hallo,
auch ich habe mir gestern abend (24.01.) wohl beim internetsurfen diesen nervigen virus eingefangen. er taucht ca alle 15min auf und nichts geht mehr. dabei fallen mir nach neustart im taskmanager einige dubiose prozesse auf, zb eine zweite firefox instanz:
firefox.exe mit beschreibung: Запуск знакомства с Windows
und noch einige .exe anwendungen die nur aus zahlen bestehen. jetzt habe ich mir malwarebytes (test) runtergeladen, aktualisiert und es findet laufend sachen die ich dann in quarantäne verschiebe. der blackscreen taucht weiterhin auf.
wie soll ich weiter vorgehen?

mfg Tim

hi, starte bitte neu drücke f8 abgesicherter modus mit netzwerk wählen
Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

• Starte bitte die
  OTL.exe
  .
  Vista und Win7 User mit Rechtsklick "als Administrator starten"
• Kopiere nun den Inhalt in die
  Textbox.

activex
netsvcs
msconfig
%SYSTEMDRIVE%\*.
%PROGRAMFILES%\*.exe
%LOCALAPPDATA%\*.exe
%systemroot%\*. /mp /s
/md5start
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
explorer.exe
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\*.dll /lockedfiles
%USERPROFILE%\*.*
%USERPROFILE%\Local Settings\Temp\*.exe
%USERPROFILE%\Local Settings\Temp\*.dll
%USERPROFILE%\Application Data\*.exe
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs
CREATERESTOREPOINT
         

• Schliesse bitte nun alle Programme. (Wichtig)
• Klicke nun bitte auf den Quick Scan Button.
• Kopiere
  nun den Inhalt aus OTL.txt und Extra.txt hier in Deinen Thread

ich nutze windows7 64bit pro. beim starten habe ich f8 mehrmals gedrückt aber dies bewirkt nur das ich die bootfestplatte auswählen soll.
den scan habe ich dann nach anweisung gemacht.

OTL.txt

OTL logfile created on: 25.01.2012 20:18:33 - Run 1
OTL by OldTimer - Version 3.2.31.0     Folder = C:\Users\Tim\Desktop
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
8,00 Gb Total Physical Memory | 6,72 Gb Available Physical Memory | 84,01% Memory free
16,00 Gb Paging File | 14,69 Gb Available in Paging File | 91,86% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 59,53 Gb Total Space | 10,85 Gb Free Space | 18,22% Space Free | Partition Type: NTFS
Drive E: | 596,17 Gb Total Space | 23,72 Gb Free Space | 3,98% Space Free | Partition Type: NTFS
Drive T: | 1863,02 Gb Total Space | 86,27 Gb Free Space | 4,63% Space Free | Partition Type: NTFS
 
Computer Name: TIM-PC | User Name: Tim | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.01.25 20:03:53 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Tim\Desktop\OTL.exe
PRC - [2012.01.03 14:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2011.12.24 17:50:18 | 000,460,872 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2011.12.14 12:59:20 | 002,984,832 | ---- | M] (TeamViewer GmbH) -- C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe
PRC - [2011.12.14 12:59:19 | 010,981,248 | ---- | M] (TeamViewer GmbH) -- C:\Program Files (x86)\TeamViewer\Version7\TeamViewer.exe
PRC - [2011.12.14 12:41:55 | 000,116,608 | ---- | M] (TeamViewer GmbH) -- C:\Program Files (x86)\TeamViewer\Version7\tv_w32.exe
PRC - [2011.08.03 02:31:42 | 000,379,496 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
PRC - [2011.07.21 11:08:02 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
PRC - [2011.05.20 09:10:12 | 000,284,440 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
PRC - [2011.04.21 06:52:51 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
PRC - [2011.04.21 06:52:36 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
PRC - [2011.03.25 22:26:46 | 000,334,448 | ---- | M] (VMware, Inc.) -- C:\Windows\SysWOW64\vmnetdhcp.exe
PRC - [2011.03.25 22:26:28 | 000,404,080 | ---- | M] (VMware, Inc.) -- C:\Windows\SysWOW64\vmnat.exe
PRC - [2011.03.25 22:26:16 | 000,113,264 | ---- | M] (VMware, Inc.) -- C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe
PRC - [2011.03.25 21:27:40 | 000,539,248 | ---- | M] (VMware, Inc.) -- C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator.exe
PRC - [2010.11.20 14:24:45 | 000,060,928 | ---- | M] (Корпорация Майкрософт) -- C:\Users\Tim\AppData\Local\Mozilla\Firefox\firefox.exe
PRC - [2009.11.04 14:43:18 | 001,617,920 | ---- | M] (Edimax Technology Co., Ltd) -- C:\Program Files (x86)\Edimax\Common\RaUI.exe
PRC - [2009.10.06 10:57:44 | 000,185,632 | ---- | M] (Ralink Technology, Corp.) -- C:\Program Files (x86)\Edimax\Common\RaRegistry.exe
PRC - [2009.08.22 19:25:00 | 002,781,184 | ---- | M] () -- C:\Program Files (x86)\RivaTuner v2.24 (2009)\RivaTuner.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.01.06 03:02:18 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\b559a471eef00081f0b5c2719d1d9623\System.Runtime.Remoting.ni.dll
MOD - [2011.10.31 17:29:26 | 000,491,520 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\89933ca5a3d6ecfddac2f276746e939e\IAStorUtil.ni.dll
MOD - [2011.10.31 17:20:19 | 012,433,408 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\6e592e424a204aafeadbe22b6b31b9db\System.Windows.Forms.ni.dll
MOD - [2011.10.31 17:20:14 | 001,587,200 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\3b2cfd85528a27eb71dc41d8067359a1\System.Drawing.ni.dll
MOD - [2011.10.31 17:19:59 | 005,453,312 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\130ad4d9719e566ca933ac7158a04203\System.Xml.ni.dll
MOD - [2011.10.31 17:19:56 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\2d5bcbeb9475ef62189f605bcca1cec6\System.Configuration.ni.dll
MOD - [2011.10.31 17:19:55 | 007,963,648 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\abab08afa60a6f06bdde0fcc9649c379\System.ni.dll
MOD - [2011.10.31 17:19:50 | 011,490,304 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\a1a82db68b3badc7c27ea1f6579d22c5\mscorlib.ni.dll
MOD - [2010.11.13 00:26:08 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll
MOD - [2009.10.06 10:57:44 | 000,860,160 | ---- | M] () -- C:\Program Files (x86)\Edimax\Common\RaWLAPI.dll
MOD - [2009.08.22 19:25:00 | 002,781,184 | ---- | M] () -- C:\Program Files (x86)\RivaTuner v2.24 (2009)\RivaTuner.exe
MOD - [2009.08.22 19:25:00 | 000,028,672 | ---- | M] () -- C:\Program Files (x86)\RivaTuner v2.24 (2009)\PlugIns\Monitoring\ADT7473.dll
MOD - [2009.06.10 22:41:46 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Runtime.Remoting.resources\2.0.0.0_de_b77a5c561934e089\System.Runtime.Remoting.resources.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - [2011.05.18 22:40:08 | 002,169,592 | ---- | M] (UltraVNC) [On_Demand | Stopped] -- C:\Program Files\UltraVNC\WinVNC.exe -- (uvnc_service)
SRV:64bit: - [2009.07.14 02:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)
SRV - [2012.01.03 14:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2011.12.24 17:50:18 | 000,652,872 | ---- | M] (Malwarebytes Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2011.12.14 12:59:20 | 002,984,832 | ---- | M] (TeamViewer GmbH) [Auto | Running] -- C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe -- (TeamViewer7)
SRV - [2011.08.03 02:31:42 | 000,379,496 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)
SRV - [2011.07.21 11:08:02 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011.05.20 09:10:26 | 000,013,592 | ---- | M] (Intel Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc) Intel(R)
SRV - [2011.04.21 06:52:51 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2011.03.25 22:26:46 | 000,334,448 | ---- | M] (VMware, Inc.) [Auto | Running] -- C:\Windows\SysWOW64\vmnetdhcp.exe -- (VMnetDHCP)
SRV - [2011.03.25 22:26:28 | 000,404,080 | ---- | M] (VMware, Inc.) [Auto | Running] -- C:\Windows\SysWOW64\vmnat.exe -- (VMware NAT Service)
SRV - [2011.03.25 22:26:16 | 000,113,264 | ---- | M] (VMware, Inc.) [Auto | Running] -- C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe -- (VMAuthdService)
SRV - [2011.03.25 21:27:40 | 000,539,248 | ---- | M] (VMware, Inc.) [Auto | Running] -- C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator.exe -- (VMUSBArbService)
SRV - [2010.08.19 12:57:14 | 000,191,024 | ---- | M] (VMware, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\VMware\VMware Player\vmware-ufad.exe -- (ufad-ws60)
SRV - [2009.10.06 10:57:44 | 000,212,256 | ---- | M] (Ralink Technology, Corp.) [Auto | Running] -- C:\Program Files (x86)\Edimax\Common\RaRegistry64.exe -- (RalinkRegistryWriter64)
SRV - [2009.10.06 10:57:44 | 000,185,632 | ---- | M] (Ralink Technology, Corp.) [Auto | Running] -- C:\Program Files (x86)\Edimax\Common\RaRegistry.exe -- (RalinkRegistryWriter)
SRV - [2009.06.10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2011.12.17 15:52:16 | 000,012,904 | ---- | M] (UVNC BVBA) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\mv2.sys -- (mv2)
DRV:64bit: - [2011.12.10 15:24:08 | 000,023,152 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)
DRV:64bit: - [2011.07.29 12:54:56 | 000,016,776 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\epmntdrv.sys -- (epmntdrv)
DRV:64bit: - [2011.07.29 12:54:56 | 000,009,096 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\EuGdiDrv.sys -- (EuGdiDrv)
DRV:64bit: - [2011.07.21 11:11:10 | 000,123,784 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2011.07.21 11:11:09 | 000,088,288 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2011.05.20 08:53:44 | 000,557,848 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:64bit: - [2011.03.25 22:27:36 | 000,068,720 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\vmx86.sys -- (vmx86)
DRV:64bit: - [2011.03.25 22:27:34 | 000,081,008 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\vmci.sys -- (vmci)
DRV:64bit: - [2011.03.25 22:25:46 | 000,031,856 | ---- | M] (VMware, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\VMkbd.sys -- (vmkbd)
DRV:64bit: - [2011.03.25 22:25:34 | 000,030,320 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\vmnetuserif.sys -- (VMnetuserif)
DRV:64bit: - [2011.03.25 21:27:36 | 000,038,512 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\hcmon.sys -- (hcmon)
DRV:64bit: - [2011.03.25 19:05:00 | 000,037,680 | ---- | M] (VMware, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\vmusb.sys -- (vmusb)
DRV:64bit: - [2011.03.25 19:04:58 | 000,045,104 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\vmnetbridge.sys -- (VMnetBridge)
DRV:64bit: - [2011.03.25 19:04:58 | 000,020,016 | ---- | M] (VMware, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\vmnetadapter.sys -- (VMnetAdapter)
DRV:64bit: - [2010.11.20 14:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.20 14:32:47 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010.11.20 14:32:46 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2010.11.20 12:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2009.10.16 02:15:00 | 000,439,808 | ---- | M] (Ralink Technology, Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\netr6164.sys -- (rt61x64)
DRV:64bit: - [2009.07.14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.06.10 21:35:33 | 000,389,120 | ---- | M] (Marvell) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\yk62x64.sys -- (yukonw7)
DRV:64bit: - [2009.06.10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2008.04.29 22:24:30 | 000,022,568 | ---- | M] (Silicon Image, Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\SiWinAcc.sys -- (SiFilter)
DRV:64bit: - [2008.04.29 22:24:28 | 000,327,720 | ---- | M] (Silicon Image, Inc) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\Si3114r5.sys -- (Si3114r5)
DRV:64bit: - [2008.04.29 22:24:28 | 000,016,936 | ---- | M] (Silicon Image, Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\SiRemFil.sys -- (SiRemFil)
DRV:64bit: - [2005.03.29 00:30:38 | 000,008,192 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ASACPI.sys -- (MTsensor)
DRV - [2011.10.04 20:02:48 | 000,019,952 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Program Files (x86)\RivaTuner v2.24 (2009)\RivaTuner64.sys -- (RivaTuner64)
DRV - [2011.07.29 12:54:56 | 000,014,216 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysWOW64\epmntdrv.sys -- (epmntdrv)
DRV - [2011.07.29 12:54:56 | 000,008,456 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysWOW64\EuGdiDrv.sys -- (EuGdiDrv)
DRV - [2011.03.18 17:08:56 | 000,029,592 | ---- | M] (Almico Software) [Kernel | Boot | Running] -- C:\Windows\SysWOW64\speedfan.sys -- (speedfan)
DRV - [2010.08.19 12:56:38 | 000,032,816 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Program Files (x86)\VMware\VMware Player\vstor2-ws60.sys -- (vstor2-ws60)
DRV - [2009.07.14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://start.facemoods.com/?a=ddrnw&s={searchTerms}&f=4
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.facemoods.com/?a=ddrnw
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 3F F9 C1 42 B4 81 CC 01  [binary data]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:50182
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "Google"
FF - prefs.js..browser.search.selectedEngine: "Bing"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "about:home"
FF - prefs.js..network.proxy.http: "127.0.0.1"
FF - prefs.js..network.proxy.http_port: 50182
FF - prefs.js..network.proxy.type: 1
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_1_102.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre7\bin\new_plugin\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.01.08 13:47:19 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
 
