Habe Trojaner Gen-Cryptor[Egun] gefunden

Bunkerer · 24.01.2012, 12:02

Hi,

hab gesehn wie hier im Forum oft das Programm Super Anti Spy empfohlen wird. Ich hab es dann auch mal durchlaufen lassen, bisher hatte ich nur Antivir. Das Programm hat dann recht viele cookies gefunden die ausspionieren koennten und den Trojaner Gen-Cryptor[Egun]. Ich hab Windows 7 mit 64bit.

Hier ist die Logfile von Super Anti Spy:

Code:

ATTFilter

SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com

Generated 01/23/2012 at 07:06 PM

Application Version : 5.0.1142

Core Rules Database Version : 8144
Trace Rules Database Version: 5956

Scan type       : Complete Scan
Total Scan Time : 00:40:56

Operating System Information
Windows 7 Home Premium 64-bit (Build 6.01.7600)
UAC Off - Administrator

Memory items scanned      : 576
Memory threats detected   : 0
Registry items scanned    : 76199
Registry threats detected : 0
File items scanned        : 57371
File threats detected     : 186

Adware.Tracking Cookie
	C:\Users\Fabien\AppData\Roaming\Microsoft\Windows\Cookies\G643JAPS.txt [ /mediaplex.com ]
	C:\Users\Fabien\AppData\Roaming\Microsoft\Windows\Cookies\6N9CLKP0.txt [ /smartadserver.com ]
	C:\Users\Fabien\AppData\Roaming\Microsoft\Windows\Cookies\218V6VNY.txt [ /partypoker.com ]
	C:\Users\Fabien\AppData\Roaming\Microsoft\Windows\Cookies\OEIE35I7.txt [ /zedo.com ]
	C:\Users\Fabien\AppData\Roaming\Microsoft\Windows\Cookies\IS0FQQVD.txt [ /atdmt.com ]
	C:\Users\Fabien\AppData\Roaming\Microsoft\Windows\Cookies\SS7PIZD4.txt [ /www1.partypoker.com ]
	C:\Users\Fabien\AppData\Roaming\Microsoft\Windows\Cookies\JXXBWL1G.txt [ /earlyexperience.partyaccount.com ]
	C:\Users\Fabien\AppData\Roaming\Microsoft\Windows\Cookies\1QD9M383.txt [ /c.atdmt.com ]
	C:\Users\Fabien\AppData\Roaming\Microsoft\Windows\Cookies\NZHCM2O6.txt [ /apmebf.com ]
	C:\USERS\FABIEN\AppData\Roaming\Microsoft\Windows\Cookies\Low\fabien@atdmt[2].txt [ Cookie:fabien@atdmt.com/ ]
	C:\USERS\FABIEN\AppData\Roaming\Microsoft\Windows\Cookies\Low\fabien@interclick[1].txt [ Cookie:fabien@interclick.com/ ]
	C:\USERS\FABIEN\AppData\Roaming\Microsoft\Windows\Cookies\Low\fabien@2o7[1].txt [ Cookie:fabien@2o7.net/ ]
	C:\USERS\FABIEN\Cookies\G643JAPS.txt [ Cookie:fabien@mediaplex.com/ ]
	C:\USERS\FABIEN\Cookies\6N9CLKP0.txt [ Cookie:fabien@smartadserver.com/ ]
	C:\USERS\FABIEN\Cookies\218V6VNY.txt [ Cookie:fabien@partypoker.com/ ]
	C:\USERS\FABIEN\Cookies\OEIE35I7.txt [ Cookie:fabien@zedo.com/ ]
	C:\USERS\FABIEN\Cookies\IS0FQQVD.txt [ Cookie:fabien@atdmt.com/ ]
	C:\USERS\FABIEN\Cookies\SS7PIZD4.txt [ Cookie:fabien@www1.partypoker.com/ ]
	C:\USERS\FABIEN\Cookies\JXXBWL1G.txt [ Cookie:fabien@earlyexperience.partyaccount.com/earlyexp/ ]
	C:\USERS\FABIEN\Cookies\NZHCM2O6.txt [ Cookie:fabien@apmebf.com/ ]
	.doubleclick.net [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.apmebf.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.mediaplex.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.imrworldwide.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.imrworldwide.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.yadro.ru [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	in.getclicky.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.server.cpmstar.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.adtech.de [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	fl01.ct2.comclick.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	fl01.ct2.comclick.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.atdmt.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.partypoker.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.partypoker.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.zedo.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	de.partypoker.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.adbrite.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.adbrite.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.adbrite.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.adbrite.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.de.partypoker.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.de.partypoker.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.de.partypoker.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	de.partypoker.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.mediafire.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.mediafire.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.lucidmedia.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.mediafire.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.mediafire.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.mediafire.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.ads.quartermedia.de [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.ads.quartermedia.de [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.ads.quartermedia.de [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.ads.quartermedia.de [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	adfarm1.adition.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	ww251.smartadserver.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.smartadserver.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.smartadserver.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.smartadserver.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.smartadserver.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.smartadserver.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.server.cpmstar.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.server.cpmstar.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.myroitracking.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.mm.chitika.net [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.clicksor.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.clicksor.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.clicksor.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.server.cpmstar.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.adtech.de [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.a.revenuemax.de [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.tribalfusion.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.apmebf.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	fl01.ct2.comclick.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.fastclick.net [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.f.megaclick.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.f.megaclick.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.megaclick.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.clickcash.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	ad.yieldmanager.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.server.cpmstar.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.server.cpmstar.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.server.cpmstar.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.ero-advertising.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.ero-advertising.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.serving-sys.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	tracking.klicktel.de [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	ad.zanox.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.zanox.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.webmasterplan.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.webmasterplan.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.mediaplex.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.adfarm1.adition.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	ad4.adfarm1.adition.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.adfarm1.adition.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.adfarm1.adition.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	ad2.adfarm1.adition.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.adfarm1.adition.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.serving-sys.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.adfarm1.adition.