe" [2011-03-21 2910208]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"NUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2010-11-17 113288]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2011-04-29 284440]
"PivotSoftware"="c:\program files (x86)\Portrait Displays\Pivot Pro Plugin\Pivot_startup.exe" [2010-05-13 110192]
"DT ACR"="c:\program files (x86)\Common Files\Portrait Displays\Shared\DT_startup.exe" [2010-06-30 121456]
"mcui_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2011-09-16 1674896]
"ASUS ShellProcess Execute"="c:\program files (x86)\ASUS\AI Suite II\ASUS Mobilink\Simulator\AsShellProcess.exe" [2010-09-28 252544]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-10-25 343168]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
McAfee Security Scan Plus.lnk - c:\program files (x86)\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Google Update-Dienst (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-08-10 136176]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;d:\program files (x86)\Lavasoft\Ad-Aware\AAWService.exe [2011-10-28 2152152]
R3 ALSysIO;ALSysIO;c:\users\Ghost\AppData\Local\Temp\ALSysIO64.sys [x]
R3 ATHDFU;Atheros Valkyrie USB BootROM;c:\windows\system32\Drivers\AthDfu.sys [x]
R3 ewsercd;Huawei DataCard USB Serial Port;c:\windows\system32\DRIVERS\ewsercd.sys [2011-07-19 112896]
R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-08-10 136176]
R3 hwusbfake;Huawei DataCard USB Fake;c:\windows\system32\DRIVERS\ewusbfake.sys [2011-07-19 116224]
R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-01-15 227232]
R3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [x]
R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files (x86)\Microsoft Office\Office14\GROOVE.EXE [2011-06-12 31125880]
R3 NLNdisPT;NetLimiter Ndis Protocol Service;c:\windows\system32\DRIVERS\nlndis.sys [x]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
R3 Point64;Microsoft IntelliPoint Filter Driver;c:\windows\system32\DRIVERS\point64.sys [x]
R3 SandraAgentSrv;SiSoftware Deployment Agent Service;d:\program files\SiSoftware\SiSoftware Sandra Lite 2011.SP4\RpcAgentSrv.exe [2009-07-13 93848]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [x]
R3 X6va005;X6va005;c:\users\Ghost\AppData\Local\Temp\005A498.tmp [x]
S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys [x]
S0 mfewfpk;McAfee Inc. mfewfpk;c:\windows\system32\drivers\mfewfpk.sys [x]
S0 mv91xx;mv91xx;c:\windows\system32\DRIVERS\mv91xx.sys [x]
S1 AsUpIO;AsUpIO;SysWow64\drivers\AsUpIO.sys [x]
S1 mfenlfk;McAfee NDIS Light Filter;c:\windows\system32\DRIVERS\mfenlfk.sys [x]
S1 nltdi;nltdi;d:\program files\NetLimiter 3\nltdi.sys [2011-03-21 88200]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 asComSvc;ASUS Com Service;c:\program files (x86)\ASUS\AXSP\1.00.13\atkexComSvc.exe [2010-11-03 918144]
S2 asHmComSvc;ASUS HM Com Service;c:\program files (x86)\ASUS\AAHM\1.00.13\aaHMSvc.exe [2010-12-02 915584]
S2 AsSysCtrlService;ASUS System Control Service;c:\program files (x86)\ASUS\AsSysCtrlService\1.00.11\AsSysCtrlService.exe [2010-10-21 586880]
S2 AtherosSvc;AtherosSvc;c:\program files (x86)\Bluetooth Suite\adminservice.exe [2010-10-27 52896]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2011-04-29 13592]
S2 MBAMService;MBAMService;d:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-08-31 366152]
S2 McMPFSvc;McAfee Personal Firewall Service;c:\program files\Common Files\McAfee\McSvcHost\McSvHost.exe [2011-01-27 249936]
S2 McNaiAnn;McAfee VirusScan Announcer;c:\program files\Common Files\McAfee\McSvcHost\McSvHost.exe [2011-01-27 249936]
S2 mfefire;McAfee Firewall Core Service;c:\program files\Common Files\McAfee\SystemCore\\mfefire.exe [2011-10-18 208536]
S2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe [x]
S2 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [x]
S2 PdiService;Portrait Displays SDK Service;c:\program files (x86)\Common Files\Portrait Displays\Drivers\pdisrvc.exe [2010-04-16 109168]
S2 Realtek87B;Realtek87B;c:\program files (x86)\Realtek\RTL8187 Wireless LAN Utility\RtlService.exe [2009-12-07 40960]
S2 TeamViewer6;TeamViewer 6;c:\program files (x86)\TeamViewer\Version6\TeamViewer_Service.exe [2011-11-03 2358656]
S2 WTGService;WTGService;c:\program files (x86)\Verbindungsassistent\WTGService.exe [2010-02-23 329168]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]
S3 AthBTPort;Atheros Virtual Bluetooth Class;c:\windows\system32\DRIVERS\btath_flt.sys [x]
S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [x]
