Hallo,

als ich heute Morgen mit Mozilla im Interent unterwegs war, öffnete sich plötzlich ein schwarzer Bildschirm. Auf diesem war der hier schon mehrfach genannte Text "Achtung! Windows wurde aus Sicherheitsgründen..." zu lesen. Im unteren Bereich des Fensters sollte man auf einen "runterladen & bezahlen" Button klicken, um ein Update gegen diese Sicherheitslücke zu erwerben. Anbei das OTL-Log.

@combofix: Habe dieses immer nur auf Anweisung benutzt...OTL Logfile:

OTL logfile created on: 26.03.2012 17:38:25 - Run 4
OTL by OldTimer - Version 3.2.39.2     Folder = C:\Users\Bonnstar007\Downloads
 Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 1,32 Gb Available Physical Memory | 65,93% Memory free
4,00 Gb Paging File | 3,46 Gb Available in Paging File | 86,51% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 221,62 Gb Total Space | 12,12 Gb Free Space | 5,47% Space Free | Partition Type: NTFS
Drive D: | 244,14 Gb Total Space | 94,53 Gb Free Space | 38,72% Space Free | Partition Type: NTFS
 
Computer Name: BONNSTAR007-PC | User Name: Bonnstar007 | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Bonnstar007\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Programme\Mozilla Firefox\mozjs.dll ()
MOD - C:\Programme\NVIDIA Corporation\3D Vision\Nv3DVStreaming.dll ()
MOD - C:\Programme\WinRAR\RarExt.dll ()
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (avast! Antivirus) -- C:\Programme\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
SRV - (nvUpdatusService) -- C:\Programme\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation)
SRV - (Stereo Service) -- C:\Programme\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
SRV - (AdobeARMservice) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (ServiceLayer) -- C:\Programme\PC Connectivity Solution\ServiceLayer.exe (Nokia)
SRV - (TomTomHOMEService) -- C:\Programme\TomTom HOME 2\TomTomHOMEService.exe (TomTom)
SRV - (Sony Ericsson PCCompanion) -- C:\Programme\Sony Ericsson\Sony Ericsson PC Companion\PCCService.exe (Avanquest Software)
SRV - (Futuremark SystemInfo Service) -- C:\Programme\Futuremark\Futuremark SystemInfo\FMSISvc.exe (Futuremark Corporation)
SRV - (WMPNetworkSvc) -- C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
SRV - (AMD External Events Utility) -- C:\Windows\System32\atiesrxx.exe (AMD)
SRV - (CVPND) -- C:\Programme\Cisco Systems\VPN Client\cvpnd.exe (Cisco Systems, Inc.)
SRV - (ACDaemon) -- C:\Programme\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.)
SRV - (SensrSvc) -- C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)
SRV - (PeerDistSvc) -- C:\Windows\System32\PeerDistSvc.dll (Microsoft Corporation)
SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (Nero BackItUp Scheduler 4.0) -- C:\Programme\Common Files\Nero\Nero BackItUp 4\NBService.exe (Nero AG)
SRV - (ose) -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (VGPU) -- System32\drivers\rdvgkmd.sys File not found
DRV - (tsusbhub) -- system32\drivers\tsusbhub.sys File not found
DRV - (Synth3dVsc) -- System32\drivers\synth3dvsc.sys File not found
DRV - (MBAMSwissArmy) -- C:\Windows\system32\drivers\mbamswissarmy.sys File not found
DRV - (cpuz135) -- C:\Windows\TEMP\cpuz135\cpuz135_x32.sys File not found
DRV - (catchme) -- C:\Users\BONNST~1\AppData\Local\Temp\catchme.sys File not found
DRV - (aswSnx) -- C:\Windows\System32\drivers\aswSnx.sys (AVAST Software)
DRV - (aswSP) -- C:\Windows\System32\drivers\aswSP.sys (AVAST Software)
DRV - (aswRdr) -- C:\Windows\System32\drivers\aswRdr2.sys (AVAST Software)
DRV - (aswTdi) -- C:\Windows\System32\drivers\aswTdi.sys (AVAST Software)
DRV - (aswMonFlt) -- C:\Windows\System32\drivers\aswMonFlt.sys (AVAST Software)
DRV - (aswFsBlk) -- C:\Windows\System32\drivers\aswFsBlk.sys (AVAST Software)
DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (NVHDA) -- C:\Windows\System32\drivers\nvhda32v.sys (NVIDIA Corporation)
DRV - (UsbserFilt) -- C:\Windows\System32\drivers\usbser_lowerfltj.sys (Nokia)
DRV - (upperdev) -- C:\Windows\System32\drivers\usbser_lowerflt.sys (Nokia)
DRV - (nmwcdc) -- C:\Windows\System32\drivers\ccdcmbo.sys (Nokia)
DRV - (nmwcd) -- C:\Windows\System32\drivers\ccdcmb.sys (Nokia)
DRV - (speedfan) -- C:\Windows\System32\speedfan.sys (Almico Software)
DRV - (vmbus) -- C:\Windows\System32\drivers\vmbus.sys (Microsoft Corporation)
DRV - (storflt) -- C:\Windows\System32\drivers\vmstorfl.sys (Microsoft Corporation)
DRV - (storvsc) -- C:\Windows\System32\drivers\storvsc.sys (Microsoft Corporation)
DRV - (TsUsbFlt) -- C:\Windows\System32\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV - (RdpVideoMiniport) -- C:\Windows\System32\drivers\rdpvideominiport.sys (Microsoft Corporation)
DRV - (WinUsb) -- C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)
DRV - (VMBusHID) -- C:\Windows\System32\drivers\VMBusHID.sys (Microsoft Corporation)
DRV - (s3cap) -- C:\Windows\System32\drivers\vms3cap.sys (Microsoft Corporation)
DRV - (sptd) -- C:\Windows\System32\drivers\sptd.sys (Duplex Secure Ltd.)