[2011.10.03 12:04:51 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Tim\AppData\Roaming\mozilla\Extensions
[2012.01.24 20:23:45 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Tim\AppData\Roaming\mozilla\Firefox\Profiles\rkhorf1z.default\extensions
[2012.01.24 20:23:45 | 000,000,000 | ---D | M] (Ghostery) -- C:\Users\Tim\AppData\Roaming\mozilla\Firefox\Profiles\rkhorf1z.default\extensions\firefox@ghostery.com
[2012.01.08 13:47:20 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
() (No name found) -- C:\USERS\TIM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RKHORF1Z.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
[2012.01.08 13:47:19 | 000,121,816 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2011.09.29 02:24:37 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011.09.29 02:16:42 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2011.09.29 02:24:37 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2011.10.05 17:16:14 | 000,002,048 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\fcmdSrch.xml
[2011.09.29 02:24:37 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2011.09.29 02:24:37 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2011.09.29 02:24:37 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2009.06.10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O4:64bit: - HKLM..\Run: [RivaTunerStartupDaemon] C:\Program Files (x86)\RivaTuner v2.24 (2009)\RivaTunerWrapper.exe ()
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKCU..\Run: [Firefox helper] C:\Users\Tim\AppData\Local\Mozilla\Firefox\firefox.exe (Корпорация Майкрософт)
O4 - HKCU..\Run: [RGSC] C:\Program Files (x86)\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe /silent File not found
O4 - Startup: C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RivaTuner.lnk = C:\Program Files (x86)\RivaTuner v2.24 (2009)\RivaTunerWrapper.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HideSCAHealth = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 177
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000011 - C:\Program Files (x86)\VMware\VMware Player\x64\vsocklib.dll (VMware, Inc.)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000012 - C:\Program Files (x86)\VMware\VMware Player\x64\vsocklib.dll (VMware, Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\Program Files (x86)\VMware\VMware Player\vsocklib.dll (VMware, Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\Program Files (x86)\VMware\VMware Player\vsocklib.dll (VMware, Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0-windows-i586.cab (Java Plug-in 10.0.0)
O16 - DPF: {CAFEEFAC-0017-0000-0000-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0-windows-i586.cab (Java Plug-in 1.7.0)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0-windows-i586.cab (Java Plug-in 1.7.0)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Java Plug-in 1.6.0_27)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Java Plug-in 1.6.0_27)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Java Plug-in 1.6.0_27)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{465EB4F3-F379-4D71-B663-1D44B7351C50}: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{5B3DD339-2FDB-47E3-82DE-40E3C7D1861E}: DhcpNameServer = 192.168.0.1
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) -C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKCU Winlogon: Shell - (Explorer.exe) -C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
ActiveX:64bit: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework
ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
NetSvcs:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
 
MsConfig:64bit - StartUpFolder: C:^Users^Tim^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.3.lnk - C:\PROGRA~2\OPENOF~1.ORG\program\QUICKS~1.EXE - ()
MsConfig:64bit - StartUpReg: 056.exe - hkey= - key= -  File not found
MsConfig:64bit - StartUpReg: Adobe ARM - hkey= - key= - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
MsConfig:64bit - StartUpReg: facemoods - hkey= - key= -  File not found
MsConfig:64bit - StartUpReg: Firefox helper - hkey= - key= - C:\Users\Tim\AppData\Local\Mozilla\Firefox\firefox.exe (Корпорация Майкрософт)
MsConfig:64bit - StartUpReg: SunJavaUpdateSched - hkey= - key= - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
MsConfig:64bit - StartUpReg: VMware hqtray - hkey= - key= - C:\Program Files (x86)\VMware\VMware Player\hqtray.exe (VMware, Inc.)
MsConfig:64bit - State: "startup" - Reg Error: Key error.
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.01.25 20:04:28 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\Tim\Desktop\OTL.exe
[2012.01.25 18:13:06 | 000,000,000 | ---D | C] -- C:\Users\Tim\AppData\Roaming\Malwarebytes
[2012.01.25 18:12:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.01.25 18:12:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.01.25 18:12:58 | 000,023,152 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012.01.25 18:12:58 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2012.01.24 20:17:22 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\F078A
[2012.01.24 20:16:48 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\LP
[2012.01.24 20:16:48 | 000,000,000 | ---D | C] -- C:\Users\Tim\AppData\Roaming\067F0
[2012.01.14 07:41:06 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Easy-Shutdown
[2012.01.14 07:41:01 | 000,000,000 | ---D | C] -- C:\Windows\uninstall
[2012.01.13 17:55:15 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2012.01.10 17:19:20 | 000,000,000 | ---D | C] -- C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MP3Gain
[2012.01.10 17:19:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MP3Gain
[2012.01.10 17:19:19 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MP3Gain
[2012.01.09 21:26:29 | 000,000,000 | ---D | C] -- C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpeedFan
[2012.01.09 21:26:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SpeedFan
[2012.01.09 21:26:29 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\SpeedFan
[2008.08.11 14:24:00 | 006,389,760 | ---- | C] (Superfirm) -- C:\Program Files (x86)\Multidecoder.exe
 
========== Files - Modified Within 30 Days ==========
 
[2012.01.25 20:20:30 | 001,480,120 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.01.25 20:20:30 | 000,646,312 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.01.25 20:20:30 | 000,609,676 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.01.25 20:20:30 | 000,127,398 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.01.25 20:20:30 | 000,104,580 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.01.25 20:20:18 | 000,018,816 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.01.25 20:20:18 | 000,018,816 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.01.25 20:17:34 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.01.25 20:17:32 | 2146,783,231 | -HS- | M] () -- C:\hiberfil.sys
[2012.01.25 20:03:53 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Tim\Desktop\OTL.exe
[2012.01.25 18:13:00 | 000,001,113 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.01.24 20:54:50 | 000,001,123 | ---- | M] () -- C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RivaTuner.lnk
[2012.01.09 21:26:29 | 000,000,045 | ---- | M] () -- C:\Windows\SysWow64\initdebug.nfo
[2012.01.08 11:31:48 | 000,148,617 | ---- | M] () -- C:\Users\Tim\Desktop\nb020.jpg
[2012.01.04 10:31:46 | 000,187,166 | ---- | M] () -- C:\Users\Tim\Desktop\nb019.jpg
[2012.01.03 11:58:41 | 000,122,702 | ---- | M] () -- C:\Users\Tim\Desktop\nb018.jpg
 
========== Files Created - No Company Name ==========
 
[2012.01.25 18:13:00 | 000,001,113 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.01.24 20:27:07 | 000,001,123 | ---- | C] () -- C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RivaTuner.lnk
[2012.01.14 07:41:06 | 000,001,983 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Easy-Shutdown.lnk
[2012.01.09 21:26:29 | 000,000,045 | ---- | C] () -- C:\Windows\SysWow64\initdebug.nfo
[2012.01.08 11:31:48 | 000,148,617 | ---- | C] () -- C:\Users\Tim\Desktop\nb020.jpg
[2012.01.04 10:31:46 | 000,187,166 | ---- | C] () -- C:\Users\Tim\Desktop\nb019.jpg
[2012.01.03 11:58:41 | 000,122,702 | ---- | C] () -- C:\Users\Tim\Desktop\nb018.jpg
[2011.10.26 19:46:38 | 000,000,914 | ---- | C] () -- C:\Users\Tim\AppData\Roaming\burnaware.ini
[2011.10.10 21:30:23 | 000,007,645 | ---- | C] () -- C:\Users\Tim\AppData\Local\Resmon.ResmonCfg
[2011.10.07 21:28:27 | 001,499,556 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2011.10.05 18:42:46 | 000,001,769 | ---- | C] () -- C:\Windows\Language_trs.ini
[2011.10.03 19:20:11 | 002,469,760 | ---- | C] () -- C:\Windows\SysWow64\BootMan.exe
[2011.10.03 19:20:11 | 000,086,408 | ---- | C] () -- C:\Windows\SysWow64\setupempdrv03.exe
[2011.10.03 19:20:11 | 000,019,840 | ---- | C] () -- C:\Windows\SysWow64\EuEpmGdi.dll
[2011.10.03 19:20:11 | 000,014,216 | ---- | C] () -- C:\Windows\SysWow64\epmntdrv.sys
[2011.10.03 19:20:11 | 000,008,456 | ---- | C] () -- C:\Windows\SysWow64\EuGdiDrv.sys
[2011.08.03 02:31:54 | 000,311,912 | ---- | C] () -- C:\Windows\SysWow64\nvStreaming.exe
[2009.07.14 06:38:36 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009.07.14 03:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT
[2009.07.14 03:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat
[2009.07.14 01:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009.07.14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll
[2009.07.13 22:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2009.06.10 22:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat
[2008.10.22 05:29:06 | 000,173,550 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat
 