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.adfarm1.adition.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.atdmt.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.h.atdmt.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.h.atdmt.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.atdmt.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.h.atdmt.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.h.atdmt.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.serving-sys.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.serving-sys.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.atdmt.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.c.atdmt.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.c.atdmt.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.c.atdmt.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.c.atdmt.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.msnportal.112.2o7.net [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.statcounter.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	click.eyk.net [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	click.eyk.net [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.js.pixelrevenue.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	click.jve.net [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	click.jve.net [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	accounts.youtube.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.accounts.google.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.accounts.google.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	accounts.google.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.zedo.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.zedo.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.zedo.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.zedo.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.zedo.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.zedo.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.doubleclick.net [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	ad.yieldmanager.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.invitemedia.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.invitemedia.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.at.atwola.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	.content.yieldmanager.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	ad.yieldmanager.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	ad.yieldmanager.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	ad.yieldmanager.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	ad.yieldmanager.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	ad.yieldmanager.com [ C:\USERS\FABIEN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
	de.partypoker.com [ C:\USERS\FABIEN\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\XPVCWL8L ]
	.zanox.com [ C:\USERS\FABIEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QF1VPAPT.DEFAULT\COOKIES.SQLITE ]
	ad.adition.net [ C:\USERS\FABIEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QF1VPAPT.DEFAULT\COOKIES.SQLITE ]
	.adfarm1.adition.com [ C:\USERS\FABIEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QF1VPAPT.DEFAULT\COOKIES.SQLITE ]
	.imrworldwide.com [ C:\USERS\FABIEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QF1VPAPT.DEFAULT\COOKIES.SQLITE ]
	.imrworldwide.com [ C:\USERS\FABIEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QF1VPAPT.DEFAULT\COOKIES.SQLITE ]
	adx.chip.de [ C:\USERS\FABIEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QF1VPAPT.DEFAULT\COOKIES.SQLITE ]
	.smartadserver.com [ C:\USERS\FABIEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QF1VPAPT.DEFAULT\COOKIES.SQLITE ]
	.smartadserver.com [ C:\USERS\FABIEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QF1VPAPT.DEFAULT\COOKIES.SQLITE ]
	.smartadserver.com [ C:\USERS\FABIEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QF1VPAPT.DEFAULT\COOKIES.SQLITE ]
	.smartadserver.com [ C:\USERS\FABIEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QF1VPAPT.DEFAULT\COOKIES.SQLITE ]
	.atdmt.com [ C:\USERS\FABIEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QF1VPAPT.DEFAULT\COOKIES.SQLITE ]
	.atdmt.com [ C:\USERS\FABIEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QF1VPAPT.DEFAULT\COOKIES.SQLITE ]
	ww251.smartadserver.com [ C:\USERS\FABIEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QF1VPAPT.DEFAULT\COOKIES.SQLITE ]
	.doubleclick.net [ C:\USERS\FABIEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QF1VPAPT.DEFAULT\COOKIES.SQLITE ]
	.smartadserver.com [ C:\USERS\FABIEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QF1VPAPT.DEFAULT\COOKIES.SQLITE ]
	.adserver.adtechus.com [ C:\USERS\FABIEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QF1VPAPT.DEFAULT\COOKIES.SQLITE ]
	ad.zanox.com [ C:\USERS\FABIEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QF1VPAPT.DEFAULT\COOKIES.SQLITE ]
	.apmebf.com [ C:\USERS\FABIEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QF1VPAPT.DEFAULT\COOKIES.SQLITE ]
	.mediaplex.com [ C:\USERS\FABIEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QF1VPAPT.DEFAULT\COOKIES.SQLITE ]
	accounts.google.com [ C:\USERS\FABIEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QF1VPAPT.DEFAULT\COOKIES.SQLITE ]
	.content.yieldmanager.com [ C:\USERS\FABIEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QF1VPAPT.DEFAULT\COOKIES.SQLITE ]
	ad.yieldmanager.com [ C:\USERS\FABIEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QF1VPAPT.DEFAULT\COOKIES.SQLITE ]
	.adfarm1.adition.com [ C:\USERS\FABIEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QF1VPAPT.DEFAULT\COOKIES.SQLITE ]
	.adfarm1.adition.com [ C:\USERS\FABIEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QF1VPAPT.DEFAULT\COOKIES.SQLITE ]
	ad2.adfarm1.adition.com [ C:\USERS\FABIEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QF1VPAPT.DEFAULT\COOKIES.SQLITE ]
	.adfarm1.adition.com [ C:\USERS\FABIEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QF1VPAPT.DEFAULT\COOKIES.SQLITE ]
	ad.yieldmanager.com [ C:\USERS\FABIEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QF1VPAPT.DEFAULT\COOKIES.SQLITE ]
	ad.yieldmanager.com [ C:\USERS\FABIEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QF1VPAPT.DEFAULT\COOKIES.SQLITE ]
	ad.yieldmanager.com [ C:\USERS\FABIEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QF1VPAPT.DEFAULT\COOKIES.SQLITE ]
	ad.yieldmanager.com [ C:\USERS\FABIEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QF1VPAPT.DEFAULT\COOKIES.SQLITE ]
	ad.yieldmanager.com [ C:\USERS\FABIEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QF1VPAPT.DEFAULT\COOKIES.SQLITE ]
	.myroitracking.com [ C:\USERS\FABIEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QF1VPAPT.DEFAULT\COOKIES.SQLITE ]
	.clicksor.com [ C:\USERS\FABIEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QF1VPAPT.DEFAULT\COOKIES.SQLITE ]
	.clicksor.com [ C:\USERS\FABIEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QF1VPAPT.DEFAULT\COOKIES.SQLITE ]
	.clicksor.com [ C:\USERS\FABIEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QF1VPAPT.DEFAULT\COOKIES.SQLITE ]
	.clicksor.com [ C:\USERS\FABIEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QF1VPAPT.DEFAULT\COOKIES.SQLITE ]
	.clicksor.com [ C:\USERS\FABIEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QF1VPAPT.DEFAULT\COOKIES.SQLITE ]
	.amazon-adsystem.com [ C:\USERS\FABIEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QF1VPAPT.DEFAULT\COOKIES.SQLITE ]
	.amazon-adsystem.com [ C:\USERS\FABIEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QF1VPAPT.DEFAULT\COOKIES.SQLITE ]
	.histats.com [ C:\USERS\FABIEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QF1VPAPT.DEFAULT\COOKIES.SQLITE ]
	.histats.com [ C:\USERS\FABIEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QF1VPAPT.DEFAULT\COOKIES.SQLITE ]
	.doubleclick.net [ C:\USERS\FABIEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QF1VPAPT.DEFAULT\COOKIES.SQLITE ]