DRV - (amdkmdap) -- C:\Windows\System32\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)
DRV - (SASKUTIL) -- C:\Programme\SUPERAntiSpyware\SASKUTIL.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (AtiHdmiService) -- C:\Windows\System32\drivers\AtiHdmi.sys (ATI Technologies, Inc.)
DRV - (CVPNDRVA) -- C:\Windows\System32\drivers\CVPNDRVA.sys (Cisco Systems, Inc.)
DRV - (SASDIFSV) -- C:\Programme\SUPERAntiSpyware\sasdifsv.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (RTL8169) -- C:\Windows\System32\drivers\Rtlh86.sys (Realtek                                            )
DRV - (AnyDVD) -- C:\Windows\System32\drivers\AnyDVD.sys (SlySoft, Inc.)
DRV - (atksgt) -- C:\Windows\System32\drivers\atksgt.sys ()
DRV - (lirsgt) -- C:\Windows\System32\drivers\lirsgt.sys ()
DRV - (atikmdag) -- C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (amdkmdag) -- C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (epmntdrv) -- C:\Windows\System32\epmntdrv.sys ()
DRV - (EuGdiDrv) -- C:\Windows\System32\EuGdiDrv.sys ()
DRV - (mcdbus) -- C:\Windows\System32\drivers\mcdbus.sys (MagicISO, Inc.)
DRV - (WmFilter) -- C:\Windows\System32\drivers\WmFilter.sys (Logitech Inc.)
DRV - (DNE) -- C:\Windows\System32\drivers\dne2000.sys (Deterministic Networks, Inc.)
DRV - (s0017mdm) -- C:\Windows\System32\drivers\s0017mdm.sys (MCCI Corporation)
DRV - (s0017unic) Sony Ericsson Device 0017 USB Ethernet Emulation SEMC0017 (WDM) -- C:\Windows\System32\drivers\s0017unic.sys (MCCI Corporation)
DRV - (s0017mgmt) Sony Ericsson Device 0017 USB WMC Device Management Drivers (WDM) -- C:\Windows\System32\drivers\s0017mgmt.sys (MCCI Corporation)
DRV - (s0017obex) -- C:\Windows\System32\drivers\s0017obex.sys (MCCI Corporation)
DRV - (s0017bus) Sony Ericsson Device 0017 driver (WDM) -- C:\Windows\System32\drivers\s0017bus.sys (MCCI Corporation)
DRV - (s0017nd5) Sony Ericsson Device 0017 USB Ethernet Emulation SEMC0017 (NDIS) -- C:\Windows\System32\drivers\s0017nd5.sys (MCCI Corporation)
DRV - (s0017mdfl) -- C:\Windows\System32\drivers\s0017mdfl.sys (MCCI Corporation)
DRV - (pccsmcfd) -- C:\Windows\System32\drivers\pccsmcfd.sys (Nokia)
DRV - (acedrv11) -- C:\Windows\System32\drivers\acedrv11.sys (Protect Software GmbH)
DRV - (seehcri) -- C:\Windows\System32\drivers\seehcri.sys (Sony Ericsson Mobile Communications)
DRV - (s3017bus) Sony Ericsson Device 3017 driver (WDM) -- C:\Windows\System32\drivers\s3017bus.sys (MCCI Corporation)
DRV - (ElbyCDFL) -- C:\Windows\System32\drivers\ElbyCDFL.sys (SlySoft, Inc.)