========== LOP Check ==========
 
[2012.01.25 19:53:08 | 000,000,000 | ---D | M] -- C:\Users\Tim\AppData\Roaming\067F0
[2011.12.17 20:43:48 | 000,000,000 | ---D | M] -- C:\Users\Tim\AppData\Roaming\Audacity
[2011.11.16 18:24:18 | 000,000,000 | ---D | M] -- C:\Users\Tim\AppData\Roaming\avidemux
[2011.10.26 21:40:37 | 000,000,000 | ---D | M] -- C:\Users\Tim\AppData\Roaming\Canneverbe Limited
[2012.01.25 19:01:50 | 000,000,000 | ---D | M] -- C:\Users\Tim\AppData\Roaming\foobar2000
[2011.10.30 18:47:33 | 000,000,000 | ---D | M] -- C:\Users\Tim\AppData\Roaming\GetRightToGo
[2011.11.24 19:35:27 | 000,000,000 | ---D | M] -- C:\Users\Tim\AppData\Roaming\ImgBurn
[2011.10.09 16:32:54 | 000,000,000 | ---D | M] -- C:\Users\Tim\AppData\Roaming\mkvtoolnix
[2011.10.06 16:40:37 | 000,000,000 | ---D | M] -- C:\Users\Tim\AppData\Roaming\OpenOffice.org
[2012.01.23 20:13:40 | 000,000,000 | ---D | M] -- C:\Users\Tim\AppData\Roaming\uTorrent
[2009.07.14 06:08:49 | 000,026,838 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %SYSTEMDRIVE%\*. >
[2011.10.02 16:12:12 | 000,000,000 | -HSD | M] -- C:\$Recycle.Bin
[2012.01.14 18:27:45 | 000,000,000 | -HSD | M] -- C:\Config.Msi
[2009.07.14 06:08:56 | 000,000,000 | -HSD | M] -- C:\Documents and Settings
[2011.10.02 16:12:06 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen
[2011.10.05 18:42:46 | 000,000,000 | ---D | M] -- C:\Intel
[2011.11.01 19:51:10 | 000,000,000 | ---D | M] -- C:\NVIDIA
[2009.07.14 04:20:08 | 000,000,000 | ---D | M] -- C:\PerfLogs
[2011.12.17 15:52:16 | 000,000,000 | R--D | M] -- C:\Program Files
[2012.01.25 18:12:58 | 000,000,000 | R--D | M] -- C:\Program Files (x86)
[2012.01.25 18:12:59 | 000,000,000 | -H-D | M] -- C:\ProgramData
[2011.10.02 16:12:06 | 000,000,000 | -HSD | M] -- C:\Programme
[2011.10.02 16:12:06 | 000,000,000 | -HSD | M] -- C:\Recovery
[2012.01.25 20:19:31 | 000,000,000 | -HSD | M] -- C:\System Volume Information
[2011.10.02 16:12:09 | 000,000,000 | R--D | M] -- C:\Users
[2012.01.14 07:41:01 | 000,000,000 | ---D | M] -- C:\Windows
 
< %PROGRAMFILES%\*.exe >
[2011.10.03 16:43:36 | 006,389,760 | ---- | M] (Superfirm) -- C:\Program Files (x86)\Multidecoder.exe
 
< %LOCALAPPDATA%\*.exe >
 
< %systemroot%\*. /mp /s >
 
 
< MD5 for: AGP440.SYS  >
[2009.07.14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\drivers\AGP440.sys
[2009.07.14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\DriverStore\FileRepository\machine.inf_amd64_neutral_a2f120466549d68b\AGP440.sys
[2009.07.14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_1607dee2d861e021\AGP440.sys
[2009.07.14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_1838f2aad55063bb\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\drivers\atapi.sys
[2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\DriverStore\FileRepository\mshdc.inf_amd64_neutral_aad30bdeec04ea5e\atapi.sys
[2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_392d19c13b3ad543\atapi.sys
[2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_3b5e2d89382958dd\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll
[2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
[2009.07.14 02:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\SysNative\cngaudit.dll
[2009.07.14 02:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll
 
< MD5 for: EXPLORER.EXE  >
[2009.07.14 02:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_b7fe430bc7ce3761\explorer.exe
[2009.10.31 06:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_b819b343c7ba6202\explorer.exe
[2010.11.20 13:17:09 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- C:\Windows\SysWOW64\explorer.exe
[2010.11.20 13:17:09 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe
[2009.08.03 07:19:07 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=700073016DAC1C3D2E7E2CE4223334B6 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_ae84b558ac4eb41c\explorer.exe
[2009.10.31 07:34:59 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=9AAAEC8DAC27AA17B053E6352AD233AE -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_adc508f19359a007\explorer.exe
[2009.08.03 06:49:47 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_b8d95faae0af7617\explorer.exe
[2010.11.20 14:24:45 | 002,872,320 | ---- | M] (Microsoft Corporation) MD5=AC4C51EB24AA95B77F705AB159189E24 -- C:\Windows\explorer.exe
[2010.11.20 14:24:45 | 002,872,320 | ---- | M] (Microsoft Corporation) MD5=AC4C51EB24AA95B77F705AB159189E24 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe
[2009.10.31 07:38:38 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=B8EC4BD49CE8F6FC457721BFC210B67F -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_ae46d6aeac7ca7c7\explorer.exe
[2009.08.03 06:35:50 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_b853c407c78e3ba9\explorer.exe
[2009.07.14 02:39:10 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=C235A51CB740E45FFA0EBFB9BAFCDA64 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_ada998b9936d7566\explorer.exe
[2009.10.31 07:00:51 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_b89b8100e0dd69c2\explorer.exe
[2009.08.03 07:17:37 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=F170B4A061C9E026437B193B4D571799 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_adff19b5932d79ae\explorer.exe
 
< MD5 for: IASTOR.SYS  >
[2011.05.20 08:53:44 | 000,557,848 | ---- | M] (Intel Corporation) MD5=2FDAEC4B02729C48C0FD1B0B4695995B -- C:\Windows\SysNative\drivers\iaStor.sys
[2011.05.20 08:53:44 | 000,557,848 | ---- | M] (Intel Corporation) MD5=2FDAEC4B02729C48C0FD1B0B4695995B -- C:\Windows\SysNative\DriverStore\FileRepository\iaahci.inf_amd64_neutral_e6913aab23ea9a9c\iaStor.sys
 
< MD5 for: IASTORV.SYS  >
[2010.11.20 14:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\SysNative\drivers\iaStorV.sys
[2010.11.20 14:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_668286aa35d55928\iaStorV.sys
[2010.11.20 14:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_0d3757e79e6784d0\iaStorV.sys
[2009.07.14 02:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_0b06441fa1790136\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2009.07.14 02:41:52 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_59aca8ea51aaeefe\netlogon.dll
[2010.11.20 14:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\SysNative\netlogon.dll
[2010.11.20 14:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_5bddbcb24e997298\netlogon.dll
[2010.11.20 13:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\SysWOW64\netlogon.dll
[2010.11.20 13:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_6632670482fa3493\netlogon.dll
[2009.07.14 02:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_6401533c860bb0f9\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2009.07.14 02:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_95cfb4ced8afab0e\nvstor.sys
[2010.11.20 14:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\SysNative\drivers\nvstor.sys
[2010.11.20 14:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_dd659ed032d28a14\nvstor.sys
[2010.11.20 14:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_9800c896d59e2ea8\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2009.07.14 02:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9e577e55272d37b4\scecli.dll
[2009.07.14 02:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9402d402f2cc75b9\scecli.dll
[2010.11.20 13:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\SysWOW64\scecli.dll
[2010.11.20 13:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_a088921d241bbb4e\scecli.dll
[2010.11.20 14:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\SysNative\scecli.dll
[2010.11.20 14:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_9633e7caefbaf953\scecli.dll
 
< MD5 for: USER32.DLL  >
[2010.11.20 13:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\SysWOW64\user32.dll
[2010.11.20 13:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll
[2009.07.14 02:41:56 | 001,008,640 | ---- | M] (Microsoft Corporation) MD5=72D7B3EA16946E8F0CF7458150031CC6 -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_292d5de8870d85d9\user32.dll
[2009.07.14 02:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_3382083abb6e47d4\user32.dll
[2010.11.20 14:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\SysNative\user32.dll
[2010.11.20 14:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2010.11.20 13:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SysWOW64\userinit.exe
[2010.11.20 13:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2009.07.14 02:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
[2009.07.14 02:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe
[2010.11.20 14:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\SysNative\userinit.exe
[2010.11.20 14:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2010.11.20 14:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\SysNative\winlogon.exe
[2010.11.20 14:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe
[2009.07.14 02:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe
[2009.10.28 08:01:57 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe
[2011.12.24 17:50:20 | 000,182,856 | ---- | M] () MD5=B382935AB01B27D0E14F267DBF288896 -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2009.10.28 07:24:40 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2009.07.14 01:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\SysNative\drivers\ws2ifsl.sys
[2009.07.14 01:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\system32\*.dll /lockedfiles >
 
< %USERPROFILE%\*.* >
[2012.01.25 20:21:28 | 001,835,008 | -HS- | M] () -- C:\Users\Tim\ntuser.dat
[2012.01.25 20:21:28 | 000,262,144 | -HS- | M] () -- C:\Users\Tim\ntuser.dat.LOG1
[2011.10.02 16:12:10 | 000,000,000 | -HS- | M] () -- C:\Users\Tim\ntuser.dat.LOG2
[2011.10.02 16:36:53 | 000,065,536 | -HS- | M] () -- C:\Users\Tim\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf
[2011.10.02 16:36:53 | 000,524,288 | -HS- | M] () -- C:\Users\Tim\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms
[2011.10.02 16:36:53 | 000,524,288 | -HS- | M] () -- C:\Users\Tim\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms
[2011.10.04 22:05:34 | 000,065,536 | -HS- | M] () -- C:\Users\Tim\ntuser.dat{bd3487c0-ee9c-11e0-a1ac-001d60acef2b}.TM.blf
[2011.10.04 22:05:34 | 000,524,288 | -HS- | M] () -- C:\Users\Tim\ntuser.dat{bd3487c0-ee9c-11e0-a1ac-001d60acef2b}.TMContainer00000000000000000001.regtrans-ms
[2011.10.04 22:05:34 | 000,524,288 | -HS- | M] () -- C:\Users\Tim\ntuser.dat{bd3487c0-ee9c-11e0-a1ac-001d60acef2b}.TMContainer00000000000000000002.regtrans-ms
[2011.10.02 16:12:10 | 000,000,020 | -HS- | M] () -- C:\Users\Tim\ntuser.ini
 