S3 BTATH_A2DP;Bluetooth A2DP Audio Driver;c:\windows\system32\drivers\btath_a2dp.sys [x]
S3 BTATH_BUS;Atheros Bluetooth Bus;c:\windows\system32\DRIVERS\btath_bus.sys [x]
S3 BTATH_HCRP;Bluetooth HCRP Server driver;c:\windows\system32\DRIVERS\btath_hcrp.sys [x]
S3 BTATH_LWFLT;Bluetooth LWFLT Device;c:\windows\system32\DRIVERS\btath_lwflt.sys [x]
S3 BTATH_RCP;Bluetooth AVRCP Device;c:\windows\system32\DRIVERS\btath_rcp.sys [x]
S3 BtFilter;BtFilter;c:\windows\system32\DRIVERS\btfilter.sys [x]
S3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys [x]
S3 ICCWDT;Intel(R) Watchdog Timer Driver (Intel(R) WDT);c:\windows\system32\DRIVERS\ICCWDT.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]
S3 MEIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [x]
S3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys [x]
S3 NLNdisMP;NLNdisMP;c:\windows\system32\DRIVERS\nlndis.sys [x]
S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys [x]
S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
S3 RTL8187;Realtek RTL8187 Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\rtl8187.sys [x]
S3 USBMULCD;USB Multi-Channel Audio Device Interface;c:\windows\system32\drivers\CM10664.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*Deregistered* - Lavasoft Kernexplorer
*Deregistered* - mfeavfk01
.
Inhalt des "geplante Tasks" Ordners
.
2011-12-13 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-08-10 20:03]
.
2011-12-13 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-08-10 20:03]
.
2011-12-12 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2438057823-3161982914-410875986-1000Core.job
- c:\users\Ghost\AppData\Local\Google\Update\GoogleUpdate.exe [2011-07-19 14:43]
.
2011-12-13 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2438057823-3161982914-410875986-1000UA.job
- c:\users\Ghost\AppData\Local\Google\Update\GoogleUpdate.exe [2011-07-19 14:43]
.
2011-12-13 c:\windows\Tasks\vtscheduletask.job
- c:\program files (x86)\McAfee\Supportability\MVT\MvtApp.exe [2011-07-27 12:25]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Cm106Sound"="c:\windows\Syswow64\cm106.dll" [2010-07-01 8151040]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2011-08-01 2417032]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = about:blank
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: An OneNote s&enden - c:\progra~2\MICROS~3\Office14\ONBttnIE.dll/105
IE: Nach Microsoft E&xcel exportieren - c:\progra~2\MICROS~3\Office14\EXCEL.EXE/3000
Trusted Zone: internet
Trusted Zone: mcafee.com
TCP: DhcpNameServer = 192.168.2.1
TCP: Interfaces\{6C802738-AE9D-4E6D-A478-99D6D0B66991}: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Ghost\AppData\Roaming\Mozilla\Firefox\Profiles\gcl7g18u.default\
FF - prefs.js: browser.startup.homepage - www.google.de
FF - prefs.js: keyword.URL - hxxp://websearch.search-results.com/redirect?client=ff&src=kw&tb=STC-SRS&o=41648033&locale=de_DE&apn_uid=27585E9B-37D2-4465-BA12-110E4DBA700F&apn_ptnrs=96&apn_sauid=C6E5D6B3-9E65-46E4-9D52-6E7458A9F170&apn_dtid=YYYYYYYYDE&q=
FF - prefs.js: network.proxy.ftp - 46.249.35.176
FF - prefs.js: network.proxy.ftp_port - 80
FF - prefs.js: network.proxy.http - 46.249.35.176
FF - prefs.js: network.proxy.http_port - 80
FF - prefs.js: network.proxy.socks - 46.249.35.176
FF - prefs.js: network.proxy.socks_port - 80
FF - prefs.js: network.proxy.ssl - 46.249.35.176
FF - prefs.js: network.proxy.ssl_port - 80
FF - prefs.js: network.proxy.type - 1
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-10 - (no file)
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\X6va005]
"ImagePath"="\??\c:\users\Ghost\AppData\Local\Temp\005A498.tmp"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10d.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil10d.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10d.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10d.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10d.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10d.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\McAfee]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
   00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0007\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0008\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2011-12-13  17:48:42
ComboFix-quarantined-files.txt  2011-12-13 16:48
ComboFix2.txt  2011-12-13 16:42
ComboFix3.txt  2011-12-13 16:29
.
Vor Suchlauf: 15 Verzeichnis(se), 38.910.857.216 Bytes frei
Nach Suchlauf: 16 Verzeichnis(se), 38.853.726.208 Bytes frei
.
- - End Of File - - 439245B8756402079B7168CBB2B6916A
         

