Gema Virus (WVista) mit OTL log

OTL logfile created on: 2/26/2012 1:30:20 PM - Run 
OTLPE by OldTimer - Version 3.1.48.0     Folder = X:\Programs\OTLPE
64bit-Windows Vista (TM) Home Premium Service Pack 2 (Version = 6.0.6002) - Type = System
Internet Explorer (Version = 7.0.6002.18005)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 90.00% Memory free
3.00 Gb Paging File | 3.00 Gb Available in Paging File | 98.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 465.76 Gb Total Space | 327.72 Gb Free Space | 70.36% Space Free | Partition Type: NTFS
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet001
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - [2011/04/27 10:21:18 | 000,288,272 | ---- | M] (Microsoft Corporation) [On_Demand] -- C:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe -- (NisSrv)
SRV:64bit: - [2011/04/27 10:21:18 | 000,012,784 | ---- | M] (Microsoft Corporation) [Auto] -- C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe -- (MsMpSvc)
SRV:64bit: - [2009/10/30 08:27:44 | 000,036,168 | ---- | M] (TuneUp Software) [Auto] -- C:\Windows\System32\uxtuneup.dll -- (UxTuneUp)
SRV:64bit: - [2008/04/30 13:20:42 | 001,371,136 | ---- | M] (Intel(R) Corporation) [Auto] -- C:\Program Files\Intel\WiFi\bin\EvtEng.exe -- (EvtEng)
SRV:64bit: - [2008/04/30 12:42:20 | 000,826,368 | ---- | M] (Intel(R) Corporation) [Auto] -- C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe -- (RegSrvc)
SRV:64bit: - [2008/01/20 21:47:32 | 000,383,544 | ---- | M] (Microsoft Corporation) [Auto] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2011/12/17 03:13:04 | 000,607,048 | ---- | M] (TuneUp Software) [On_Demand] -- C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpDefragService.exe -- (TuneUp.Defrag) @C:\Program Files (x86)
SRV - [2011/08/10 07:52:54 | 000,138,760 | R--- | M] (Symantec Corporation) [Auto] -- C:\Program Files (x86)\Norton Internet Security\Engine\19.1.0.28\ccSvcHst.exe -- (NIS)
SRV - [2009/10/30 08:33:44 | 001,353,544 | ---- | M] (TuneUp Software) [Auto] -- C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesService64.exe -- (TuneUp.UtilitiesSvc)
SRV - [2009/10/30 08:27:34 | 000,030,024 | ---- | M] (TuneUp Software) [Auto] -- C:\Windows\SysWOW64\uxtuneup.dll -- (UxTuneUp)
SRV - [2009/03/29 23:42:14 | 000,066,368 | ---- | M] (Microsoft Corporation) [Disabled] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2008/10/29 09:11:26 | 000,071,168 | ---- | M] () [Auto] -- C:\Program Files (x86)\Realtek Semiconductor Corp\Realtek USB 2.0 Card Reader\reset.exe -- (resetWinService)
SRV - [2008/04/15 10:54:42 | 000,354,840 | ---- | M] (Intel Corporation) [Auto] -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON) Intel(R)
SRV - [2007/06/05 06:20:32 | 000,177,704 | ---- | M] () [Auto] -- C:\Windows\SysWOW64\PSIService.exe -- (ProtexisLicensing)
SRV - [2006/12/19 03:30:26 | 000,081,920 | ---- | M] (Prolific Technology Inc.) [Auto] -- C:\Windows\SysWOW64\IoctlSvc.exe -- (PLFlash DeviceIoControl Service)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2012/02/26 06:19:44 | 000,174,200 | ---- | M] (Symantec Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\SYMEVENT64x86.SYS -- (SymEvent)
DRV:64bit: - [2011/08/08 10:38:06 | 000,167,048 | R--- | M] (Symantec Corporation) [Kernel | System] -- C:\Windows\system32\drivers\NISx64\1301000.01C\ccSetx64.sys -- (ccSet_NIS)
DRV:64bit: - [2011/08/02 13:22:10 | 000,729,720 | R--- | M] (Symantec Corporation) [File_System | System] -- C:\Windows\system32\drivers\NISx64\1301000.01C\SRTSP64.SYS -- (SRTSP)
DRV:64bit: - [2011/08/02 13:22:10 | 000,037,496 | R--- | M] (Symantec Corporation) [Kernel | System] -- C:\Windows\system32\drivers\NISx64\1301000.01C\SRTSPX64.SYS -- (SRTSPX) Symantec Real Time Storage Protection (PEL)
DRV:64bit: - [2011/07/28 14:20:02 | 001,084,536 | R--- | M] (Symantec Corporation) [File_System | Boot] -- C:\Windows\System32\drivers\NISx64\1301000.01C\SymEFA64.sys -- (SymEFA)
DRV:64bit: - [2011/07/25 13:18:40 | 000,445,560 | R--- | M] (Symantec Corporation) [Kernel | System] -- C:\Windows\system32\drivers\NISx64\1301000.01C\SYMTDIV.SYS -- (SYMTDIv)
DRV:64bit: - [2011/07/25 13:18:36 | 000,451,192 | R--- | M] (Symantec Corporation) [Kernel | Boot] -- C:\Windows\System32\drivers\NISx64\1301000.01C\SymDS64.sys -- (SymDS)
DRV:64bit: - [2011/07/25 13:15:52 | 000,189,560 | R--- | M] (Symantec Corporation) [Kernel | System] -- C:\Windows\system32\drivers\NISx64\1301000.01C\Ironx64.SYS -- (SymIRON)
DRV:64bit: - [2011/04/27 08:25:24 | 000,084,864 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\NisDrvWFP.sys -- (NisDrv)