DRV - (CVirtA) -- C:\Windows\System32\drivers\CVirtA.sys (Cisco Systems, Inc.)
DRV - (AtiPcie) ATI PCI Express (3GIO) -- C:\Windows\System32\drivers\AtiPcie.sys (ATI Technologies Inc.)
DRV - (giveio) -- C:\Windows\System32\giveio.sys ()
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\URLSearchHook:  - No CLSID value found
IE - HKLM\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - No CLSID value found
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.ask.com/?l=dis&o=15768
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook:  - No CLSID value found
IE - HKCU\..\SearchScopes,DefaultScope = {AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB9}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd
IE - HKCU\..\SearchScopes\{AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB9}: "URL" = hxxp://www.daemon-search.com/search/web?q={searchTerms}
IE - HKCU\..\SearchScopes\{B13590B0-5D8B-43CA-BBF1-FC06D7121DA7}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=NDV&o=15765&src=kw&q={searchTerms}&locale=&apn_ptnrs=NY&apn_dtid=YYYYYYYYDE&apn_uid=97110DCF-E7E9-4DEB-BFAF-2D6254883610&apn_sauid=5861F0D3-2470-423D-9F52-BC6B55443B4C&
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.startup.homepage: "www.google.de"
FF - user.js - File not found
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@movenetworks.com/Quantum Media Player:  File not found
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@pages.tvunetworks.com/WebPlayer: C:\Windows\system32\TVUAx\npTVUAx.dll (TVU networks)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@veetle.com/veetleCorePlugin,version=0.9.18: C:\Program Files\Veetle\plugins\npVeetle.dll (Veetle Inc)
FF - HKLM\Software\MozillaPlugins\@veetle.com/veetlePlayerPlugin,version=0.9.18: C:\Program Files\Veetle\Player\npvlc.dll (Veetle Inc)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@movenetworks.com/Quantum Media Player:  File not found
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{B728AB94-9BC7-49b7-B76A-422BB31B2FD0}: C:\Program Files\ArcSoft\Media Converter for Philips\Internet Video Downloader\Plugin_FireFox [2010.05.28 19:30:03 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010.12.24 10:47:30 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\wrc@avast.com: C:\Program Files\Alwil Software\Avast5\WebRep\FF [2012.03.21 07:59:22 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.03.17 16:54:04 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.03.11 12:33:32 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 8.0\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2011.12.10 01:07:10 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 8.0\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins [2012.03.11 12:33:33 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\te_7.0@nokia.com: C:\Program Files\Nokia\Nokia Suite\Connectors\Thunderbird Connector\ThunderbirdExtension_7.0 [2011.11.16 20:28:21 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010.12.24 10:47:30 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{1B4F7A14-66EC-45B3-A6E3-E31E0B5D2950}: C:\Users\Bonnstar007\AppData\Local\{1B4F7A14-66EC-45B3-A6E3-E31E0B5D2950}
 
[2012.02.07 23:57:08 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Bonnstar007\AppData\Roaming\mozilla\Extensions
[2010.09.05 13:40:51 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Bonnstar007\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2011.08.25 20:41:18 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Bonnstar007\AppData\Roaming\mozilla\Extensions\home2@tomtom.com
[2012.03.23 01:25:30 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Bonnstar007\AppData\Roaming\mozilla\Firefox\Profiles\shcwt2u4.default\extensions