< %USERPROFILE%\Local Settings\Temp\*.exe >
 
< %USERPROFILE%\Local Settings\Temp\*.dll >
 
< %USERPROFILE%\Application Data\*.exe >
 
< HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs >
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Required: DebugWindows [binary data]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Windows: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16

< End of report >
         

Extras.txt

OTL Extras logfile created on: 25.01.2012 20:18:33 - Run 1
OTL by OldTimer - Version 3.2.31.0     Folder = C:\Users\Tim\Desktop
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
8,00 Gb Total Physical Memory | 6,72 Gb Available Physical Memory | 84,01% Memory free
16,00 Gb Paging File | 14,69 Gb Available in Paging File | 91,86% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 59,53 Gb Total Space | 10,85 Gb Free Space | 18,22% Space Free | Partition Type: NTFS
Drive E: | 596,17 Gb Total Space | 23,72 Gb Free Space | 3,98% Space Free | Partition Type: NTFS
Drive T: | 1863,02 Gb Total Space | 86,27 Gb Free Space | 4,63% Space Free | Partition Type: NTFS
 
Computer Name: TIM-PC | User Name: Tim | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html[@ = htmlfile] -- Reg Error: Key error. File not found
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = htmlfile] -- Reg Error: Key error. File not found
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- Reg Error: Key error.
htmlfile [opennew] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] -- "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
https [open] -- "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- Reg Error: Key error.
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Key error.
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- Reg Error: Key error.
htmlfile [opennew] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] -- "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
https [open] -- "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- Reg Error: Key error.
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Key error.
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{26A24AE4-039D-4CA4-87B4-2F86417000FF}" = Java(TM) 7 (64-bit)
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{7A61142C-CA19-4F3C-BA66-FF8F131501FA}" = Paint.NET v3.5.9
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision Treiber 280.26
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 280.26
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 280.26
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB" = NVIDIA 3D Vision Controller-Treiber 280.19
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX-Systemsoftware 9.10.0514
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin 64-bit
"MediaInfo" = MediaInfo 0.7.50
"Ultravnc2_is1" = UltraVnc
"uTorrent" = µTorrent
"WinRAR archiver" = WinRAR 4.01 (64-bit)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{26A24AE4-039D-4CA4-87B4-2F83216022F0}" = Java(TM) 6 Update 22
"{26A24AE4-039D-4CA4-87B4-2F83216027FF}" = Java(TM) 6 Update 27
"{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}" = Intel(R) Rapid Storage Technology
"{4286716B-1287-48E7-9078-3DC8248DBA96}" = OpenOffice.org 3.3
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{51C7AD07-C3F6-4635-8E8A-231306D810FE}" = Cisco LEAP Module
"{5454083B-1308-4485-BF17-1110000D8301}" = Grand Theft Auto IV
"{579BA58C-F33D-4970-9953-B94B43768AC3}" = Grand Theft Auto IV
"{59E4543A-D49D-4489-B445-473D763C79AF}" = Microsoft Games for Windows - LIVE Redistributable
"{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}" = Cisco EAP-FAST Module
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{A53A11EA-0095-493F-86FA-A15E8A86A405}" = VMware Player
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.2) - Deutsch
"{B9DB4C76-01A4-46D5-8910-F7AA6376DBAF}" = NVIDIA PhysX
"{ED5776D5-59B4-46B7-AF81-5F2D94D7C640}" = Cisco PEAP Module
"{FAB1F336-1B7C-4057-A7BC-2922CD82A781}" = Edimax RT6x Wireless LAN Card
"{FFD9383C-01D5-4897-A954-43AF599AED30}" = tools-windows
"5513-1208-7298-9440" = JDownloader 0.9
"Audacity 1.3 Beta (Unicode)_is1" = Audacity 1.3.14 (Unicode)
"Avidemux 2.5 (64-bit)" = Avidemux 2.5
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"EASEUS Partition Master Home Edition_is1" = EASEUS Partition Master 9.1.0 Home Edition
"Easy-Shutdown" = Easy-Shutdown 1.3 
"foobar2000" = foobar2000 v1.1.8
"HD Tune_is1" = HD Tune 2.55
"ImgBurn" = ImgBurn
"IsoBuster_is1" = IsoBuster 2.8.5
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.60.0.1800
"MKVtoolnix" = MKVtoolnix 5.0.0
"Mozilla Firefox 9.0.1 (x86 de)" = Mozilla Firefox 9.0.1 (x86 de)
"NVIDIA StereoUSB Driver" = NVIDIA 3D Vision Controller Driver
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"RivaTuner" = RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition
"SpeedFan" = SpeedFan (remove only)
"SyncBack_is1" = SyncBack
"TeamViewer 7" = TeamViewer 7
"VLC media player" = VLC media player 1.1.11
"VMware_Player" = VMware Player
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 22.12.2011 07:50:19 | Computer Name = Tim-PC | Source = Application Hang | ID = 1002
Description = Programm firefox.exe, Version 8.0.0.4325 kann nicht mehr unter Windows
 ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung,
 um nach weiteren Informationen zum Problem zu suchen.    Prozess-ID: a00    Startzeit: 
01ccbff19f9b1ef7    Endzeit: 99    Anwendungspfad: C:\Program Files (x86)\Mozilla Firefox\firefox.exe

Berichts-ID:
   
 
Error - 23.12.2011 07:45:39 | Computer Name = Tim-PC | Source = Application Hang | ID = 1002
Description = Programm firefox.exe, Version 8.0.0.4325 kann nicht mehr unter Windows
 ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung,
 um nach weiteren Informationen zum Problem zu suchen.    Prozess-ID: 1b90    Startzeit:
 01ccc09fe267687e    Endzeit: 64    Anwendungspfad: C:\Program Files (x86)\Mozilla Firefox\firefox.exe

Berichts-ID:
 96582dc3-2d5b-11e1-a354-005056c00001  
 
Error - 02.01.2012 16:08:42 | Computer Name = Tim-PC | Source = Application Hang | ID = 1002
Description = Programm firefox.exe, Version 8.0.0.4325 kann nicht mehr unter Windows
 ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung,
 um nach weiteren Informationen zum Problem zu suchen.    Prozess-ID: d70    Startzeit: 
01ccc168681a7442    Endzeit: 66    Anwendungspfad: C:\Program Files (x86)\Mozilla Firefox\firefox.exe

Berichts-ID:
   
 
Error - 03.01.2012 06:03:22 | Computer Name = Tim-PC | Source = Microsoft-Windows-Defrag | ID = 257
Description = 
 
Error - 03.01.2012 06:34:52 | Computer Name = Tim-PC | Source = Application Hang | ID = 1002
Description = Programm firefox.exe, Version 8.0.0.4325 kann nicht mehr unter Windows
 ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung,
 um nach weiteren Informationen zum Problem zu suchen.    Prozess-ID: 1880    Startzeit:
 01ccc98a56486455    Endzeit: 60    Anwendungspfad: C:\Program Files (x86)\Mozilla Firefox\firefox.exe

Berichts-ID:
   
 
Error - 04.01.2012 07:23:08 | Computer Name = Tim-PC | Source = Application Hang | ID = 1002
Description = Programm firefox.exe, Version 8.0.0.4325 kann nicht mehr unter Windows
 ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung,
 um nach weiteren Informationen zum Problem zu suchen.    Prozess-ID: 990    Startzeit: 
01ccca0354b0e82f    Endzeit: 52    Anwendungspfad: C:\Program Files (x86)\Mozilla Firefox\firefox.exe

Berichts-ID:
   
 
Error - 08.01.2012 08:47:16 | Computer Name = Tim-PC | Source = Application Hang | ID = 1002
Description = Programm firefox.exe, Version 8.0.0.4325 kann nicht mehr unter Windows
 ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung,
 um nach weiteren Informationen zum Problem zu suchen.    Prozess-ID: 1894    Startzeit:
 01cccd354c0f57b1    Endzeit: 84    Anwendungspfad: C:\Program Files (x86)\Mozilla Firefox\firefox.exe

Berichts-ID:
   
 
Error - 08.01.2012 15:17:00 | Computer Name = Tim-PC | Source = Application Hang | ID = 1002
Description = Programm Explorer.EXE, Version 6.1.7601.17514 kann nicht mehr unter
 Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf 
in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem
 zu suchen.    Prozess-ID: a7c    Startzeit: 01ccbff05f88683d    Endzeit: 21050    Anwendungspfad:
 C:\Windows\Explorer.EXE    Berichts-ID: 422cbdf9-3a2d-11e1-a354-005056c00001  
 
Error - 10.01.2012 12:23:14 | Computer Name = Tim-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: MP3GainGUI.exe, Version: 1.3.0.4,
 Zeitstempel: 0x41e0466a  Name des fehlerhaften Moduls: MSCOMCTL.OCX, Version: 6.0.88.62,
 Zeitstempel: 0x39247822  Ausnahmecode: 0xc0000005  Fehleroffset: 0x00084a28  ID des fehlerhaften
 Prozesses: 0x1b20  Startzeit der fehlerhaften Anwendung: 0x01cccfb39f11f8ad  Pfad der
 fehlerhaften Anwendung: C:\Program Files (x86)\MP3Gain\MP3GainGUI.exe  Pfad des fehlerhaften
 Moduls: C:\Windows\SysWow64\MSCOMCTL.OCX  Berichtskennung: 64f7f027-3ba7-11e1-a354-005056c00001
 
Error - 25.01.2012 15:12:59 | Computer Name = Tim-PC | Source = Application Hang | ID = 1002
Description = Programm OTL.exe, Version 3.2.31.0 kann nicht mehr unter Windows ausgeführt
 werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung,
 um nach weiteren Informationen zum Problem zu suchen.    Prozess-ID: 10f8    Startzeit:
 01ccdb944d043334    Endzeit: 10    Anwendungspfad: C:\Users\Tim\Desktop\OTL.exe    Berichts-ID:
   
 
[ System Events ]
Error - 24.01.2012 15:53:24 | Computer Name = Tim-PC | Source = ipnathlp | ID = 31004
Description = 
 
Error - 25.01.2012 11:54:57 | Computer Name = Tim-PC | Source = ipnathlp | ID = 31004
Description = 
 
Error - 25.01.2012 12:10:22 | Computer Name = Tim-PC | Source = ipnathlp | ID = 31004
Description = 
 
Error - 25.01.2012 12:32:57 | Computer Name = Tim-PC | Source = ipnathlp | ID = 31004
Description = 
 
Error - 25.01.2012 12:48:23 | Computer Name = Tim-PC | Source = ipnathlp | ID = 31004
Description = 
 
Error - 25.01.2012 13:03:41 | Computer Name = Tim-PC | Source = ipnathlp | ID = 31004
Description = 
 
Error - 25.01.2012 13:50:42 | Computer Name = Tim-PC | Source = ipnathlp | ID = 31004
Description = 
 
Error - 25.01.2012 14:06:31 | Computer Name = Tim-PC | Source = ipnathlp | ID = 31004
Description = 
 
Error - 25.01.2012 15:16:42 | Computer Name = Tim-PC | Source = Microsoft-Windows-Directory-Services-SAM | ID = 12291
Description = Das SAM-Modul konnte den TCP/IP- bzw. SPX/IPX-Listening-Thread nicht
 starten.
 