DRV:64bit: - [2009/10/05 13:29:13 | 000,012,160 | ---- | M] () [Kernel | On_Demand] -- C:\Windows\System32\WinIo.sys -- (WINIO)
DRV:64bit: - [2009/09/30 19:51:42 | 000,046,592 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\WpdUsb.sys -- (WpdUsb)
DRV:64bit: - [2008/12/29 11:06:54 | 001,868,032 | ---- | M] () [Kernel | On_Demand] -- C:\Windows\System32\drivers\snp2uvc.sys -- (SNP2UVC) USB2.0 PC Camera (SNP2UVC)
DRV:64bit: - [2008/11/13 09:47:06 | 000,068,096 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\RTSTOR64.sys -- (RTSTOR)
DRV:64bit: - [2008/10/03 19:17:30 | 000,184,320 | ---- | M] (Realtek Corporation                                            ) [Kernel | On_Demand] -- C:\Windows\System32\drivers\Rtlh64.sys -- (RTL8169)
DRV:64bit: - [2008/09/24 10:09:48 | 000,058,912 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\nvhda64v.sys -- (NVHDA)
DRV:64bit: - [2008/04/27 23:38:12 | 004,730,368 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\NETw5v64.sys -- (NETw5v64) Intel(R)
DRV:64bit: - [2006/09/18 16:36:24 | 000,000,308 | ---- | M] () [File_System | On_Demand] -- C:\Windows\System32\wbem\ntfs.mof -- (Ntfs)
DRV - [2011/08/09 20:00:00 | 000,481,912 | ---- | M] (Symantec Corporation) [Kernel | System] -- C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys -- (eeCtrl)
DRV - [2011/07/25 13:15:12 | 001,151,096 | ---- | M] (Symantec Corporation) [Kernel | System] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.1.0.28\Definitions\BASHDefs\20110723.001\BHDrvx64.sys -- (BHDrvx64)
DRV - [2011/07/20 12:43:24 | 000,488,568 | ---- | M] (Symantec Corporation) [Kernel | System] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.1.0.28\Definitions\IPSDefs\20110726.001\IDSviA64.sys -- (IDSVia64)
DRV - [2009/10/14 01:24:44 | 000,011,856 | ---- | M] (TuneUp Software) [Kernel | On_Demand] -- C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesDriver64.sys -- (TuneUpUtilitiesDrv)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
 
IE - HKU\Ute_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.facemoods.com/?a=ddrnw
IE - HKU\Ute_ON_C\Software\Microsoft\Internet Explorer\Main,StartPageCache = 2
IE - HKU\Ute_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@divx.com/DivX OVS Helper,version=1.0.0: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.1.0.28\IPSFFPlgn\ [2012/02/26 06:24:15 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Firefox\Extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.1.0.28\coFFPlgn\ [2012/02/26 06:23:44 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Mozilla Firefox 10.0.2\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/02/18 12:08:44 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Mozilla Firefox 10.0.2\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012/01/16 12:14:35 | 000,000,000 | ---D | M]
 
[2011/12/13 14:08:24 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions
[2012/02/18 12:08:44 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2011/05/03 21:52:23 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2010/12/06 17:03:18 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npwachk.dll
[2011/12/29 04:47:36 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011/12/29 04:47:36 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2011/12/29 04:47:36 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2011/11/22 02:34:21 | 000,002,048 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\fcmdSrch.xml
[2011/12/29 04:47:36 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2011/12/29 04:47:36 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2011/12/29 04:47:36 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2006/09/18 16:37:24 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1             localhost
O2 - BHO: (Skype add-on (mastermind)) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O2 - BHO: (Norton Identity Protection) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\19.1.0.28\CoIEPlg.dll (Symantec Corporation)
O2 - BHO: (Norton Vulnerability Protection) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\19.1.0.28\IPS\IPSBHO.dll (Symantec Corporation)
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\19.1.0.28\CoIEPlg.dll (Symantec Corporation)
O4:64bit: - HKLM..\Run: [IAAnotif] C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [MSC] C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)
O4:64bit: - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [Skytel] C:\Program Files\Realtek\Audio\HDA\SkyTel.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [gema.] C:\ProgramData\gema\gema.exe (Promise Technology, Inc.)