Trojan.Agent/Gen-Cryptor[Egun]
	C:\PROGRAM FILES (X86)\COUNTER-STRIKE 1.6 V40\LAUNCHER.EXE

Ich hab auch alle Programme geschlossen und OTL durchlaufen lassen, leider hat mir das Programm nur eine txt Datei erstellt (OTL) und keine extra.txt wie es hier beschrieben ist.

Code:

ATTFilter

OTL logfile created on: 1/24/2012 5:52:00 PM - Run 3
OTL by OldTimer - Version 3.2.31.0     Folder = C:\Users\Fabien\Desktop
64bit- Home Premium Edition  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
 
3.86 Gb Total Physical Memory | 2.06 Gb Available Physical Memory | 53.49% Memory free
7.71 Gb Paging File | 5.56 Gb Available in Paging File | 72.15% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 100.10 Gb Total Space | 41.78 Gb Free Space | 41.74% Space Free | Partition Type: NTFS
Drive D: | 598.44 Gb Total Space | 576.09 Gb Free Space | 96.27% Space Free | Partition Type: NTFS
 
Computer Name: FABIEN-PC | User Name: Fabien | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012/01/24 02:49:51 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Fabien\Desktop\OTL.exe
PRC - [2012/01/05 16:48:46 | 001,047,024 | ---- | M] (Google Inc.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
PRC - [2011/11/24 08:18:10 | 000,203,776 | ---- | M] () -- C:\ProgramData\Mobile Partner\OnlineUpdate\ouc.exe
PRC - [2011/10/05 10:18:00 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
PRC - [2011/10/05 10:17:51 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
PRC - [2011/10/05 10:17:50 | 000,258,512 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
PRC - [2011/08/03 20:23:54 | 000,828,944 | ---- | M] (GlavSoft LLC.) -- C:\Program Files (x86)\TightVNC\tvnserver.exe
PRC - [2011/03/28 11:21:16 | 000,249,648 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
PRC - [2011/01/28 12:15:33 | 000,066,048 | ---- | M] (PostgreSQL Global Development Group) -- C:\Program Files (x86)\PostgreSQL\8.4\bin\pg_ctl.exe
PRC - [2011/01/28 12:13:43 | 004,538,368 | ---- | M] (PostgreSQL Global Development Group) -- C:\Program Files (x86)\PostgreSQL\8.4\bin\postgres.exe
PRC - [2010/11/17 08:53:16 | 000,113,288 | ---- | M] (Renesas Electronics Corporation) -- C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
PRC - [2010/11/16 20:37:30 | 000,230,912 | ---- | M] (Huawei Technologies Co., Ltd.) -- C:\ProgramData\DatacardService\DCSHelper.exe
PRC - [2010/08/20 10:49:04 | 000,162,912 | ---- | M] (CyberLink Corp.) -- C:\Program Files (x86)\CyberLink\YouCam\YouCamTray.exe
PRC - [2010/08/20 10:49:04 | 000,136,488 | ---- | M] (CyberLink) -- C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
PRC - [2010/03/13 16:58:58 | 000,075,048 | ---- | M] (cyberlink) -- C:\Program Files (x86)\CyberLink\Shared files\brs.exe
PRC - [2010/02/03 04:08:56 | 000,087,336 | ---- | M] (CyberLink Corp.) -- C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
PRC - [2009/11/20 15:48:18 | 000,082,944 | ---- | M] () -- C:\Program Files (x86)\Novatel Wireless\Novacore\Server\NvtlSrvr.exe
PRC - [2009/09/29 13:03:46 | 000,735,960 | ---- | M] (ESET) -- C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012/01/05 16:48:44 | 000,411,120 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\16.0.912.75\ppgooglenaclpluginchrome.dll
MOD - [2012/01/05 16:48:43 | 003,767,792 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\16.0.912.75\pdf.dll
MOD - [2012/01/05 16:47:19 | 000,122,880 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\16.0.912.75\avutil-51.dll
MOD - [2012/01/05 16:47:18 | 000,222,208 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\16.0.912.75\avformat-53.dll
MOD - [2012/01/05 16:47:17 | 001,746,432 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\16.0.912.75\avcodec-53.dll
MOD - [2012/01/05 14:06:01 | 008,593,056 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\16.0.912.75\gcswf32.dll
MOD - [2011/01/08 10:27:00 | 000,004,096 | ---- | M] () -- C:\Program Files (x86)\NVIDIA Corporation\coprocmanager\detoured.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - [2011/08/12 06:38:04 | 000,140,672 | ---- | M] (SUPERAntiSpyware.com) [Auto | Running] -- C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE -- (!SASCORE)
SRV:64bit: - [2010/09/22 18:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)
SRV:64bit: - [2009/09/29 13:11:14 | 000,023,296 | ---- | M] (ESET) [On_Demand | Stopped] -- C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe -- (EhttpSrv)
SRV:64bit: - [2009/09/29 13:03:46 | 000,735,960 | ---- | M] (ESET) [Auto | Running] -- C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe -- (ekrn)
SRV:64bit: - [2009/07/14 08:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend)
SRV - [2011/11/24 08:18:10 | 000,203,776 | ---- | M] () [Auto | Stopped] -- C:\Program Files (x86)\Mobile Partner\UpdateDog\ouc.exe -- (Mobile Partner. RunOuc)
SRV - [2011/10/05 10:18:00 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2011/10/05 10:17:51 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011/08/03 20:23:54 | 000,828,944 | ---- | M] (GlavSoft LLC.) [Auto | Running] -- C:\Program Files (x86)\TightVNC\tvnserver.exe -- (tvnserver)
SRV - [2011/04/01 11:14:30 | 000,183,560 | ---- | M] (Microsoft Corporation.) [On_Demand | Stopped] -- C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE -- (BBSvc)
SRV - [2011/03/28 11:21:16 | 000,249,648 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE -- (SeaPort)
SRV - [2011/01/28 12:15:33 | 000,066,048 | ---- | M] (PostgreSQL Global Development Group) [Auto | Running] -- C:\Program Files (x86)\PostgreSQL\8.4\bin\pg_ctl.exe -- (postgresql-8.4)