--- --- ---


Nachtrag 1

Hatte ich vergessen beim Eingangsthread anzuführen:

Bevor ich schlauer wurde, habe ich otl genutzt um eine "redirect.dll" zu löschen. Den genauen Pfad erinnere ich nicht mehr, aber ich glaube es kam darin noch "Office14" vor.

Nachtrag 2

Der Pfad "Eigene Dateien" ist verschlossen. Die Pfade zu den anderen Standard"bibliotheken" ebenfalls, aber über eine Verknüpfung zu erreichen. Unter C:\ sind die "Documents and Settings", "Dokumente und Einstellungen" und "Programme" mit einem Schloß gesperrt, das Icon ist jeweils blass und alle 3 lassen sich trotz Rechte als Administrator nicht öffnen.

Gruß

verrant

1. bitte verzichte auf komplette zitate das zieht alles unnötig in die länge
2. warum löschts du einfach irgendwas mit otl?
3. öffne computer, c: qoobox rechtsklick quarantain hochladen.
http://www.trojaner-board.de/54791-a...ner-board.html
4. hast du die anleitung von combofix gelesen da steht doch alles haar klein drinn...

Danke für die schnelle Antwort.

Aus einer unnötigen Laune heraus OTL genutzt. Passiert nicht wieder. Solche Aktionen nur noch auf Anweisung.

Die Anleitung habe ich gelesen, aber n o c h nicht vorsichtig/genau genug umgesetzt. Werde mich bemühen, Anleitungen präziser abzuarbeiten.

Die Ordneransicht habe ich entsprechend der Anleitung für "Computer" angepasst.

Etwas ist mir in deiner kurzen Anleitung unklar geblieben:
Was ist mit dem Rechtsklick nach dem Öffnen des Ordners Qoobox gemeint? Was aus dem Kontextmenü soll ich womit machen?

Ordner Quarantine packen und hochladen?


Gerade aufgefallen: McAffee scheint wieder zu funktionieren. Echtzeitscan bleibt an und manueller Scan zeigt verarbeitete Dateien.



Gruß
verrant

du sollst nen rechtsklick machen und je nach dem was du nutzt dann winrar ein archiv erstellen lassen, also zu quarantain.rar hinzufügen, oder 7zip oder winzip etc nutzen

ZIP-Datei hochgeladen

hmm sehe keine falls zu groß
File-Upload.net - Ihr kostenloser File Hoster!
dort hochladen und link als private nachicht an mich

lade hitmanpro:
http://dl.surfright.nl/HitmanPro36beta2_x64.exe
öffnen settings, license, testlicense
scanner dort funde in quarantäne im letzten schritt solltest du einen bericht speichern können, den anhängen.

HitmanPro3_6_0_log.xml hochgeladen

Es gab keine Funde - keine Quarantäne.

leitet firefox noch die verbindung um?

ja, Firefox leitet noch um

zu ner speziellen seite oder sinds immer unterschiedliche, falls ne spezielle seite sag sie mir mal.

In der Adresszeile von Firefox steht: Google

So sieht die Site aus:

错误
您所请求的网址（URL）无法获取

当尝试读取以下网址（URL）时： Google

发生了下列的错误：

Access Denied.
拒绝访问

Access control configuration prevents your request from being allowed at this time. Please contact your service provider if you feel this is incorrect.
当前的存取控制设定禁止您的请求被接受，如果您觉得这是错误的，请与您网路服务的提供者联系。

本缓存服务器管理员：webmaster
Generated Wed, 14 Dec 2011 13:03:11 GMT by yestruereligionjeans.com (squid/2.6.STABLE21)

In der Adresszeile WEB.DE - E-Mail - Suche - DSL - De-Mail - Shopping - Entertainment eingegeben.

Site bleibt die Gleiche, nur für web.de und die Uhrziet unten ändert sich.

ok schaun wir mal weiter.
lade den CCleaner standard:
CCleaner Download - CCleaner 3.13.1600
falls der CCleaner
bereits instaliert, überspringen.
instalieren, öffnen, extras, liste der instalierten programme, als txt speichern. öffnen.
hinter, jedes von dir benötigte programm, schreibe notwendig.
hinter, jedes, von dir nicht benötigte, unnötig.
hinter, dir unbekannte, unbekannt.
liste posten.