O4 - HKU\LocalService_ON_C..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\LocalService_ON_C..\Run: [WindowsWelcomeCenter] C:\Windows\SysWow64\oobefldr.dll (Microsoft Corporation)
O4 - HKU\NetworkService_ON_C..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\NetworkService_ON_C..\Run: [WindowsWelcomeCenter] C:\Windows\SysWow64\oobefldr.dll (Microsoft Corporation)
O4 - HKU\Ute_ON_C..\Run: [gema]  File not found
O4 - HKU\Ute_ON_C..\Run: [Userinit] C:\Users\Ute\AppData\Roaming\appconf32.exe ()
O4 - HKLM..\RunOnce: [B Register C:\Program Files (x86)\DivX\DivX Plus Player\DPXPlugins\DPXBannerAdPlugin.dll] C:\Program Files (x86)\DivX\DivX Plus Player\DPXPlugins\DPXBannerAdPlugin.dll ()
O4 - HKLM..\RunOnce: [B Register C:\Program Files (x86)\DivX\DivX Plus Player\DPXPlugins\DPXDFXAudioPlugin.dll] C:\Program Files (x86)\DivX\DivX Plus Player\DPXPlugins\DPXDFXAudioPlugin.dll ()
O4 - HKLM..\RunOnce: [B Register C:\Program Files (x86)\DivX\DivX Plus Player\DPXPlugins\DPXMediaManagerPlugin.dll] C:\Program Files (x86)\DivX\DivX Plus Player\DPXPlugins\DPXMediaManagerPlugin.dll ()
O4 - HKLM..\RunOnce: [B Register C:\Program Files (x86)\DivX\DivX Plus Player\DPXPlugins\DPXPlayerPlugin.dll] C:\Program Files (x86)\DivX\DivX Plus Player\DPXPlugins\DPXPlayerPlugin.dll ()
O4 - HKLM..\RunOnce: [B Register C:\Program Files (x86)\DivX\DivX Plus Player\DSEPlugins\DFXAudioPlugin.dll] C:\Program Files (x86)\DivX\DivX Plus Player\DSEPlugins\DFXAudioPlugin.dll (DivX, Inc.)
O4 - HKLM..\RunOnce: [ Malwarebytes Anti-Malware ] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\RunOnce: [ Malwarebytes Anti-Malware  (cleanup)] C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\cleanup.dll (Malwarebytes Corporation)
O4 - Startup: Error locating startup folders.
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O9 - Extra Button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O13:64bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O18:64bit: - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\ProgramData\gema\gema.exe) - C:\ProgramData\gema\gema.exe (Promise Technology, Inc.)