[2012.03.10 09:35:28 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\Bonnstar007\AppData\Roaming\mozilla\Firefox\Profiles\shcwt2u4.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2011.11.17 20:25:44 | 000,002,333 | ---- | M] () -- C:\Users\Bonnstar007\AppData\Roaming\Mozilla\Firefox\Profiles\shcwt2u4.default\searchplugins\askcom.xml
[2012.02.13 23:35:45 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2012.03.21 07:59:22 | 000,000,000 | ---D | M] (avast! WebRep) -- C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST5\WEBREP\FF
() (No name found) -- C:\USERS\BONNSTAR007\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\SHCWT2U4.DEFAULT\EXTENSIONS\{9D1F059C-CADA-4111-9696-41A62D64E3BA}.XPI
() (No name found) -- C:\USERS\BONNSTAR007\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\SHCWT2U4.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
[2012.03.17 16:54:03 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2011.02.02 21:40:24 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2012.01.29 16:02:49 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.01.29 15:50:55 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012.01.29 16:02:49 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2012.01.29 16:02:49 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.01.29 16:02:49 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.01.29 16:02:49 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
CHR - default_search_provider: Google ()
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?client=chrome&hl={language}&q={searchTerms}
 
O1 HOSTS File: ([2011.05.24 20:32:44 | 000,000,242 | -HS- | M]) - C:\Windows\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1       localhost
O1 - Hosts: 127.0.0.1 www.firepatch.oni.cc
O1 - Hosts: 127.0.0.1 firepatch2011.blogspot.com
O2 - BHO: (IEPlugin Class) - {11222041-111B-46E3-BD29-EFB2449479B1} - C:\Programme\ArcSoft\Media Converter for Philips\Internet Video Downloader\ArcURLRecord.dll (ArcSoft, Inc.)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Programme\Alwil Software\Avast5\aswWebRepIE.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Programme\Alwil Software\Avast5\aswWebRepIE.dll (AVAST Software)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\avastUI.exe (AVAST Software)
O4 - HKCU..\Run: []  File not found
O4 - HKCU..\Run: [Dxtory Update Checker 2.0] C:\Programme\Dxtory Software\Dxtory2.0\UpdateChecker.exe (Dxtory Software)
O4 - HKCU..\Run: [NokiaSuite.exe] C:\Program Files\Nokia\Nokia Suite\NokiaSuite.exe (Nokia)
O4 - HKCU..\Run: [SkypePM] C:\Users\Bonnstar007\AppData\Local\Skype\SkypePM.exe (Microsoft Corporation)
O4 - Startup: C:\Users\Bonnstar007\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MagicDisc.lnk = C:\Programme\MagicDisc\MagicDisc.exe (MagicISO, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Free YouTube Download - C:\Users\Bonnstar007\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Bonnstar007\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - C:\Programme\Microsoft Office\OFFICE11\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Programme\ICQ7.5\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Programme\ICQ7.5\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: PokerStars.net - {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - C:\Programme\PokerStars.NET\PokerStarsUpdate.exe (PokerStars)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} hxxp://www.shockwave.com/content/bejeweled2/sis/popcaploader_v10.cab (Reg Error: Key error.)
O16 - DPF: {FFB3A759-98B1-446F-BDA9-909C6EB18CC7} hxxp://utilities.pcpitstop.com/Optimize3/pcpitstop2.dll (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{67C9BC67-1B53-4ECE-ABA1-F0E40B7AB444}: NameServer = 192.168.0.1