SRV - [2010/03/18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009/11/20 15:48:18 | 000,082,944 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Novatel Wireless\Novacore\Server\NvtlSrvr.exe -- (NvtlService)
SRV - [2009/06/11 04:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2011/12/10 22:51:07 | 000,130,760 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2011/11/24 08:18:12 | 000,256,000 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ewusbnet.sys -- (ewusbnet)
DRV:64bit: - [2011/11/24 08:18:12 | 000,121,600 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ewusbmdm.sys -- (hwdatacard)
DRV:64bit: - [2011/11/24 08:18:12 | 000,117,248 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ew_hwusbdev.sys -- (ew_hwusbdev)
DRV:64bit: - [2011/11/24 08:18:12 | 000,086,016 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ew_jubusenum.sys -- (huawei_enumerator)
DRV:64bit: - [2011/09/15 23:55:03 | 000,097,312 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2011/09/15 23:55:03 | 000,027,760 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr)
DRV:64bit: - [2011/07/22 23:26:56 | 000,014,928 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS -- (SASDIFSV)
DRV:64bit: - [2011/07/13 04:55:18 | 000,012,368 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS -- (SASKUTIL)
DRV:64bit: - [2011/05/16 14:57:32 | 000,051,240 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\bScsiMSa.sys -- (bScsiMSa)
DRV:64bit: - [2011/05/13 15:37:54 | 000,048,488 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\fssfltr.sys -- (fssfltr)
DRV:64bit: - [2011/05/06 10:11:12 | 000,086,056 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\bScsiSDa.sys -- (bScsiSDa)
DRV:64bit: - [2011/03/11 13:22:41 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011/03/11 13:22:40 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2011/02/22 23:40:52 | 012,263,104 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)
DRV:64bit: - [2011/02/10 18:52:34 | 000,181,760 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nusb3xhc.sys -- (nusb3xhc)
DRV:64bit: - [2011/02/10 13:52:34 | 000,082,432 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nusb3hub.sys -- (nusb3hub)
DRV:64bit: - [2011/01/20 18:15:30 | 000,019,496 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\b57xdmp.sys -- (b57xdmp)
DRV:64bit: - [2011/01/20 18:15:28 | 000,067,624 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\b57xdbd.sys -- (b57xdbd)
DRV:64bit: - [2011/01/08 10:27:00 | 000,025,576 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\nvpciflt.sys -- (nvpciflt)
DRV:64bit: - [2010/11/06 14:45:46 | 000,438,808 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:64bit: - [2010/11/05 23:50:38 | 002,716,768 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\athwx.sys -- (AR5416)
DRV:64bit: - [2010/10/15 06:28:16 | 000,317,440 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\IntcDAud.sys -- (IntcDAud) Intel(R)
DRV:64bit: - [2010/08/20 10:49:06 | 000,031,088 | ---- | M] (CyberLink Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\clwvd.sys -- (clwvd)
DRV:64bit: - [2010/07/31 06:36:14 | 000,406,056 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\k57nd60a.sys -- (k57nd60a) Broadcom NetLink (TM)
DRV:64bit: - [2010/02/18 14:22:56 | 000,316,464 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP)
DRV:64bit: - [2009/11/19 19:08:24 | 000,256,000 | ---- | M] (Novatel Wireless Inc) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NWADIenum.sys -- (NWADI)
DRV:64bit: - [2009/11/10 15:56:22 | 000,213,376 | ---- | M] (Novatel Wireless Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nwusbser2.sys -- (NWUSBPort2)
DRV:64bit: - [2009/11/10 15:56:22 | 000,213,376 | ---- | M] (Novatel Wireless Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nwusbser.sys -- (NWUSBPort)
DRV:64bit: - [2009/11/10 15:56:22 | 000,213,376 | ---- | M] (Novatel Wireless Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nwusbmdm.sys -- (NWUSBModem)
DRV:64bit: - [2009/09/29 13:06:16 | 000,123,200 | ---- | M] (ESET) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\epfwwfpr.sys -- (epfwwfpr)
DRV:64bit: - [2009/09/29 13:03:00 | 000,136,584 | ---- | M] (ESET) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\ehdrv.sys -- (ehdrv)
DRV:64bit: - [2009/09/29 12:56:36 | 000,144,824 | ---- | M] (ESET) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\eamon.sys -- (eamon)
DRV:64bit: - [2009/07/14 08:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009/07/14 08:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009/07/14 08:47:48 | 000,077,888 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2009/07/14 08:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009/07/14 06:31:10 | 000,109,056 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\sdbus.sys -- (sdbus)
DRV:64bit: - [2009/06/11 03:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009/06/11 03:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009/06/11 03:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009/06/11 03:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV - [2010/03/13 16:58:52 | 000,146,928 | ---- | M] (CyberLink Corp.) [2011/09/06 15:32:59] [Kernel | Auto | Running] -- C:\Program Files (x86)\CyberLink\PowerDVD10\NavFilter\000.fcl -- ({1BA31E5A-C098-42d8-8F88-3C9F78A2FDDC})
DRV - [2009/07/14 08:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://th.msn.com/?rd=1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 44 CD C3 AF 6C 6C CC 01  [binary data]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
 