O20 - HKU\Ute_ON_C Winlogon: Shell - (C:\Users\Ute\AppData\Roaming\gema\gema.exe) -  File not found
O20 - HKU\Ute_ON_C Winlogon: Shell - (Explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/03/24 06:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
64bit: O35 - HKLM\..comfile [open] -- "%1" %* File not found
64bit: O35 - HKLM\..exefile [open] -- "%1" %* File not found
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012/02/26 06:50:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012/02/26 06:50:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012/02/26 06:50:20 | 000,023,152 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2012/02/26 06:50:20 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2012/02/26 06:49:36 | 009,502,424 | ---- | C] (Malwarebytes Corporation                                    ) -- C:\Users\Ute\Desktop\mbam-setup-1.60.1.1000.exe
[2012/02/26 06:20:25 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Symantec Shared
[2012/02/26 06:19:44 | 000,174,200 | ---- | C] (Symantec Corporation) -- C:\Windows\System32\drivers\SYMEVENT64x86.SYS
[2012/02/26 06:19:44 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Symantec Shared
[2012/02/26 06:19:44 | 000,000,000 | ---D | C] -- C:\Program Files\Symantec
[2012/02/26 06:19:31 | 001,084,536 | R--- | C] (Symantec Corporation) -- C:\Windows\System32\drivers\NISx64\1301000.01C\SymEFA64.sys
[2012/02/26 06:19:31 | 000,729,720 | R--- | C] (Symantec Corporation) -- C:\Windows\System32\drivers\NISx64\1301000.01C\srtsp64.sys
[2012/02/26 06:19:31 | 000,451,192 | R--- | C] (Symantec Corporation) -- C:\Windows\System32\drivers\NISx64\1301000.01C\SymDS64.sys
[2012/02/26 06:19:31 | 000,445,560 | R--- | C] (Symantec Corporation) -- C:\Windows\System32\drivers\NISx64\1301000.01C\symtdiv.sys
[2012/02/26 06:19:31 | 000,401,016 | R--- | C] (Symantec Corporation) -- C:\Windows\System32\drivers\NISx64\1301000.01C\symnets.sys
[2012/02/26 06:19:31 | 000,189,560 | R--- | C] (Symantec Corporation) -- C:\Windows\System32\drivers\NISx64\1301000.01C\Ironx64.sys
[2012/02/26 06:19:31 | 000,167,048 | R--- | C] (Symantec Corporation) -- C:\Windows\System32\drivers\NISx64\1301000.01C\ccSetx64.sys
[2012/02/26 06:19:31 | 000,037,496 | R--- | C] (Symantec Corporation) -- C:\Windows\System32\drivers\NISx64\1301000.01C\srtspx64.sys
[2012/02/26 06:19:15 | 000,000,000 | ---D | C] -- C:\Windows\System32\drivers\NISx64
[2012/02/26 06:19:15 | 000,000,000 | ---D | C] -- C:\Windows\System32\drivers\NISx64\1301000.01C
[2012/02/26 06:19:12 | 000,000,000 | R--D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton Internet Security
[2012/02/26 06:19:12 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Norton Internet Security
[2012/02/26 06:19:07 | 000,000,000 | ---D | C] -- C:\ProgramData\NortonInstaller
[2012/02/26 06:19:07 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\NortonInstaller
[2012/02/26 06:18:14 | 109,133,480 | ---- | C] (Symantec Corporation) -- C:\Users\Ute\Desktop\NIS-TW-30-19-1-0-28-GE.exe
[2012/02/26 06:05:17 | 000,000,000 | ---D | C] -- C:\Users\Ute\AppData\Local\NPE
[2012/02/26 06:05:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Norton
[2012/02/26 06:04:37 | 002,805,464 | ---- | C] (Symantec Corporation) -- C:\Users\Ute\Desktop\NPE(1).exe
[2012/02/25 12:22:19 | 000,247,808 | ---- | C] (Promise Technology, Inc.) -- C:\Windows\System32\gema.exe
[2012/02/25 12:13:32 | 000,000,000 | ---D | C] -- C:\ProgramData\gema
[2012/02/17 10:10:03 | 000,621,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msvcrt.dll
[2012/02/17 10:09:54 | 000,759,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtmled.dll