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Common Files\microsoft shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Common Files\microsoft shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O24 - Desktop WallPaper: C:\Users\Bonnstar007\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O24 - Desktop BackupWallPaper: C:\Users\Bonnstar007\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.03.23 08:48:57 | 003,166,720 | ---- | C] (Dxtory Software) -- C:\Windows\System32\DxtoryCodec.dll
[2012.03.23 08:48:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dxtory2.0
[2012.03.23 08:48:56 | 000,000,000 | ---D | C] -- C:\Program Files\Dxtory Software
[2012.03.22 21:12:52 | 000,000,000 | ---D | C] -- C:\Program Files\ATI Technologies
[2012.03.22 21:12:03 | 000,000,000 | ---D | C] -- C:\Users\Bonnstar007\Desktop\Treiber
[2012.03.22 20:40:50 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
[2012.03.22 20:29:41 | 000,000,000 | ---D | C] -- C:\ProgramData\NVIDIA Corporation
[2012.03.22 14:59:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Futuremark
[2012.03.22 14:56:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Futuremark
[2012.03.22 14:56:20 | 000,000,000 | ---D | C] -- C:\Program Files\Futuremark
[2012.03.22 14:56:13 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Wise Installation Wizard
[2012.03.18 17:56:19 | 000,000,000 | ---D | C] -- C:\Users\Bonnstar007\AppData\Local\Dxtory Software
[2012.03.18 13:32:04 | 003,931,189 | ---- | C] (Geeks3D.com                                                 ) -- C:\Users\Bonnstar007\Desktop\FurMark_1.9.2.exe
[2012.03.18 10:20:36 | 000,000,000 | ---D | C] -- C:\Program Files\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition
[2012.03.17 19:43:40 | 000,000,000 | ---D | C] -- C:\Users\Bonnstar007\AppData\Roaming\Carambis
[2012.03.17 19:43:25 | 000,000,000 | ---D | C] -- C:\Program Files\Carambis
[2012.03.17 19:43:19 | 000,000,000 | ---D | C] -- C:\Users\Bonnstar007\AppData\Local\TempDIR
[2012.03.17 16:23:52 | 000,000,000 | ---D | C] -- C:\Users\Bonnstar007\AppData\Roaming\NVIDIA
[2012.03.15 00:24:15 | 000,000,000 | ---D | C] -- C:\Users\Bonnstar007\AppData\Local\Spotify
[2012.03.15 00:23:55 | 000,000,000 | ---D | C] -- C:\Users\Bonnstar007\AppData\Roaming\Spotify
[2012.03.14 21:06:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\2K Sports
[2012.03.14 20:36:13 | 000,000,000 | ---D | C] -- C:\ProgramData\NVIDIA
[2012.03.14 20:34:34 | 000,061,248 | ---- | C] (Khronos Group) -- C:\Windows\System32\OpenCL.dll
[2012.03.14 20:34:16 | 000,000,000 | ---D | C] -- C:\Program Files\NVIDIA Corporation
[2012.03.14 20:33:56 | 000,000,000 | ---D | C] -- C:\NVIDIA
[2012.03.13 23:48:52 | 000,000,000 | ---D | C] -- C:\Users\Bonnstar007\AppData\Roaming\Auslogics
[2012.03.11 12:44:53 | 000,000,000 | ---D | C] -- C:\Users\Bonnstar007\Documents\NBA LIVE 08
[2012.03.10 18:57:52 | 000,000,000 | ---D | C] -- C:\Users\Bonnstar007\Documents\NHL09
[2012.03.10 18:53:39 | 000,000,000 | ---D | C] -- C:\Users\Bonnstar007\AppData\Roaming\Leadertech
[2012.03.09 21:55:04 | 000,000,000 | ---D | C] -- C:\Program Files\PriceGong
[2012.03.08 21:26:06 | 000,000,000 | ---D | C] -- C:\Users\Bonnstar007\Unigine Heaven
[2012.03.06 20:08:52 | 000,000,000 | ---D | C] -- C:\Users\Bonnstar007\Desktop\PESEdit.com_2012_Patch_3.0
[8 C:\Users\Bonnstar007\Documents\*.tmp files -> C:\Users\Bonnstar007\Documents\*.tmp -> ]
[19 C:\Users\Bonnstar007\Desktop\*.tmp files -> C:\Users\Bonnstar007\Desktop\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.03.26 17:22:03 | 000,682,082 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.03.26 17:22:03 | 000,639,396 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.03.26 17:22:03 | 000,142,110 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.03.26 17:22:03 | 000,116,164 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.03.26 17:17:52 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.03.26 17:17:47 | 1610,162,176 | -HS- | M] () -- C:\hiberfil.sys