Error - 25.01.2012 15:17:55 | Computer Name = Tim-PC | Source = ipnathlp | ID = 31004
Description = 
 
 
< End of report >
         

hi


dieses script sowie evtl. folgende scripts sind nur für den jeweiligen user.
wenn ihr probleme habt, eröffnet eigene topics und wartet auf, für euch angepasste scripts.


• Starte bitte die OTL.exe
• Kopiere nun das Folgende in die Textbox.

:OTL
O4 - HKCU..\Run: [Firefox helper] C:\Users\Tim\AppData\Local\Mozilla\Firefox\firefox.exe (Корпорация Майкрософт)
 :Files
C:\Users\Tim\AppData\Local\Mozilla\Firefox\firefox.exe
:Commands
[purity]
[EMPTYFLASH] 
[emptytemp]
[Reboot]
         

• Schliesse bitte nun alle Programme.
• Klicke nun bitte auf den Fix Button.
• OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
• Nach dem Neustart findest Du ein Textdokument, dessen inhalt in deiner nächsten antwort hier reinkopieren.
starte in den normalen modus.

falls du keine symbole hast, dann rechtsklick, ansicht, desktop symbole einblenden

Drücke bitte die + E Taste.

• Öffne dein Systemlaufwerk ( meistens C: )
• Suche nun
  folgenden Ordner: _OTL und öffne diesen.
• Mache einen Rechtsklick auf den Ordner Movedfiles --> Senden an --> Zip-Komprimierter Ordner
• 
  Dies wird eine Movedfiles.zip Datei in _OTL erstellen
• Lade diese bitte in unseren Uploadchannel
  hoch. ( Durchsuchen --> C:\_OTL\Movedfiles.zip )

Teile mir mit ob der Upload problemlos geklappt hat. Danke im voraus

der upload hat geklappt. (meiner meinung nach)

hier die .log datei

01252012_213250

All processes killed
========== OTL ==========
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\Firefox helper deleted successfully.
C:\Users\Tim\AppData\Local\Mozilla\Firefox\firefox.exe moved successfully.
========== COMMANDS ==========
 
[EMPTYFLASH]
 
User: All Users
 
User: Default
 
User: Default User
 
User: Public
 
User: Tim
->Flash cache emptied: 470 bytes
 
Total Flash Files Cleaned = 0,00 mb
 
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Public
 
User: Tim
->Temp folder emptied: 97698642 bytes
->Temporary Internet Files folder emptied: 20183936 bytes
->Java cache emptied: 303355 bytes
->FireFox cache emptied: 52426235 bytes
->Flash cache emptied: 0 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 5439503 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 67765 bytes
RecycleBin emptied: 6471027897 bytes
 
Total Files Cleaned = 6.339,00 mb
 
 
OTL by OldTimer - Version 3.2.31.0 log created on 01252012_213250

Files\Folders moved on Reboot...
C:\Users\Tim\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
C:\Windows\temp\vmware-SYSTEM\vmware-usbarb-SYSTEM-1884.log moved successfully.

Registry entries deleted on Reboot...
         

danke, hat geklappt

Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich
ziehen und eine Bereinigung der Infektion noch erschweren.

Bitte downloade dir Combofix.exe und speichere es unbedingt auf deinem Desktop.

• Besuche folgende Seite für Downloadlinks und Anweisungen für dieses
  Tool
  
  Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  
• Hinweis:
  Gehe sicher das all deine Anti Virus und Anti Malware Programme abgeschalten sind, damit diese Combofix nicht bei der Arbeit stören.
  
• Poste bitte die C:\Combofix.txt in deiner nächsten Antwort.

so, habe genau die anleitung befolgt, alles geschlossen und auch windows firewall und avira antivir deaktiviert (und sogar per expertenmodus prozesse beendet). combofix meinte zwar antivir wäre noch aktiv, hat aber trotzdem geklappt.

hier die logdatei "Combofix.txt"

ComboFix 12-01-26.01 - Tim 26.01.2012  16:48:35.1.4 - x64
Microsoft Windows 7 Professional   6.1.7601.1.1252.49.1031.18.8191.6737 [GMT 1:00]
ausgeführt von:: c:\users\Tim\Desktop\ComboFix.exe
AV: AntiVir Desktop *Enabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: AntiVir Desktop *Enabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\facemoods.com
c:\program files (x86)\facemoods.com\facemoodsdddd\1.4.17.11\dddd.exe
c:\program files (x86)\LP
c:\program files (x86)\LP\0010\4E21.tmp
c:\program files (x86)\LP\0010\55D2.tmp
c:\program files (x86)\LP\0010\5642.tmp
c:\program files (x86)\LP\0010\8C59.tmp
c:\program files (x86)\LP\0010\966B.tmp
c:\program files (x86)\LP\0010\CC83.tmp
c:\program files (x86)\LP\0010\D5CC.tmp
c:\windows\system32\drivers\etc\hosts.ics
c:\windows\system32\java.exe
.
.
(((((((((((((((((((((((   Dateien erstellt von 2011-12-26 bis 2012-01-26  ))))))))))))))))))))))))))))))
.
.
2012-01-26 15:50 . 2012-01-26 15:50	--------	d-----w-	c:\users\Default\AppData\Local\temp
2012-01-26 15:46 . 2012-01-26 15:46	--------	d-----w-	c:\users\Tim\AppData\Roaming\Avira
2012-01-25 20:32 . 2012-01-25 20:38	--------	d-----w-	C:\_OTL
2012-01-25 17:13 . 2012-01-25 17:13	--------	d-----w-	c:\users\Tim\AppData\Roaming\Malwarebytes
2012-01-25 17:12 . 2012-01-25 17:12	--------	d-----w-	c:\programdata\Malwarebytes
2012-01-25 17:12 . 2012-01-25 17:13	--------	d-----w-	c:\program files (x86)\Malwarebytes' Anti-Malware
2012-01-25 17:12 . 2011-12-10 14:24	23152	----a-w-	c:\windows\system32\drivers\mbam.sys
2012-01-24 19:17 . 2012-01-25 17:25	--------	d-----w-	c:\program files (x86)\F078A
2012-01-24 19:16 . 2012-01-25 18:53	--------	d-----w-	c:\users\Tim\AppData\Roaming\067F0
2012-01-24 14:47 . 2012-01-06 05:15	8602168	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{ACDA49D7-47DC-4742-8542-05E6ACF593A5}\mpengine.dll
2012-01-14 06:41 . 2012-01-14 06:41	--------	d-----w-	c:\program files (x86)\Easy-Shutdown
2012-01-14 06:41 . 2012-01-14 06:41	--------	d-----w-	c:\windows\uninstall
2012-01-11 15:35 . 2011-11-17 06:41	1731920	----a-w-	c:\windows\system32\ntdll.dll
2012-01-11 15:35 . 2011-11-17 05:38	1292080	----a-w-	c:\windows\SysWow64\ntdll.dll
2012-01-11 15:34 . 2011-10-26 05:25	1572864	----a-w-	c:\windows\system32\quartz.dll
2012-01-11 15:34 . 2011-10-26 05:25	366592	----a-w-	c:\windows\system32\qdvd.dll
2012-01-11 15:34 . 2011-10-26 04:32	514560	----a-w-	c:\windows\SysWow64\qdvd.dll
2012-01-11 15:34 . 2011-10-26 04:32	1328128	----a-w-	c:\windows\SysWow64\quartz.dll
2012-01-11 15:22 . 2011-11-19 14:58	77312	----a-w-	c:\windows\system32\packager.dll
2012-01-11 15:22 . 2011-11-19 14:01	67072	----a-w-	c:\windows\SysWow64\packager.dll
2012-01-10 16:19 . 2012-01-10 16:30	--------	d-----w-	c:\program files (x86)\MP3Gain
2012-01-09 20:26 . 2012-01-09 20:29	--------	d-----w-	c:\program files (x86)\SpeedFan
2012-01-08 12:47 . 2012-01-08 12:47	626688	----a-w-	c:\program files (x86)\Mozilla Firefox\msvcr80.dll
2012-01-08 12:47 . 2012-01-08 12:47	548864	----a-w-	c:\program files (x86)\Mozilla Firefox\msvcp80.dll
2012-01-08 12:47 . 2012-01-08 12:47	479232	----a-w-	c:\program files (x86)\Mozilla Firefox\msvcm80.dll
2012-01-08 12:47 . 2012-01-08 12:47	43992	----a-w-	c:\program files (x86)\Mozilla Firefox\mozutils.dll
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-12-17 14:52 . 2011-12-17 14:52	12904	----a-w-	c:\windows\system32\drivers\mv2.sys
2011-12-17 14:52 . 2011-12-17 14:52	27240	----a-w-	c:\windows\system32\mv2.dll
2011-12-15 10:02 . 2011-10-03 11:16	414368	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2011-11-24 04:52 . 2011-12-14 18:32	3145216	----a-w-	c:\windows\system32\win32k.sys
2011-11-15 13:29 . 2011-10-03 10:18	270720	------w-	c:\windows\system32\MpSigStub.exe
2011-11-05 05:32 . 2011-12-14 18:29	2048	----a-w-	c:\windows\system32\tzres.dll
2011-11-05 04:26 . 2011-12-14 18:29	2048	----a-w-	c:\windows\SysWow64\tzres.dll
2011-10-31 17:38 . 2011-10-31 17:38	178800	----a-w-	c:\windows\SysWow64\CmdLineExt_x64.dll
2011-10-03 15:43 . 2008-08-11 13:24	6389760	----a-w-	c:\program files (x86)\Multidecoder.exe
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2011-04-21 281768]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2011-05-20 284440]
"Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-12-24 460872]
.
c:\users\Tim\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
RivaTuner.lnk - c:\program files (x86)\RivaTuner v2.24 (2009)\RivaTunerWrapper.exe [2009-8-22 24576]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Wireless Utility.lnk - c:\program files (x86)\Edimax\Common\RaUI.exe [2011-10-3 1617920]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"HideSCAHealth"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
R3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys [2011-07-29 16776]
R3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys [2011-07-29 9096]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 uvnc_service;uvnc_service;c:\program files\UltraVNC\WinVNC.exe [2011-05-18 2169592]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]
S2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2011-04-21 136360]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2011-05-20 13592]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-12-24 652872]
S2 RalinkRegistryWriter64;Ralink Registry Writer 64;c:\program files (x86)\Edimax\Common\RaRegistry64.exe [2009-10-06 212256]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-08-03 379496]
S2 TeamViewer7;TeamViewer 7;c:\program files (x86)\TeamViewer\Version7\TeamViewer_Service.exe [2011-12-14 2984832]
S2 vmci;VMware vmci;c:\windows\system32\drivers\vmci.sys [x]
S2 VMUSBArbService;VMware USB Arbitration Service;c:\program files (x86)\Common Files\VMware\USB\vmware-usbarbitrator.exe [2011-03-25 539248]
S3 ALSysIO;ALSysIO;c:\users\Tim\AppData\Local\Temp\ALSysIO64.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]
S3 mv2;mv2;c:\windows\system32\DRIVERS\mv2.sys [x]
S3 RivaTuner64;RivaTuner64;c:\program files (x86)\RivaTuner v2.24 (2009)\RivaTuner64.sys [2011-10-04 19952]
S3 rt61x64;RT61 Extensible Wireless Driver;c:\windows\system32\DRIVERS\netr6164.sys [x]
S3 yukonw7;NDIS6.2-Miniporttreiber für Marvell Yukon-Ethernet-Controller;c:\windows\system32\DRIVERS\yk62x64.sys [x]
.
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RivaTunerStartupDaemon"="c:\program files (x86)\RivaTuner v2.24 (2009)\RivaTunerWrapper.exe" [2009-08-22 24576]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://start.facemoods.com/?a=ddrnw
uInternet Settings,ProxyServer = http=127.0.0.1:50182
LSP: c:\program files (x86)\VMware\VMware Player\vsocklib.dll
TCP: DhcpNameServer = 192.168.0.1
FF - ProfilePath - c:\users\Tim\AppData\Roaming\Mozilla\Firefox\Profiles\rkhorf1z.default\
FF - prefs.js: browser.search.selectedEngine - Bing
FF - prefs.js: browser.startup.homepage - about:home
FF - prefs.js: network.proxy.http - 127.0.0.1
FF - prefs.js: network.proxy.http_port - 50182
FF - prefs.js: network.proxy.type - 1
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKCU-Run-RGSC - c:\program files (x86)\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-1348303554-1960285835-3578576916-1000\Software\SecuROM\License information*]
"datasecu"=hex:d3,0f,1f,22,be,9d,7f,d5,6e,da,5b,0d,89,68,f1,85,af,78,8f,31,b2,
   06,55,b1,26,e5,9a,0c,2e,39,a2,35,47,77,5c,71,d4,a5,0f,5e,39,ce,63,68,b0,38,\
"rkeysecu"=hex:2f,0f,d5,3e,02,2b,06,63,b1,0b,dd,b6,71,e2,54,98
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2012-01-26  16:52:17
ComboFix-quarantined-files.txt  2012-01-26 15:52
.
Vor Suchlauf: 9 Verzeichnis(se), 12.209.434.624 Bytes frei
Nach Suchlauf: 13 Verzeichnis(se), 12.097.150.976 Bytes frei
.
- - End Of File - - 94E01C5BF25844EAB6853A0AB5D5ACF1
         