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.0.60531.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 5.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011/09/06 15:39:26 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 5.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\eplgTb@eset.com: C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird [2011/09/06 15:42:56 | 000,000,000 | ---D | M]
 
[2011/09/26 12:57:03 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Fabien\AppData\Roaming\mozilla\Extensions
[2011/11/14 06:49:19 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions
[2011/11/13 19:20:00 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2011/11/14 06:49:20 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA}
[2011/06/16 11:17:34 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2010/01/01 15:00:00 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
 
========== Chrome  ==========
 
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\16.0.912.75\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files (x86)\Microsoft Silverlight\4.0.50401.0\npctrl.dll
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\16.0.912.75\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\16.0.912.75\pdf.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.69\npGoogleUpdate3.dll
CHR - plugin: Windows Live\u0099 Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
 
O1 HOSTS File: ([2009/06/11 04:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O2:64bit: - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.7227.1100\swg64.dll (Google Inc.)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.7.7227.1100\swg.dll (Google Inc.)
O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O3:64bit: - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O4:64bit: - HKLM..\Run: [egui] C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe (ESET)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [BDRegion] C:\Program Files (x86)\CyberLink\Shared files\brs.exe (cyberlink)
O4 - HKLM..\Run: [NUSB3MON] C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (Renesas Electronics Corporation)
O4 - HKLM..\Run: [RemoteControl10] C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe (CyberLink Corp.)
O4 - HKLM..\Run: [tvncontrol] C:\Program Files (x86)\TightVNC\tvnserver.exe (GlavSoft LLC.)
O4 - HKLM..\Run: [YouCam Mirage] C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe (CyberLink)
O4 - HKLM..\Run: [YouCam Tray] C:\Program Files (x86)\CyberLink\YouCam\YouCamTray.exe (CyberLink Corp.)
O4 - HKCU..\Run: [MobiLink 3] C:\Program Files (x86)\Novatel Wireless\MobiLink3\MobiLink3.exe (Novatel Wireless Inc.)
O4 - HKCU..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: SoftwareSASGeneration = 1
O8:64bit: - Extra context menu item: Google Sidewiki... - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html File not found
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html File not found
O9 - Extra Button: ICQ7.6 - {7644E42D-B096-457F-8B5B-901238FC81AE} - C:\Program Files (x86)\ICQ7.6\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.6 - {7644E42D-B096-457F-8B5B-901238FC81AE} - C:\Program Files (x86)\ICQ7.6\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Users\Fabien\Desktop\PartyPoker.lnk ()
O9 - Extra 'Tools' menuitem : PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Users\Fabien\Desktop\PartyPoker.lnk ()
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.11.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{87B4CA44-5B38-4825-8B12-ED80E8357115}: DhcpNameServer = 192.168.11.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{E95C4365-E88B-4A92-8BB9-E48E8C830FDA}: NameServer = 61.19.64.19 61.19.245.246
O18:64bit: - Protocol\Handler\grooveLocalGWS - No CLSID value found
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - AppInit_DLLs: (C:\Windows\system32\nvinitx.dll) - C:\Windows\SysNative\nvinitx.dll (NVIDIA Corporation)
O20 - AppInit_DLLs: (C:\Windows\SysWOW64\nvinit.dll) -C:\Windows\SysWOW64\nvinit.dll (NVIDIA Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) -C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{0614fa69-231c-11e1-b049-001e101f859f}\Shell - "" = AutoRun