[2012.03.26 17:05:45 | 000,010,288 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.03.26 17:05:45 | 000,010,288 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.03.26 17:00:37 | 000,001,104 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.03.26 16:58:01 | 000,001,108 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.03.22 14:57:39 | 000,001,181 | ---- | M] () -- C:\Users\Public\Desktop\3DMark Vantage.lnk
[2012.03.21 07:59:24 | 000,002,577 | ---- | M] () -- C:\Windows\System32\config.nt
[2012.03.20 22:26:34 | 000,001,523 | ---- | M] () -- C:\Users\Bonnstar007\Desktop\nba2k11 - Verknüpfung.lnk
[2012.03.18 13:32:09 | 003,931,189 | ---- | M] (Geeks3D.com                                                 ) -- C:\Users\Bonnstar007\Desktop\FurMark_1.9.2.exe
[2012.03.17 19:45:53 | 000,004,998 | ---- | M] () -- C:\ProgramData\mtbjfghn.xbe
[2012.03.17 19:37:44 | 000,000,554 | ---- | M] () -- C:\Users\Bonnstar007\Documents\cc_20120317_183741.reg
[2012.03.17 19:37:15 | 000,007,024 | ---- | M] () -- C:\Users\Bonnstar007\Documents\cc_20120317_183709.reg
[2012.03.15 00:24:14 | 000,001,841 | ---- | M] () -- C:\Users\Bonnstar007\Desktop\Spotify.lnk
[2012.03.14 21:06:23 | 000,001,044 | ---- | M] () -- C:\Users\Public\Desktop\NBA 2K12.lnk
[2012.03.14 20:19:38 | 000,375,904 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2012.03.11 12:31:13 | 000,000,120 | ---- | M] () -- C:\Users\Bonnstar007\AppData\Roaming\default.rss
[2012.03.09 21:48:29 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2012.03.09 21:48:29 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2012.03.07 02:15:19 | 000,041,184 | ---- | M] (AVAST Software) -- C:\Windows\avastSS.scr
[2012.03.07 02:15:14 | 000,201,352 | ---- | M] (AVAST Software) -- C:\Windows\System32\aswBoot.exe
[2012.03.07 02:03:51 | 000,612,184 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswSnx.sys
[2012.03.07 02:03:38 | 000,337,880 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswSP.sys
[2012.03.07 02:02:14 | 000,044,376 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswRdr2.sys
[2012.03.07 02:01:53 | 000,053,848 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswTdi.sys
[2012.03.07 02:01:48 | 000,057,688 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswMonFlt.sys
[2012.03.07 02:01:30 | 000,020,696 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswFsBlk.sys
[2012.03.01 01:59:00 | 000,061,248 | ---- | M] (Khronos Group) -- C:\Windows\System32\OpenCL.dll
[2012.03.01 01:59:00 | 000,008,772 | ---- | M] () -- C:\Windows\System32\nvinfo.pb
[2012.02.29 22:58:52 | 002,515,790 | ---- | M] () -- C:\Windows\System32\nvcoproc.bin
[2012.02.29 14:26:56 | 000,416,064 | ---- | M] () -- C:\Windows\System32\nvStreaming.exe
[8 C:\Users\Bonnstar007\Documents\*.tmp files -> C:\Users\Bonnstar007\Documents\*.tmp -> ]
[19 C:\Users\Bonnstar007\Desktop\*.tmp files -> C:\Users\Bonnstar007\Desktop\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.03.22 20:30:35 | 002,515,790 | ---- | C] () -- C:\Windows\System32\nvcoproc.bin
[2012.03.22 14:57:38 | 000,001,181 | ---- | C] () -- C:\Users\Public\Desktop\3DMark Vantage.lnk
[2012.03.20 22:26:34 | 000,001,523 | ---- | C] () -- C:\Users\Bonnstar007\Desktop\nba2k11 - Verknüpfung.lnk
[2012.03.17 19:45:53 | 000,004,998 | ---- | C] () -- C:\ProgramData\mtbjfghn.xbe
[2012.03.17 19:37:42 | 000,000,554 | ---- | C] () -- C:\Users\Bonnstar007\Documents\cc_20120317_183741.reg
[2012.03.17 19:37:11 | 000,007,024 | ---- | C] () -- C:\Users\Bonnstar007\Documents\cc_20120317_183709.reg
[2012.03.15 00:24:14 | 000,001,841 | ---- | C] () -- C:\Users\Bonnstar007\Desktop\Spotify.lnk
[2012.03.15 00:24:14 | 000,001,827 | ---- | C] () -- C:\Users\Bonnstar007\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spotify.lnk
[2012.03.14 21:06:23 | 000,001,044 | ---- | C] () -- C:\Users\Public\Desktop\NBA 2K12.lnk
[2012.03.14 20:34:34 | 000,008,772 | ---- | C] () -- C:\Windows\System32\nvinfo.pb