öffne malwarebytes, logdateien, poste alle berichte.

von gestern

2012/01/25 18:13:38 +0100	TIM-PC	Tim	MESSAGE	Starting protection
2012/01/25 18:13:39 +0100	TIM-PC	Tim	MESSAGE	Protection started successfully
2012/01/25 18:13:42 +0100	TIM-PC	Tim	MESSAGE	Starting IP protection
2012/01/25 18:13:43 +0100	TIM-PC	Tim	MESSAGE	IP Protection started successfully
2012/01/25 18:14:30 +0100	TIM-PC	Tim	IP-BLOCK	114.207.112.26 (Type: outgoing, Port: 50714, Process: 056.exe)
2012/01/25 18:14:38 +0100	TIM-PC	Tim	IP-BLOCK	109.163.226.203 (Type: outgoing, Port: 50716, Process: c0000.exe)
2012/01/25 18:19:10 +0100	TIM-PC	Tim	DETECTION	C:\Users\Tim\AppData\Roaming\067F0\C0000.exe	Trojan.Downloader.BH	ALLOW
2012/01/25 18:19:11 +0100	TIM-PC	Tim	DETECTION	C:\Users\Tim\AppData\Local\Mozilla\Firefox\firefox.exe	Trojan.FakeMS	ALLOW
2012/01/25 18:19:11 +0100	TIM-PC	Tim	DETECTION	C:\Program Files (x86)\LP\0010\056.exe	Trojan.Downloader.BH	ALLOW
2012/01/25 18:19:18 +0100	TIM-PC	Tim	IP-BLOCK	114.207.112.26 (Type: outgoing, Port: 50933, Process: c0000.exe)
2012/01/25 18:20:01 +0100	TIM-PC	Tim	DETECTION	C:\Users\Tim\AppData\Roaming\067F0\C0000.exe	Trojan.Downloader.BH	QUARANTINE
2012/01/25 18:20:01 +0100	TIM-PC	Tim	DETECTION	C:\Users\Tim\AppData\Roaming\067F0\C0000.exe	Trojan.Downloader.BH	DENY
2012/01/25 18:20:01 +0100	TIM-PC	Tim	ERROR	Quarantine failed:  DeleteFile failed with error code 5
2012/01/25 18:25:08 +0100	TIM-PC	Tim	DETECTION	C:\Program Files (x86)\F078A\lvvm.exe	Trojan.Downloader.BH	QUARANTINE
2012/01/25 18:25:28 +0100	TIM-PC	Tim	DETECTION	C:\Program Files (x86)\LP\0010\CC83.exe	Trojan.Downloader.BH	QUARANTINE
2012/01/25 18:25:42 +0100	TIM-PC	Tim	DETECTION	C:\Program Files (x86)\LP\0010\056.exe	Trojan.Downloader.BH	QUARANTINE
2012/01/25 18:25:42 +0100	TIM-PC	Tim	ERROR	Quarantine failed:  DeleteFile failed with error code 5
2012/01/25 18:26:18 +0100	TIM-PC	Tim	MESSAGE	Executing scheduled update:  Daily
2012/01/25 18:26:19 +0100	TIM-PC	Tim	MESSAGE	Database already up-to-date
2012/01/25 18:26:41 +0100	TIM-PC	Tim	IP-BLOCK	109.235.49.191 (Type: outgoing, Port: 50990, Process: c0000.exe)
2012/01/25 18:27:50 +0100	TIM-PC	Tim	DETECTION	C:\Users\Tim\AppData\Roaming\067F0\C0000.exe	Trojan.Downloader.BH	DENY
2012/01/25 18:28:01 +0100	TIM-PC	Tim	DETECTION	C:\Program Files (x86)\LP\0010\056.exe	Trojan.Downloader.BH	DENY
2012/01/25 18:30:01 +0100	TIM-PC	Tim	IP-BLOCK	109.163.226.203 (Type: outgoing, Port: 51390, Process: c0000.exe)
2012/01/25 18:30:11 +0100	TIM-PC	Tim	DETECTION	C:\Users\Tim\AppData\Roaming\067F0\C0000.exe	Trojan.Downloader.BH	DENY
2012/01/25 18:30:22 +0100	TIM-PC	Tim	DETECTION	C:\Program Files (x86)\LP\0010\056.exe	Trojan.Downloader.BH	DENY
2012/01/25 18:31:44 +0100	TIM-PC	Tim	DETECTION	C:\Users\Tim\AppData\Local\Mozilla\Firefox\firefox.exe	Trojan.FakeMS	QUARANTINE
2012/01/25 18:31:44 +0100	TIM-PC	Tim	ERROR	Quarantine failed:  DeleteFile failed with error code 5
2012/01/25 18:32:32 +0100	TIM-PC	Tim	DETECTION	C:\Users\Tim\AppData\Roaming\067F0\C0000.exe	Trojan.Downloader.BH	DENY
2012/01/25 18:32:47 +0100	TIM-PC	Tim	DETECTION	C:\Program Files (x86)\LP\0010\8C59.exe	Trojan.Downloader.BH	QUARANTINE
2012/01/25 18:32:59 +0100	TIM-PC	Tim	DETECTION	C:\Program Files (x86)\LP\0010\056.exe	Trojan.Downloader.BH	DENY
2012/01/25 18:33:30 +0100	TIM-PC	Tim	IP-BLOCK	109.163.226.203 (Type: outgoing, Port: 51410, Process: c0000.exe)
2012/01/25 18:34:29 +0100	TIM-PC	Tim	DETECTION	C:\Users\Tim\AppData\Roaming\067F0\C0000.exe	Trojan.Downloader.BH	ALLOW
2012/01/25 18:34:29 +0100	TIM-PC	Tim	DETECTION	C:\Users\Tim\AppData\Local\Mozilla\Firefox\firefox.exe	Trojan.FakeMS	ALLOW
2012/01/25 18:34:29 +0100	TIM-PC	Tim	DETECTION	C:\Program Files (x86)\LP\0010\056.exe	Trojan.Downloader.BH	ALLOW
2012/01/25 18:34:36 +0100	TIM-PC	Tim	DETECTION	C:\Users\Tim\AppData\Roaming\067F0\C0000.exe	Trojan.Downloader.BH	QUARANTINE
2012/01/25 18:34:36 +0100	TIM-PC	Tim	DETECTION	C:\Users\Tim\AppData\Roaming\067F0\C0000.exe	Trojan.Downloader.BH	DENY
2012/01/25 18:34:36 +0100	TIM-PC	Tim	ERROR	Quarantine failed:  DeleteFile failed with error code 5
2012/01/25 18:34:48 +0100	TIM-PC	Tim	DETECTION	C:\Program Files (x86)\LP\0010\056.exe	Trojan.Downloader.BH	QUARANTINE
2012/01/25 18:34:48 +0100	TIM-PC	Tim	ERROR	Quarantine failed:  DeleteFile failed with error code 5
2012/01/25 18:36:57 +0100	TIM-PC	Tim	DETECTION	C:\Users\Tim\AppData\Roaming\067F0\C0000.exe	Trojan.Downloader.BH	DENY
2012/01/25 18:37:08 +0100	TIM-PC	Tim	DETECTION	C:\Program Files (x86)\LP\0010\056.exe	Trojan.Downloader.BH	DENY
2012/01/25 18:39:18 +0100	TIM-PC	Tim	DETECTION	C:\Users\Tim\AppData\Roaming\067F0\C0000.exe	Trojan.Downloader.BH	DENY
2012/01/25 18:39:29 +0100	TIM-PC	Tim	DETECTION	C:\Program Files (x86)\LP\0010\056.exe	Trojan.Downloader.BH	DENY
2012/01/25 18:41:39 +0100	TIM-PC	Tim	DETECTION	C:\Users\Tim\AppData\Roaming\067F0\C0000.exe	Trojan.Downloader.BH	DENY
2012/01/25 18:41:50 +0100	TIM-PC	Tim	DETECTION	C:\Program Files (x86)\LP\0010\056.exe	Trojan.Downloader.BH	DENY
2012/01/25 18:44:00 +0100	TIM-PC	Tim	DETECTION	C:\Users\Tim\AppData\Roaming\067F0\C0000.exe	Trojan.Downloader.BH	DENY
2012/01/25 18:44:11 +0100	TIM-PC	Tim	DETECTION	C:\Program Files (x86)\LP\0010\056.exe	Trojan.Downloader.BH	DENY
2012/01/25 18:46:21 +0100	TIM-PC	Tim	DETECTION	C:\Users\Tim\AppData\Roaming\067F0\C0000.exe	Trojan.Downloader.BH	DENY
2012/01/25 18:46:32 +0100	TIM-PC	Tim	DETECTION	C:\Program Files (x86)\LP\0010\056.exe	Trojan.Downloader.BH	DENY
2012/01/25 18:48:42 +0100	TIM-PC	Tim	DETECTION	C:\Users\Tim\AppData\Roaming\067F0\C0000.exe	Trojan.Downloader.BH	DENY
2012/01/25 18:48:53 +0100	TIM-PC	Tim	DETECTION	C:\Program Files (x86)\LP\0010\056.exe	Trojan.Downloader.BH	DENY
2012/01/25 18:50:35 +0100	TIM-PC	Tim	DETECTION	C:\Users\Tim\AppData\Roaming\067F0\C0000.exe	Trojan.Downloader.BH	ALLOW
2012/01/25 18:50:35 +0100	TIM-PC	Tim	DETECTION	C:\Users\Tim\AppData\Local\Mozilla\Firefox\firefox.exe	Trojan.FakeMS	ALLOW
2012/01/25 18:50:35 +0100	TIM-PC	Tim	DETECTION	C:\Program Files (x86)\LP\0010\056.exe	Trojan.Downloader.BH	ALLOW
2012/01/25 18:50:42 +0100	TIM-PC	Tim	DETECTION	C:\Users\Tim\AppData\Roaming\067F0\C0000.exe	Trojan.Downloader.BH	QUARANTINE
2012/01/25 18:50:42 +0100	TIM-PC	Tim	DETECTION	C:\Users\Tim\AppData\Roaming\067F0\C0000.exe	Trojan.Downloader.BH	DENY
2012/01/25 18:50:42 +0100	TIM-PC	Tim	ERROR	Quarantine failed:  DeleteFile failed with error code 5
2012/01/25 18:51:39 +0100	TIM-PC	Tim	DETECTION	C:\Program Files (x86)\LP\0010\056.exe	Trojan.Downloader.BH	QUARANTINE
2012/01/25 18:51:39 +0100	TIM-PC	Tim	ERROR	Quarantine failed:  DeleteFile failed with error code 5
2012/01/25 18:53:03 +0100	TIM-PC	Tim	DETECTION	C:\Users\Tim\AppData\Roaming\067F0\C0000.exe	Trojan.Downloader.BH	DENY
2012/01/25 18:53:22 +0100	TIM-PC	Tim	DETECTION	C:\Program Files (x86)\LP\0010\4E21.exe	Trojan.Downloader.BH	QUARANTINE
2012/01/25 18:53:50 +0100	TIM-PC	Tim	DETECTION	C:\Program Files (x86)\LP\0010\056.exe	Trojan.Downloader.BH	DENY
2012/01/25 18:55:44 +0100	TIM-PC	Tim	DETECTION	C:\Users\Tim\AppData\Roaming\067F0\C0000.exe	Trojan.Downloader.BH	DENY
2012/01/25 18:56:01 +0100	TIM-PC	Tim	DETECTION	C:\Program Files (x86)\LP\0010\056.exe	Trojan.Downloader.BH	DENY
2012/01/25 18:58:05 +0100	TIM-PC	Tim	DETECTION	C:\Users\Tim\AppData\Roaming\067F0\C0000.exe	Trojan.Downloader.BH	DENY
2012/01/25 18:58:16 +0100	TIM-PC	Tim	DETECTION	C:\Program Files (x86)\LP\0010\056.exe	Trojan.Downloader.BH	DENY
2012/01/25 19:00:26 +0100	TIM-PC	Tim	DETECTION	C:\Users\Tim\AppData\Roaming\067F0\C0000.exe	Trojan.Downloader.BH	DENY
2012/01/25 19:00:37 +0100	TIM-PC	Tim	DETECTION	C:\Program Files (x86)\LP\0010\056.exe	Trojan.Downloader.BH	DENY
2012/01/25 19:02:47 +0100	TIM-PC	Tim	DETECTION	C:\Users\Tim\AppData\Roaming\067F0\C0000.exe	Trojan.Downloader.BH	DENY
2012/01/25 19:02:58 +0100	TIM-PC	Tim	DETECTION	C:\Program Files (x86)\LP\0010\056.exe	Trojan.Downloader.BH	DENY
2012/01/25 19:05:08 +0100	TIM-PC	Tim	DETECTION	C:\Users\Tim\AppData\Roaming\067F0\C0000.exe	Trojan.Downloader.BH	DENY
2012/01/25 19:05:19 +0100	TIM-PC	Tim	DETECTION	C:\Program Files (x86)\LP\0010\056.exe	Trojan.Downloader.BH	DENY
2012/01/25 19:06:11 +0100	TIM-PC	Tim	DETECTION	C:\Users\Tim\AppData\Roaming\067F0\C0000.exe	Trojan.Downloader.BH	ALLOW
2012/01/25 19:06:11 +0100	TIM-PC	Tim	DETECTION	C:\Users\Tim\AppData\Roaming\067F0\C0000.exe	Trojan.Downloader.BH	ALLOW
2012/01/25 19:06:12 +0100	TIM-PC	Tim	DETECTION	C:\Users\Tim\AppData\Local\Mozilla\Firefox\firefox.exe	Trojan.FakeMS	ALLOW
2012/01/25 20:19:53 +0100	TIM-PC	Tim	MESSAGE	Starting protection
2012/01/25 20:19:55 +0100	TIM-PC	Tim	MESSAGE	Protection started successfully
2012/01/25 20:19:58 +0100	TIM-PC	Tim	MESSAGE	Starting IP protection
2012/01/25 20:19:58 +0100	TIM-PC	Tim	MESSAGE	IP Protection started successfully
2012/01/25 21:36:13 +0100	TIM-PC	Tim	MESSAGE	Starting protection
2012/01/25 21:36:15 +0100	TIM-PC	Tim	MESSAGE	Protection started successfully
2012/01/25 21:36:18 +0100	TIM-PC	Tim	MESSAGE	Starting IP protection
2012/01/25 21:36:19 +0100	TIM-PC	Tim	MESSAGE	IP Protection started successfully
         