[2012/02/17 10:09:54 | 000,590,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll
[2012/02/17 10:09:54 | 000,485,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\html.iec
[2012/02/17 10:09:54 | 000,478,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
[2012/02/17 10:09:54 | 000,471,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msfeeds.dll
[2012/02/17 10:09:54 | 000,389,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\html.iec
[2012/02/17 10:09:54 | 000,249,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll
[2012/02/17 10:09:54 | 000,224,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2012/02/17 10:09:54 | 000,193,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iepeers.dll
[2012/02/17 10:09:54 | 000,180,736 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2012/02/17 10:09:54 | 000,108,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll
[2012/02/17 10:09:54 | 000,106,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll
[2012/02/17 10:09:53 | 000,422,400 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieapfltr.dll
[2012/02/17 10:09:53 | 000,380,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieapfltr.dll
[2012/02/02 09:23:25 | 001,689,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\lsasrv.dll
[2012/02/02 09:23:25 | 000,094,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\secur32.dll
[2012/02/02 09:18:17 | 000,000,000 | ---D | C] -- C:\Users\Ute\Desktop\Kap Verde
[2009/05/27 12:37:16 | 000,225,280 | ---- | C] ( ) -- C:\Windows\SysWow64\rsnp2uvc.dll
 
========== Files - Modified Within 30 Days ==========
 
[2012/02/26 07:20:29 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012/02/26 06:50:22 | 000,000,948 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012/02/26 06:50:22 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012/02/26 06:23:22 | 000,001,100 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/02/26 06:23:21 | 000,003,712 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012/02/26 06:23:20 | 000,003,712 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012/02/26 06:23:17 | 000,235,357 | ---- | M] () -- C:\ProgramData\nvModes.001
[2012/02/26 06:22:27 | 003,053,341 | ---- | M] () -- C:\Windows\System32\drivers\NISx64\1301000.01C\Cat.DB
[2012/02/26 06:19:44 | 000,174,200 | ---- | M] (Symantec Corporation) -- C:\Windows\System32\drivers\SYMEVENT64x86.SYS
[2012/02/26 06:19:44 | 000,007,530 | ---- | M] () -- C:\Windows\System32\drivers\SYMEVENT64x86.CAT
[2012/02/26 06:19:44 | 000,000,855 | ---- | M] () -- C:\Windows\System32\drivers\SYMEVENT64x86.INF
[2012/02/26 06:19:43 | 000,002,291 | ---- | M] () -- C:\Users\Public\Desktop\Norton Internet Security.lnk
[2012/02/26 06:19:43 | 000,000,000 | R--D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton Internet Security
[2012/02/26 06:18:55 | 000,624,394 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012/02/26 06:18:55 | 000,592,810 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012/02/26 06:18:55 | 000,125,794 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012/02/26 06:18:55 | 000,103,584 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012/02/26 06:15:56 | 109,133,480 | ---- | M] (Symantec Corporation) -- C:\Users\Ute\Desktop\NIS-TW-30-19-1-0-28-GE.exe
[2012/02/26 06:04:28 | 002,805,464 | ---- | M] (Symantec Corporation) -- C:\Users\Ute\Desktop\NPE(1).exe
[2012/02/26 05:50:32 | 009,502,424 | ---- | M] (Malwarebytes Corporation                                    ) -- C:\Users\Ute\Desktop\mbam-setup-1.60.1.1000.exe
[2012/02/26 05:37:10 | 000,001,460 | ---- | M] () -- C:\Users\Ute\AppData\Local\d3d9caps64.dat