[2012.03.09 21:48:29 | 000,000,000 | RHS- | C] () -- C:\MSDOS.SYS
[2012.03.09 21:48:29 | 000,000,000 | RHS- | C] () -- C:\IO.SYS
[2012.02.29 14:26:56 | 000,416,064 | ---- | C] () -- C:\Windows\System32\nvStreaming.exe
[2011.08.11 22:16:11 | 000,000,099 | ---- | C] () -- C:\Users\Bonnstar007\AppData\Local\fusioncache.dat
[2011.04.29 08:35:49 | 000,080,896 | ---- | C] () -- C:\Windows\System32\RDVGHelper.exe
[2011.04.29 08:34:32 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe
[2010.12.29 22:26:51 | 000,256,512 | ---- | C] () -- C:\Windows\PEV.exe
[2010.12.29 22:26:51 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2010.12.29 22:26:51 | 000,089,088 | ---- | C] () -- C:\Windows\MBR.exe
[2010.12.29 22:26:51 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2010.12.29 22:26:51 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2010.12.24 10:39:24 | 000,238,988 | ---- | C] () -- C:\Windows\hpwins26.dat
[2010.08.29 22:34:33 | 000,000,026 | ---- | C] () -- C:\Windows\NeoSetup.INI
[2010.06.22 14:03:10 | 000,004,096 | -H-- | C] () -- C:\Users\Bonnstar007\AppData\Local\keyfile3.drm
[2010.05.28 19:49:10 | 000,022,140 | ---- | C] () -- C:\Windows\System32\emptyregdb.dat
[2010.05.28 19:25:50 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2010.05.26 12:40:10 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2010.04.29 17:37:26 | 000,002,137 | ---- | C] () -- C:\Windows\System32\atipblag.dat
[2010.04.06 19:54:32 | 000,203,336 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat
 
========== LOP Check ==========
 
[2010.12.24 11:39:53 | 000,000,000 | ---D | M] -- C:\Users\Bonnstar007\AppData\Roaming\12339
[2012.03.14 21:10:05 | 000,000,000 | ---D | M] -- C:\Users\Bonnstar007\AppData\Roaming\2K Sports
[2011.03.08 22:16:50 | 000,000,000 | ---D | M] -- C:\Users\Bonnstar007\AppData\Roaming\62486
[2011.05.27 16:59:54 | 000,000,000 | ---D | M] -- C:\Users\Bonnstar007\AppData\Roaming\Amazon
[2012.03.13 23:48:52 | 000,000,000 | ---D | M] -- C:\Users\Bonnstar007\AppData\Roaming\Auslogics
[2010.11.29 16:01:39 | 000,000,000 | ---D | M] -- C:\Users\Bonnstar007\AppData\Roaming\AVG10
[2012.03.17 19:52:26 | 000,000,000 | ---D | M] -- C:\Users\Bonnstar007\AppData\Roaming\Carambis
[2009.03.06 19:11:44 | 000,000,000 | ---D | M] -- C:\Users\Bonnstar007\AppData\Roaming\DAEMON Tools
[2011.10.21 20:38:27 | 000,000,000 | ---D | M] -- C:\Users\Bonnstar007\AppData\Roaming\DAEMON Tools Lite
[2010.05.28 19:41:51 | 000,000,000 | ---D | M] -- C:\Users\Bonnstar007\AppData\Roaming\DAEMON Tools Pro
[2010.05.28 19:41:51 | 000,000,000 | ---D | M] -- C:\Users\Bonnstar007\AppData\Roaming\Diercke Globus Online
[2012.03.10 09:36:05 | 000,000,000 | ---D | M] -- C:\Users\Bonnstar007\AppData\Roaming\DVDVideoSoft
[2011.04.18 23:32:14 | 000,000,000 | ---D | M] -- C:\Users\Bonnstar007\AppData\Roaming\DVDVideoSoftIEHelpers
[2010.05.28 19:41:51 | 000,000,000 | ---D | M] -- C:\Users\Bonnstar007\AppData\Roaming\ICAClient
[2011.11.01 23:20:28 | 000,000,000 | ---D | M] -- C:\Users\Bonnstar007\AppData\Roaming\ICQ
[2011.08.11 22:17:21 | 000,000,000 | ---D | M] -- C:\Users\Bonnstar007\AppData\Roaming\Imaxel
[2010.05.28 19:41:52 | 000,000,000 | ---D | M] -- C:\Users\Bonnstar007\AppData\Roaming\IrfanView
[2011.09.17 16:07:25 | 000,000,000 | ---D | M] -- C:\Users\Bonnstar007\AppData\Roaming\Kalypso Media
[2012.03.10 18:53:39 | 000,000,000 | ---D | M] -- C:\Users\Bonnstar007\AppData\Roaming\Leadertech
[2010.05.28 19:42:11 | 000,000,000 | ---D | M] -- C:\Users\Bonnstar007\AppData\Roaming\Notepad++
[2010.05.28 19:42:11 | 000,000,000 | ---D | M] -- C:\Users\Bonnstar007\AppData\Roaming\OpenOffice.org
[2009.09.14 18:16:27 | 000,000,000 | ---D | M] -- C:\Users\Bonnstar007\AppData\Roaming\Ordner HP Share-to-Web
[2011.11.16 20:32:37 | 000,000,000 | ---D | M] -- C:\Users\Bonnstar007\AppData\Roaming\PC Suite
[2011.03.05 16:45:13 | 000,000,000 | ---D | M] -- C:\Users\Bonnstar007\AppData\Roaming\PCFix