von heute

2012/01/26 15:46:09 +0100	TIM-PC	Tim	MESSAGE	Starting protection
2012/01/26 15:46:11 +0100	TIM-PC	Tim	MESSAGE	Protection started successfully
2012/01/26 15:46:14 +0100	TIM-PC	Tim	MESSAGE	Starting IP protection
2012/01/26 15:46:14 +0100	TIM-PC	Tim	MESSAGE	IP Protection started successfully
2012/01/26 16:00:25 +0100	TIM-PC	Tim	MESSAGE	Executing scheduled update:  Daily
2012/01/26 16:00:46 +0100	TIM-PC	Tim	MESSAGE	Scheduled update executed successfully:  database updated from version v2012.01.25.04 to version v2012.01.26.04
2012/01/26 16:00:46 +0100	TIM-PC	Tim	MESSAGE	Starting database refresh
2012/01/26 16:00:46 +0100	TIM-PC	Tim	MESSAGE	Stopping IP protection
2012/01/26 16:01:27 +0100	TIM-PC	Tim	MESSAGE	IP Protection stopped
2012/01/26 16:01:28 +0100	TIM-PC	Tim	MESSAGE	Database refreshed successfully
2012/01/26 16:01:28 +0100	TIM-PC	Tim	MESSAGE	Starting IP protection
2012/01/26 16:01:29 +0100	TIM-PC	Tim	MESSAGE	IP Protection started successfully
2012/01/26 16:37:51 +0100	TIM-PC	Tim	MESSAGE	Stopping IP protection
2012/01/26 16:38:31 +0100	TIM-PC	Tim	MESSAGE	IP Protection stopped
2012/01/26 16:56:10 +0100	TIM-PC	Tim	MESSAGE	Starting IP protection
2012/01/26 16:56:11 +0100	TIM-PC	Tim	MESSAGE	IP Protection started successfully
2012/01/26 17:17:46 +0100	TIM-PC	Tim	MESSAGE	Starting protection
2012/01/26 17:17:47 +0100	TIM-PC	Tim	MESSAGE	Protection started successfully
2012/01/26 17:17:50 +0100	TIM-PC	Tim	MESSAGE	Starting IP protection
2012/01/26 17:17:51 +0100	TIM-PC	Tim	MESSAGE	IP Protection started successfully
2012/01/26 17:22:06 +0100	TIM-PC	Tim	IP-BLOCK	208.73.210.29 (Type: outgoing, Port: 49329, Process: utorrent.exe)
2012/01/26 17:22:14 +0100	TIM-PC	Tim	IP-BLOCK	208.73.210.29 (Type: outgoing, Port: 49375, Process: utorrent.exe)
2012/01/26 17:22:38 +0100	TIM-PC	Tim	IP-BLOCK	94.100.22.91 (Type: outgoing, Port: 52816, Process: utorrent.exe)
2012/01/26 17:22:38 +0100	TIM-PC	Tim	IP-BLOCK	208.73.210.29 (Type: outgoing, Port: 49461, Process: utorrent.exe)
2012/01/26 17:23:26 +0100	TIM-PC	Tim	IP-BLOCK	208.73.210.29 (Type: outgoing, Port: 49601, Process: utorrent.exe)
2012/01/26 17:23:50 +0100	TIM-PC	Tim	IP-BLOCK	83.128.54.71 (Type: outgoing, Port: 52816, Process: utorrent.exe)
2012/01/26 17:23:58 +0100	TIM-PC	Tim	IP-BLOCK	62.45.204.181 (Type: outgoing, Port: 52816, Process: utorrent.exe)
2012/01/26 17:23:58 +0100	TIM-PC	Tim	IP-BLOCK	212.117.163.218 (Type: outgoing, Port: 52816, Process: utorrent.exe)
2012/01/26 17:24:54 +0100	TIM-PC	Tim	IP-BLOCK	208.73.210.29 (Type: outgoing, Port: 49808, Process: utorrent.exe)
2012/01/26 17:27:42 +0100	TIM-PC	Tim	IP-BLOCK	208.73.210.29 (Type: outgoing, Port: 50008, Process: utorrent.exe)
2012/01/26 17:33:02 +0100	TIM-PC	Tim	IP-BLOCK	208.73.210.29 (Type: outgoing, Port: 50275, Process: utorrent.exe)
         

anmerkung: bei utorrent lade ich mir aufgenommene fernsehsendungen runter die eigentlich von vertrauenswürdigen seiten kommen. es kommt aber ab und zu eine blockier-meldung von malwarebytes

gibt es scan logs von malwarebytes?
was heißt vertrauenswürdig, sind die sendungen direkt von den sendern reingestellt worden? alles andere ist nicht legal und damit nicht vertrauenswürdig.

der komplettscan läuft. wie lange ungefähr dauert das bei ca 2,7TB?
die fernsehaufnahmen sind legal (onlinetvrecorder) jedoch werden sie dann auf diversen filehostern gespeichert und runtergeladen.
seit ich den thread hier geöffnet habe, schreibe und poste ich hier alles über meinen laptop weil firefox auf dem pc nicht mehr läuft (Proxy-Server weist die verbindung zurück)
mit dem richtigen pc verbinde ich mich für die logs und scanner mit teamviewer und kopiere alles hin und her.
muss ich mein system und firefox auf dem virusbefallenen pc nachdem das alles beendet ist neu installieren oder kann ich es weiternutzen wie bisher?

keine ahnung, wird ne weile dauern.
wegen firefox, gehe mal auf extras, adons, deinstaliere alle unnötigen erweiterungen, außer java und flash und deaktiviere alle plugins.
dann öffne extras einstellung erweitert netzwerk, dort eintrag bei proxy und port löschen, keinen proxy verwenden, übernehmen ok, ff neustarten und gucken ob es jetzt geht.

alles klar, firefox geht wieder.
welcher schutz ist denn zu empfehlen für mein OS wenn ich so einen virus nicht wieder haben will. bis jetzt habe ich die windows7 eigenen mittel und avira antivir benutzt weil es eben so reccourcensparend ist und dazu kostenlos ist. gibt es gute kostenlose (oder günstige) möglichkeiten die gut und schlank sind oder braucht man mehrere einzellösungen?

hier der scan log, hat wohl nur noch seit 10j nicht benutzte uralt sachen gefunden.