O33 - MountPoints2\{0614fa69-231c-11e1-b049-001e101f859f}\Shell\AutoRun\command - "" = H:\LaunchU3.exe -a
O33 - MountPoints2\{3bd91dba-d8d1-11e0-97e1-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{3bd91dba-d8d1-11e0-97e1-806e6f6e6963}\Shell\AutoRun\command - "" = E:\Setup.exe
O33 - MountPoints2\{763331f1-e957-11e0-ac43-c0f8da83ab3e}\Shell - "" = AutoRun
O33 - MountPoints2\{763331f1-e957-11e0-ac43-c0f8da83ab3e}\Shell\AutoRun\command - "" = F:\LiteAuto.exe
O33 - MountPoints2\{763335dd-e957-11e0-ac43-c0f8da83ab3e}\Shell - "" = AutoRun
O33 - MountPoints2\{763335dd-e957-11e0-ac43-c0f8da83ab3e}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a
O33 - MountPoints2\{9e2cd21e-1636-11e1-8fb4-c0f8da83ab3e}\Shell - "" = AutoRun
O33 - MountPoints2\{9e2cd21e-1636-11e1-8fb4-c0f8da83ab3e}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{9e2cd227-1636-11e1-8fb4-c0f8da83ab3e}\Shell - "" = AutoRun
O33 - MountPoints2\{9e2cd227-1636-11e1-8fb4-c0f8da83ab3e}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012/01/24 02:49:32 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\Fabien\Desktop\OTL.exe
[2012/01/22 14:52:47 | 000,000,000 | ---D | C] -- C:\Users\Fabien\AppData\Roaming\Microgaming
[2012/01/22 14:42:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NordicBet
[2012/01/22 14:42:39 | 000,000,000 | ---D | C] -- C:\Microgaming
[2012/01/22 14:42:39 | 000,000,000 | ---D | C] -- C:\ProgramData\MGS
[2012/01/22 13:53:04 | 000,000,000 | ---D | C] -- C:\Users\Fabien\AppData\Roaming\dvdcss
[2012/01/20 07:21:13 | 000,000,000 | ---D | C] -- C:\Users\Fabien\AppData\Roaming\SUPERAntiSpyware.com
[2012/01/20 07:20:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware
[2012/01/20 07:20:41 | 000,000,000 | ---D | C] -- C:\ProgramData\SUPERAntiSpyware.com
[2012/01/20 07:20:41 | 000,000,000 | ---D | C] -- C:\Program Files\SUPERAntiSpyware
[2012/01/18 19:25:34 | 000,000,000 | ---D | C] -- C:\ldrscan
[2012/01/12 20:42:34 | 000,000,000 | ---D | C] -- C:\ProgramData\HP
[2012/01/12 20:42:30 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP
[2012/01/12 20:42:20 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\HP
[2012/01/12 20:41:48 | 000,000,000 | ---D | C] -- C:\Program Files\HP
[2012/01/12 20:41:13 | 000,000,000 | ---D | C] -- C:\Users\Fabien\AppData\Local\HP
 
========== Files - Modified Within 30 Days ==========
 
[2012/01/24 17:19:28 | 000,014,416 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/01/24 17:19:28 | 000,014,416 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/01/24 17:11:54 | 000,000,894 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/01/24 17:11:42 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012/01/24 17:11:33 | 3104,722,944 | -HS- | M] () -- C:\hiberfil.sys
[2012/01/24 02:49:51 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Fabien\Desktop\OTL.exe
[2012/01/24 02:49:09 | 000,000,000 | ---- | M] () -- C:\Users\Fabien\defogger_reenable
[2012/01/24 02:48:27 | 000,050,477 | ---- | M] () -- C:\Users\Fabien\Desktop\Defogger.exe
[2012/01/24 02:09:05 | 000,000,898 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/01/22 23:43:26 | 000,017,279 | ---- | M] () -- C:\Users\Fabien\Desktop\default.xml
[2012/01/22 14:51:50 | 000,001,811 | ---- | M] () -- C:\Users\Fabien\Application Data\Microsoft\Internet Explorer\Quick Launch\NordicBet.lnk
[2012/01/22 14:51:50 | 000,001,781 | ---- | M] () -- C:\Users\Public\Desktop\NordicBet.lnk
[2012/01/20 07:20:43 | 000,001,812 | ---- | M] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
[2012/01/20 01:10:16 | 001,498,506 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012/01/20 01:10:16 | 000,654,126 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012/01/20 01:10:16 | 000,626,298 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012/01/20 01:10:16 | 000,130,002 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012/01/20 01:10:16 | 000,106,850 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012/01/12 20:42:30 | 000,002,240 | ---- | M] () -- C:\Users\Public\Desktop\HP Deskjet 1000 J110 series.lnk
[2012/01/12 20:42:30 | 000,001,198 | ---- | M] () -- C:\Users\Public\Desktop\Zubehör einkaufen - HP Deskjet 1000 J110 series.lnk
 