[2012/02/26 05:16:33 | 000,001,104 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/02/25 12:31:51 | 000,000,329 | ---- | M] () -- C:\Users\Ute\Desktop\Ute - Verknüpfung.lnk
[2012/02/25 12:15:29 | 000,235,357 | ---- | M] () -- C:\ProgramData\nvModes.dat
[2012/02/25 12:13:31 | 000,247,808 | ---- | M] (Promise Technology, Inc.) -- C:\Windows\System32\gema.exe
[2012/02/20 13:58:33 | 000,048,128 | ---- | M] () -- C:\Users\Ute\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/02/17 21:22:20 | 000,324,536 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2012/02/05 12:10:10 | 512,411,984 | ---- | M] () -- C:\Windows\MEMORY.DMP
 
========== Files Created - No Company Name ==========
 
[2012/02/26 06:50:22 | 000,000,948 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012/02/26 06:21:45 | 003,053,341 | ---- | C] () -- C:\Windows\System32\drivers\NISx64\1301000.01C\Cat.DB
[2012/02/26 06:19:44 | 000,007,530 | ---- | C] () -- C:\Windows\System32\drivers\SYMEVENT64x86.CAT
[2012/02/26 06:19:44 | 000,000,855 | ---- | C] () -- C:\Windows\System32\drivers\SYMEVENT64x86.INF
[2012/02/26 06:19:43 | 000,002,291 | ---- | C] () -- C:\Users\Public\Desktop\Norton Internet Security.lnk
[2012/02/26 06:19:22 | 000,003,433 | R--- | C] () -- C:\Windows\System32\drivers\NISx64\1301000.01C\SymEFA.inf
[2012/02/26 06:19:22 | 000,002,852 | R--- | C] () -- C:\Windows\System32\drivers\NISx64\1301000.01C\SymDS.inf
[2012/02/26 06:19:22 | 000,001,468 | R--- | C] () -- C:\Windows\System32\drivers\NISx64\1301000.01C\SymNetV.inf
[2012/02/26 06:19:22 | 000,001,440 | R--- | C] () -- C:\Windows\System32\drivers\NISx64\1301000.01C\SymNet.inf
[2012/02/26 06:19:22 | 000,001,438 | R--- | C] () -- C:\Windows\System32\drivers\NISx64\1301000.01C\srtsp64.inf
[2012/02/26 06:19:22 | 000,001,420 | R--- | C] () -- C:\Windows\System32\drivers\NISx64\1301000.01C\srtspx64.inf
[2012/02/26 06:19:22 | 000,000,854 | R--- | C] () -- C:\Windows\System32\drivers\NISx64\1301000.01C\ccSetx64.inf
[2012/02/26 06:19:22 | 000,000,772 | R--- | C] () -- C:\Windows\System32\drivers\NISx64\1301000.01C\Iron.inf
[2012/02/26 06:19:15 | 000,007,877 | R--- | C] () -- C:\Windows\System32\drivers\NISx64\1301000.01C\symnetv64.cat
[2012/02/26 06:19:15 | 000,007,510 | R--- | C] () -- C:\Windows\System32\drivers\NISx64\1301000.01C\ccSetx64.cat
[2012/02/26 06:19:15 | 000,007,504 | R--- | C] () -- C:\Windows\System32\drivers\NISx64\1301000.01C\srtspx64.cat
[2012/02/26 06:19:15 | 000,007,502 | R--- | C] () -- C:\Windows\System32\drivers\NISx64\1301000.01C\SymEFA64.cat
[2012/02/26 06:19:15 | 000,007,500 | R--- | C] () -- C:\Windows\System32\drivers\NISx64\1301000.01C\srtsp64.cat
[2012/02/26 06:19:15 | 000,007,496 | R--- | C] () -- C:\Windows\System32\drivers\NISx64\1301000.01C\SymDS64.cat
[2012/02/26 06:19:15 | 000,007,492 | R--- | C] () -- C:\Windows\System32\drivers\NISx64\1301000.01C\iron.cat
[2012/02/26 06:19:15 | 000,007,458 | R--- | C] () -- C:\Windows\System32\drivers\NISx64\1301000.01C\symnet64.cat
[2012/02/26 06:19:15 | 000,002,801 | R--- | C] () -- C:\Windows\System32\drivers\NISx64\1301000.01C\SymVTcer.dat
[2012/02/26 06:19:15 | 000,000,172 | ---- | C] () -- C:\Windows\System32\drivers\NISx64\1301000.01C\isolate.ini
[2012/02/25 12:31:51 | 000,000,329 | ---- | C] () -- C:\Users\Ute\Desktop\Ute - Verknüpfung.lnk
[2012/02/05 12:10:10 | 512,411,984 | ---- | C] () -- C:\Windows\MEMORY.DMP
[2011/11/27 05:38:34 | 000,000,000 | ---- | C] () -- C:\Users\Ute\AppData\Local\{FED0F8A6-7FE8-4163-AD99-11DA024981C1}
[2011/11/21 04:21:36 | 000,000,000 | ---- | C] () -- C:\Users\Ute\AppData\Local\{3A45E69B-64F5-4D0B-AC74-0F7AC4130962}