 Malwarebytes Anti-Malware  (Test) 1.60.0.1800
www.malwarebytes.org

Datenbank Version: v2012.01.26.06

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 8.0.7601.17514
Tim :: TIM-PC [Administrator]

Schutz: Aktiviert

26.01.2012 18:24:12
mbam-log-2012-01-26 (19-33-01).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 503090
Laufzeit: 56 Minute(n), 15 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 17
C:\_OTL\MovedFiles\01252012_213250\C_Users\Tim\AppData\Local\Mozilla\Firefox\firefox.exe (Trojan.FakeMS) -> Keine Aktion durchgeführt.
E:\für Sync\Dateien\Computec\Cool_n_Quiet_Switcher\CQSwitch.exe (Adware.Agent) -> Keine Aktion durchgeführt.
E:\für Sync\Dateien\setup exe\Games\Spiele Gimmiks\c&c\Command & Conquer Red Alert(tm) II\RA2\RA2MD.exe (Trojan.FakeAlert) -> Keine Aktion durchgeführt.
E:\für Sync\Dateien\setup exe\Games\Spiele Gimmiks\trackmania\TrackMania.exe (Trojan.Agent) -> Keine Aktion durchgeführt.
E:\für Sync\Dateien\setup exe\Treiber_ Downloads & Setupdateien\Games\Spiele Gimmiks\c&c\Command & Conquer Red Alert(tm) II\RA2\RA2MD.exe (Trojan.FakeAlert) -> Keine Aktion durchgeführt.
E:\für Sync\Dateien\setup exe\Treiber_ Downloads & Setupdateien\Games\Spiele Gimmiks\trackmania\TrackMania.exe (Trojan.Agent) -> Keine Aktion durchgeführt.
E:\für Sync\Dateien\spiele gimmicks\c&c\Command & Conquer Red Alert(tm) II\RA2\RA2MD.exe (Trojan.FakeAlert) -> Keine Aktion durchgeführt.
E:\für Sync\Dateien\spiele gimmicks\trackmania\TrackMania.exe (Trojan.Agent) -> Keine Aktion durchgeführt.
T:\Backup\Dateien\Computec\Cool_n_Quiet_Switcher\CQSwitch.exe (Adware.Agent) -> Keine Aktion durchgeführt.
T:\Backup\Dateien\setup exe\Games\Spiele Gimmiks\c&c\Command & Conquer Red Alert(tm) II\RA2\RA2MD.exe (Trojan.FakeAlert) -> Keine Aktion durchgeführt.
T:\Backup\Dateien\setup exe\Games\Spiele Gimmiks\trackmania\TrackMania.exe (Trojan.Agent) -> Keine Aktion durchgeführt.
T:\Backup\Dateien\setup exe\Treiber_ Downloads & Setupdateien\Games\Spiele Gimmiks\c&c\Command & Conquer Red Alert(tm) II\RA2\RA2MD.exe (Trojan.FakeAlert) -> Keine Aktion durchgeführt.
T:\Backup\Dateien\setup exe\Treiber_ Downloads & Setupdateien\Games\Spiele Gimmiks\trackmania\TrackMania.exe (Trojan.Agent) -> Keine Aktion durchgeführt.
T:\Backup\Dateien\spiele gimmicks\c&c\Command & Conquer Red Alert(tm) II\RA2\RA2MD.exe (Trojan.FakeAlert) -> Keine Aktion durchgeführt.
T:\Backup\Dateien\spiele gimmicks\trackmania\TrackMania.exe (Trojan.Agent) -> Keine Aktion durchgeführt.
T:\setup exe\Games\Spiele Gimmiks\c&c\Command & Conquer Red Alert(tm) II\RA2\RA2MD.exe (Trojan.FakeAlert) -> Keine Aktion durchgeführt.
T:\setup exe\Games\Spiele Gimmiks\trackmania\TrackMania.exe (Trojan.Agent) -> Keine Aktion durchgeführt.

(Ende)
         

hi,

benötigst du die gefundenen games? falls nein lass das mal von Malwarebytes löschen, sonst müssten wir uns die dateien och ansehen.
ich werde dir nen kostengünstiges av (20 € im jahr) empfehlen.
einzellösungen benötigt man in dem sinne, dass ein antimalware programm nicht reicht.
ich werde dir noch ein paar helferlein an die seite stellen, die dir helfen das system sauber zu halten.
lade den CCleaner standard:
CCleaner Download - CCleaner 3.14.1616
falls der CCleaner
bereits instaliert, überspringen.
instalieren, öffnen, extras, liste der instalierten programme, als txt speichern. öffnen.
hinter, jedes von dir benötigte programm, schreibe notwendig.
hinter, jedes, von dir nicht benötigte, unnötig.
hinter, dir unbekannte, unbekannt.
liste posten.

nein, die gefundenen sachen werde ich löschen.
von den installierten programmen sind mir alle bekannt und ich benutze sie auch alle (vieles ist für audio video bearbeitung). außer evtl UltraVNC, dies werde ich deinstallieren weil ich es nicht mehr brauche.
ansonsten kann ich mein system so weiterbenutzen wie es ist, es ist jetzt quasi "sauber" und muss nicht neu installiert werden?
schonmal vielen dank für die kompetente hilfe.

liste der installierten programme

Adobe Flash Player 11 Plugin 64-bit	Adobe Systems Incorporated	14.12.2011	6,00MB	11.1.102.55
Adobe Reader X (10.1.2) - Deutsch	Adobe Systems Incorporated	12.01.2012	121,2MB	10.1.2
Audacity 1.3.14 (Unicode)	Audacity Team	16.12.2011	40,5MB	
Avidemux 2.5		15.11.2011		2.5.4.7200
Avira AntiVir Personal - Free Antivirus	Avira GmbH	16.10.2011	92,1MB	10.2.0.704
CCleaner	Piriform	25.01.2012		3.15
Cisco EAP-FAST Module	Cisco Systems, Inc.	02.10.2011	1,55MB	2.2.14
Cisco LEAP Module	Cisco Systems, Inc.	02.10.2011	0,63MB	1.0.19
Cisco PEAP Module	Cisco Systems, Inc.	02.10.2011	1,24MB	1.1.6
EASEUS Partition Master 9.1.0 Home Edition	EASEUS	02.10.2011	45,0MB	
Easy-Shutdown 1.3	JPA-Software	14.01.2012		1.3
Edimax RT6x Wireless LAN Card	Edimax	02.10.2011		1.5.5.0
foobar2000 v1.1.8	Peter Pawlowski	02.10.2011	7,87MB	1.1.8
Grand Theft Auto IV	Rockstar Games	30.10.2011		1.00.0000
HD Tune 2.55	EFD Software	03.10.2011		
ImgBurn	LIGHTNING UK!	23.11.2011		2.5.6.0
Intel(R) Rapid Storage Technology	Intel Corporation	23.10.2011		10.6.0.1002
IsoBuster 2.8.5	Smart Projects	03.11.2011	10,7MB	2.8.5
Java(TM) 6 Update 22	Oracle	05.10.2011	97,1MB	6.0.220
Java(TM) 6 Update 27	Oracle	04.10.2011	95,0MB	6.0.270
Java(TM) 7 (64-bit)	Oracle	04.10.2011	93,3MB	7.0.0
JDownloader 0.9	AppWork GmbH	04.10.2011		0.9
Malwarebytes Anti-Malware Version 1.60.0.1800	Malwarebytes Corporation	24.01.2012	18,6MB	1.60.0.1800
MediaInfo 0.7.50	MediaArea.net	07.10.2011	12,5MB	0.7.50
Microsoft Games for Windows - LIVE Redistributable	Microsoft Corporation	30.10.2011	32,6MB	2.0.672.0
Microsoft Visual C++ 2005 Redistributable	Microsoft Corporation	30.10.2011	0,41MB	8.0.56336
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148	Microsoft Corporation	05.10.2011	0,77MB	9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148	Microsoft Corporation	02.10.2011	0,58MB	9.0.30729.4148
MKVtoolnix 5.0.0	Moritz Bunkus	08.10.2011		5.0.0
Mozilla Firefox 9.0.1 (x86 de)	Mozilla	07.01.2012	62,0MB	9.0.1
NVIDIA 3D Vision Controller-Treiber 280.19	NVIDIA Corporation	03.10.2011		280.19
NVIDIA 3D Vision Treiber 280.26	NVIDIA Corporation	03.10.2011		280.26
NVIDIA Grafiktreiber 280.26	NVIDIA Corporation	03.10.2011		280.26
NVIDIA PhysX-Systemsoftware 9.10.0514	NVIDIA Corporation	03.10.2011		9.10.0514
OpenOffice.org 3.3	OpenOffice.org	05.10.2011	415MB	3.3.9567
Paint.NET v3.5.9	dotPDN LLC	07.10.2011	10,7MB	3.59.0
RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition	Alexey Nicolaychuk	03.10.2011		v2.24 MSI Master Overclocking Arena 2009 edition
SpeedFan (remove only)		08.01.2012		
SyncBack	2BrightSparks	31.10.2011	4,57MB	
TeamViewer 7	TeamViewer	16.12.2011		7.0.12313
UltraVnc	uvnc bvba	16.12.2011	3,35MB	1.0.9.6.1
VLC media player 1.1.11	VideoLAN	02.10.2011		1.1.11
VMware Player	VMware, Inc	06.10.2011	391MB	3.1.4.16648
WinRAR 4.01 (64-bit)	win.rar GmbH	14.12.2011		4.01.0
µTorrent		17.10.2011		3.0.0