========== Files Created - No Company Name ==========
 
[2012/01/24 02:49:09 | 000,000,000 | ---- | C] () -- C:\Users\Fabien\defogger_reenable
[2012/01/24 02:48:22 | 000,050,477 | ---- | C] () -- C:\Users\Fabien\Desktop\Defogger.exe
[2012/01/22 23:39:02 | 000,017,279 | ---- | C] () -- C:\Users\Fabien\Desktop\default.xml
[2012/01/22 14:42:40 | 000,001,811 | ---- | C] () -- C:\Users\Fabien\Application Data\Microsoft\Internet Explorer\Quick Launch\NordicBet.lnk
[2012/01/22 14:42:40 | 000,001,781 | ---- | C] () -- C:\Users\Public\Desktop\NordicBet.lnk
[2012/01/20 07:20:43 | 000,001,812 | ---- | C] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
[2012/01/12 20:42:30 | 000,002,240 | ---- | C] () -- C:\Users\Public\Desktop\HP Deskjet 1000 J110 series.lnk
[2012/01/12 20:42:30 | 000,001,198 | ---- | C] () -- C:\Users\Public\Desktop\Zubehör einkaufen - HP Deskjet 1000 J110 series.lnk
[2011/10/24 20:43:12 | 000,000,056 | -H-- | C] () -- C:\Windows\SysWow64\ezsidmv.dat
[2011/10/08 23:48:26 | 000,000,000 | ---- | C] () -- C:\Windows\HMHud.INI
[2011/09/06 15:30:46 | 000,165,376 | ---- | C] () -- C:\Windows\SysWow64\unrar.dll
[2011/09/06 15:30:46 | 000,000,038 | ---- | C] () -- C:\Windows\avisplitter.ini
[2011/09/06 15:30:45 | 000,810,496 | ---- | C] () -- C:\Windows\SysWow64\xvidcore.dll
[2011/09/06 15:30:45 | 000,183,808 | ---- | C] () -- C:\Windows\SysWow64\xvidvfw.dll
[2011/09/06 15:30:45 | 000,080,896 | ---- | C] () -- C:\Windows\SysWow64\ff_vfw.dll
[2011/09/06 15:01:52 | 000,963,116 | ---- | C] () -- C:\Windows\SysWow64\igkrng600.bin
[2011/09/06 15:01:52 | 000,213,332 | ---- | C] () -- C:\Windows\SysWow64\igfcg600m.bin
[2011/09/06 15:01:52 | 000,145,804 | ---- | C] () -- C:\Windows\SysWow64\igcompkrng600.bin
[2009/07/14 12:38:36 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009/07/14 09:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT
[2009/07/14 09:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat
[2009/07/14 07:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009/07/14 06:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll
[2009/07/14 04:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2009/06/11 04:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat
 
========== LOP Check ==========
 
[2011/11/13 19:43:25 | 000,000,000 | ---D | M] -- C:\Users\Fabien\AppData\Roaming\ACD Systems
[2011/10/08 23:46:39 | 000,000,000 | ---D | M] -- C:\Users\Fabien\AppData\Roaming\HEM Data
[2012/01/20 07:06:20 | 000,000,000 | ---D | M] -- C:\Users\Fabien\AppData\Roaming\ICQ
[2012/01/23 01:04:38 | 000,000,000 | ---D | M] -- C:\Users\Fabien\AppData\Roaming\Microgaming
[2011/09/26 14:09:46 | 000,000,000 | ---D | M] -- C:\Users\Fabien\AppData\Roaming\TightVNC
[2009/07/14 12:08:49 | 000,012,068 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Files - Unicode (All) ==========
[2011/12/06 22:13:08 | 000,000,000 | ---D | M](C:\Users\Fabien\Desktop\Ms???) -- C:\Users\Fabien\Desktop\Msไทย
[2011/12/06 22:12:12 | 000,000,000 | ---D | C](C:\Users\Fabien\Desktop\Ms???) -- C:\Users\Fabien\Desktop\Msไทย
[2011/12/06 22:12:11 | 000,000,000 | ---D | M](C:\Users\Fabien\Desktop\Ms????) -- C:\Users\Fabien\Desktop\Msสากล
[2011/12/06 22:11:21 | 000,000,000 | ---D | C](C:\Users\Fabien\Desktop\Ms????) -- C:\Users\Fabien\Desktop\Msสากล

< End of report >

Schon mal Danke fuer eure Hilfe!

cosinus · 24.01.2012, 21:40

Zitat:

Trojan.Agent/Gen-Cryptor[Egun]
C:\PROGRAM FILES (X86)\COUNTER-STRIKE 1.6 V40\LAUNCHER.EXE

Aus welcher Quelle stammt dein CS denn?

Bunkerer · 25.01.2012, 03:30

Counter Strike hat mein Sohn installiert, hab bisher garnicht gesehn dass der Trojaner daher kommt, hab die logfiles nie durchgelesen bzw. nicht mal ueberflogen. Soll ich ihn fragen woher er es hat?

cosinus · 25.01.2012, 11:01

Kannste bei Gelegenheit vllt machen.

Bitte routinemäßig einen Vollscan mit Malwarebytes machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss! Außerdem müssen alle Funde entfernt werden.

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!

Bunkerer · 25.01.2012, 14:17

okay, Danke! Hier ist der erste Log:

Code:

ATTFilter

 Malwarebytes Anti-Malware  (Test) 1.60.0.1800
www.malwarebytes.org

Datenbank Version: v2012.01.25.02

Windows 7 x64 NTFS
Internet Explorer 8.0.7600.16385
Fabien :: FABIEN-PC [Administrator]

Schutz: Aktiviert

1/25/2012 6:20:42 PM
mbam-log-2012-01-25 (19-50-40).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 392785
Laufzeit: 1 Stunde(n), 10 Minute(n), 

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\nordicbet (Poker) (PUP.Casino.Gen) -> Keine Aktion durchgeführt.