[2011/08/14 01:52:01 | 000,000,000 | ---- | C] () -- C:\Users\Ute\AppData\Local\{91D948D5-8369-436A-980F-AB9A7F253CB9}
[2011/03/12 04:34:57 | 001,463,378 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2011/02/08 07:13:46 | 000,000,680 | ---- | C] () -- C:\Users\Ute\AppData\Local\d3d9caps.dat
[2009/12/05 08:42:41 | 000,117,248 | ---- | C] () -- C:\Windows\SysWow64\EhStorAuthn.dll
[2009/12/05 08:41:45 | 000,107,612 | ---- | C] () -- C:\Windows\SysWow64\StructuredQuerySchema.bin
[2009/12/05 08:41:02 | 000,368,640 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2009/06/02 14:11:31 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2009/05/28 15:29:58 | 000,003,140 | -HS- | C] () -- C:\Windows\SysWow64\KGyGaAvL.sys
[2009/05/28 15:29:58 | 000,000,008 | RHS- | C] () -- C:\Windows\SysWow64\F160466CB4.sys
[2009/05/28 15:21:41 | 000,048,128 | ---- | C] () -- C:\Users\Ute\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/05/27 14:52:22 | 000,018,904 | ---- | C] () -- C:\Windows\SysWow64\StructuredQuerySchemaTrivial.bin
[2009/05/27 13:45:08 | 000,235,357 | ---- | C] () -- C:\ProgramData\nvModes.001
[2009/05/27 13:43:23 | 000,235,357 | ---- | C] () -- C:\ProgramData\nvModes.dat
[2009/05/27 12:37:16 | 000,233,472 | ---- | C] () -- C:\Windows\tsnp2uvc.exe
[2009/05/27 12:37:16 | 000,015,497 | ---- | C] () -- C:\Windows\snp2uvc.ini
[2009/05/27 12:13:38 | 000,001,460 | ---- | C] () -- C:\Users\Ute\AppData\Local\d3d9caps64.dat
[2008/01/20 21:50:05 | 000,060,124 | ---- | C] () -- C:\Windows\SysWow64\tcpmon.ini
[2007/06/05 06:20:32 | 000,177,704 | ---- | C] () -- C:\Windows\SysWow64\PSIService.exe
[2006/11/02 10:37:05 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006/11/02 10:02:31 | 000,197,632 | ---- | C] () -- C:\Windows\SysWow64\ir32_32.dll
[2006/11/02 07:37:14 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat
[2006/11/02 07:24:17 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT
[2006/11/02 07:18:17 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat
[2006/11/02 04:47:54 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
 
========== LOP Check ==========
 
[2009/05/27 12:13:17 | 000,000,000 | -HSD | M] -- C:\ProgramData\Anwendungsdaten
[2006/11/02 10:42:17 | 000,000,000 | -HSD | M] -- C:\ProgramData\Application Data
[2006/11/02 10:42:17 | 000,000,000 | -HSD | M] -- C:\ProgramData\Desktop
[2006/11/02 10:42:17 | 000,000,000 | -HSD | M] -- C:\ProgramData\Documents
[2009/05/27 12:13:17 | 000,000,000 | -HSD | M] -- C:\ProgramData\Dokumente
[2009/05/27 12:13:17 | 000,000,000 | -HSD | M] -- C:\ProgramData\Favoriten
[2006/11/02 10:42:17 | 000,000,000 | -HSD | M] -- C:\ProgramData\Favorites
[2012/02/25 12:13:32 | 000,000,000 | ---D | M] -- C:\ProgramData\gema
[2009/08/24 10:30:31 | 000,000,000 | ---D | M] -- C:\ProgramData\maxdome
[2011/07/25 10:51:32 | 000,000,000 | ---D | M] -- C:\ProgramData\PMB Files
[2009/05/27 12:37:02 | 000,000,000 | ---D | M] -- C:\ProgramData\Roaming
[2010/04/08 07:12:44 | 000,000,000 | ---D | M] -- C:\ProgramData\Rossmann Fotoservice
[2006/11/02 10:42:17 | 000,000,000 | -HSD | M] -- C:\ProgramData\Start Menu
[2009/05/27 12:13:17 | 000,000,000 | -HSD | M] -- C:\ProgramData\Startmenü
[2009/05/27 13:00:45 | 000,000,000 | ---D | M] -- C:\ProgramData\Temp
[2006/11/02 10:42:17 | 000,000,000 | -HSD | M] -- C:\ProgramData\Templates
[2011/12/17 03:12:07 | 000,000,000 | ---D | M] -- C:\ProgramData\TuneUp Software
[2009/05/27 12:13:17 | 000,000,000 | -HSD | M] -- C:\ProgramData\Vorlagen
[2011/12/17 03:10:59 | 000,000,000 | -HSD | M] -- C:\ProgramData\{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}
[2012/02/26 05:49:00 | 000,032,582 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
< End of report >