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 5
C:\Microgaming\Poker\NordicBetMPP\install.exe (PUP.Casino.Gen) -> Keine Aktion durchgeführt.
C:\Users\Fabien\AppData\Local\Temp\Rar$EX00.859\Windows Loader\Windows Loader.exe (RiskWare.Tool.CK) -> Keine Aktion durchgeführt.
C:\Users\Fabien\Desktop\spiele\Trackmania\Trackmania\TrackMania.exe (Trojan.Agent) -> Keine Aktion durchgeführt.
C:\Users\Fabien\Downloads\NordicBet.exe (PUP.Casino.Gen) -> Keine Aktion durchgeführt.
C:\Users\Fabien\Downloads\Windows Loader\Windows Loader\Windows Loader.exe (RiskWare.Tool.CK) -> Keine Aktion durchgeführt.

(Ende)

cosinus · 25.01.2012, 14:36

Zitat:

C:\Users\Fabien\AppData\Local\Temp\Rar$EX00.859\Windows Loader\Windows Loader.exe (RiskWare.Tool.CK)

Auweia, da haste wohl ein illegales Windows am Start...war wohl auch Sohnemann?

Jedenfalls

Kauf dir ein echtes/legales Windows!

Siehe auch => http://www.trojaner-board.de/95393-c...-software.html

Falls wir Hinweise auf illegal erworbene Software finden, werden wir den Support ohne jegliche Diskussion beenden.

Cracks/Keygens sind zu 99,9% gefährliche Schädlinge, mit denen man nicht spaßen sollte. Ausserdem sind diese illegal und wir unterstützen die Verwendung von geklauter Software nicht. Somit beschränkt sich der Support auf Anleitung zur kompletten Neuinstallation!!

Dass illegale Cracks und Keygens im Wesentlichen dazu dienen, Malware zu verbreiten ist kein Geheimnis und muss jedem klar sein!

In Zukunft Finger weg von: Softonic, Registry-Bereinigern und illegalem Zeugs Cracks/Keygens/Serials

Bunkerer · 25.01.2012, 16:52

eieiei, ja das war auch der Sohnemann, das wird einige Wochen Computersperre geben. Er hat mir sogar noch das Geld fuer Windows 7 abgeknuepft und eine Rechnung gefaelscht und ausgedruckt. Wie mach ich das jetzt am besten?

Ich hab wichtige Daten auf diesem Laptop, sollte ich diese auf eine externe Festplatte ziehen, dann den Laptop formatieren, originales Windows 7 draufmachen und die Daten wieder draufspielen? Oder koennte ich den formatierten Laptop dann neu infizieren?

cosinus · 25.01.2012, 18:48

Zitat:

und eine Rechnung gefaelscht und ausgedruckt.

Gefälscht?

Naja kann ich so nicht sehen, ich seh nur, dass hier auf dem Rechner von dem das Log stammt, eine Datei drauf ist, die ganz offensichtlich dazu genutzt wird, ein gecracktes Windows "genuine" zu machen.
Wenn er wirklich eine Lizenz gekauft hat, muss er einen Lizenzkey sowie Windows-DVD samt Beilagen wie Hülle usw. haben. Vllt kann er das ja nachweisen

Zum Thema Datensicherung von infizierten Systemen; mach das über ne Live-CD wie Knoppix, Ubuntu (zweiter Link in meiner Signatur) oder über PartedMagic. Grund: Bei einem Live-System sind keine Schädlinge des infizierten Windows-Systems aktiv, damit ist dann auch eine negative Beeinflussung des Backups durch Schädlinge ausgeschlossen.

Du brauchst natürlich auch ein Sicherungsmedium, am besten dürfte eine externe Platte sein. Sofern du nicht allzuviel sichern musst, kann auch ein USB-Stick ausreichen.

Hier eine kurze Anleitung zu PartedMagic, funktioniert prinzipell so aber fast genauso mit allen anderen Live-Systemen auch.

1. Lade Dir das ISO-Image von PartedMagic herunter, müssten ca. 180 MB sein
2. Brenn es per Imagebrennfunktion auf CD, geht zB mit ImgBurn unter Windows
3. Boote von der gebrannten CD, im Bootmenü von Option 1 starten und warten bis der Linux-Desktop oben ist

4. Du müsstest ein Symbol "Mount Devices" finden, das doppelklicken
5. Mounte die Partitionen wo Windows installiert ist, meistens isses /dev/sda1 und natürlich noch etwaige andere Partitionen, wo noch Daten liegen und die gesichert werden müssen - natürlich auch die der externen Platte (du bekommmst nur Lese- und Schreibzugriffe auf die Dateisysteme, wenn diese gemountet sind)
6. Kopiere die Daten der internen Platte auf die externe Platte - kopiere nur persönliche Dateien, Musik, Videos, etc. auf die Backupplatte, KEINE ausführbaren Dateien wie Programme/Spiele/Setups!!
7. Wenn fertig, starte den Rechner neu, schalte die ext. Platte ab und boote von der Windows-DVD zur Neuinstallation (Anleitung beachten)

Bunkerer · 29.01.2012, 04:50

okay Danke, hab jetzt meine Dateien gesichert. Ich brauch jetzt ein originales Windows 7. Im Moment bin ich noch für mehrere Wochen in Thailand. Ein Kumpel hat aber eine originale Windows 7 CD dabei, kann ich das Betriebssystem mit seiner CD installieren, mir Windows 7 an meine Adresse nach Deutschland schicken lassen und den Product Key verwenden?

Habe Trojaner Gen-Cryptor[Egun] gefunden

Log-Analyse und Auswertung: Habe Trojaner Gen-Cryptor[Egun] gefunden