[2011.01.28 13:05:44 | 000,000,000 | ---D | M] -- C:\Users\Bonnstar007\AppData\Roaming\PDF Software
[2011.01.28 13:23:08 | 000,000,000 | ---D | M] -- C:\Users\Bonnstar007\AppData\Roaming\PixelPlanet
[2010.05.28 19:42:12 | 000,000,000 | ---D | M] -- C:\Users\Bonnstar007\AppData\Roaming\ProtectDisc
[2012.03.26 10:08:44 | 000,000,000 | ---D | M] -- C:\Users\Bonnstar007\AppData\Roaming\Spotify
[2010.12.23 20:39:06 | 000,000,000 | ---D | M] -- C:\Users\Bonnstar007\AppData\Roaming\temp
[2010.09.05 13:40:47 | 000,000,000 | ---D | M] -- C:\Users\Bonnstar007\AppData\Roaming\Thunderbird
[2011.08.25 20:41:15 | 000,000,000 | ---D | M] -- C:\Users\Bonnstar007\AppData\Roaming\TomTom
[2011.09.17 16:12:16 | 000,000,000 | ---D | M] -- C:\Users\Bonnstar007\AppData\Roaming\Tropico 4
[2010.05.28 19:42:13 | 000,000,000 | ---D | M] -- C:\Users\Bonnstar007\AppData\Roaming\TuneUp Software
[2011.03.05 17:34:10 | 000,000,000 | ---D | M] -- C:\Users\Bonnstar007\AppData\Roaming\Uniblue
[2011.08.29 18:49:50 | 000,000,000 | ---D | M] -- C:\Users\Bonnstar007\AppData\Roaming\wargaming.net
[2010.10.23 10:13:55 | 000,000,000 | ---D | M] -- C:\Users\Bonnstar007\AppData\Roaming\XWindows Dock
[2012.02.13 08:08:42 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
< %SYSTEMDRIVE%\*. >
[2010.03.25 21:51:44 | 000,000,000 | ---D | M] -- C:\$AVG
[2010.05.28 20:09:11 | 000,000,000 | ---D | M] -- C:\$INPLACE.~TR
[2011.03.20 17:02:24 | 000,000,000 | -HSD | M] -- C:\$RECYCLE.BIN
[2010.05.28 19:50:18 | 000,000,000 | ---D | M] -- C:\$WINDOWS.~Q
[2010.02.15 15:30:40 | 000,000,000 | ---D | M] -- C:\AllDupBackup
[2009.03.13 14:47:53 | 000,000,000 | ---D | M] -- C:\ATI
[2011.04.29 09:13:50 | 000,000,000 | -HSD | M] -- C:\Boot
[2009.09.14 18:12:34 | 000,000,000 | ---D | M] -- C:\col3927
[2012.03.22 14:56:30 | 000,000,000 | ---D | M] -- C:\Config.Msi
[2009.03.06 18:28:27 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen
[2011.12.21 00:28:17 | 000,000,000 | ---D | M] -- C:\Fraps
[2012.03.09 21:56:03 | 000,000,000 | ---D | M] -- C:\Games
[2011.09.10 17:30:03 | 000,000,000 | ---D | M] -- C:\GenTool
[2011.02.11 15:28:38 | 000,000,000 | ---D | M] -- C:\Medion
[2012.03.22 20:36:04 | 000,000,000 | ---D | M] -- C:\NVIDIA
[2009.07.14 04:37:05 | 000,000,000 | ---D | M] -- C:\PerfLogs
[2012.03.23 08:48:56 | 000,000,000 | R--D | M] -- C:\Program Files
[2012.03.22 20:29:41 | 000,000,000 | ---D | M] -- C:\ProgramData
[2009.03.06 18:28:27 | 000,000,000 | -HSD | M] -- C:\Programme
[2011.03.10 22:37:22 | 000,000,000 | ---D | M] -- C:\Qoobox
[2010.05.28 20:28:07 | 000,000,000 | ---D | M] -- C:\Recovery
[2009.09.13 13:43:23 | 000,000,000 | ---D | M] -- C:\sj652
[2012.03.25 21:29:04 | 000,000,000 | -HSD | M] -- C:\System Volume Information
[2010.12.24 01:26:40 | 000,000,000 | ---D | M] -- C:\temp
[2012.03.22 20:37:15 | 000,000,000 | R--D | M] -- C:\Users
[2012.03.26 17:09:52 | 000,000,000 | ---D | M] -- C:\Windows
[2010.12.29 20:56:07 | 000,000,000 | ---D | M] -- C:\_OTL
 
< %PROGRAMFILES%\*.exe >
 
< %LOCALAPPDATA%\*.exe >
 
< %systemroot%\*. /mp /s >
 
< MD5 for: AGP440.SYS  >
[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\ERDNT\cache\AGP440.sys
[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\drivers\AGP440.sys
[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_x86_neutral_a97a2a0d0fbc6696\AGP440.sys
[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_b9e9435f20046eeb\AGP440.sys
[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_bc1a57271cf2f285\AGP440.sys
 
< MD5 for: AHCIX86S.SYS  >
[2007.11.01 16:31:46 | 000,122,880 | ---- | M] (Promise Technology, Inc.) MD5=4283A0F3A9557EB133D2BA8979747A77 -- C:\Users\Bonnstar007\Desktop\Treiber\WIN7\Packages\Drivers\SBDrv\SB6xx\RAID\LH\ahcix86s.sys
[2009.04.08 15:45:10 | 000,188,944 | ---- | M] (Advanced Micro Devices, Inc) MD5=A2A2E677071141196C57FF7D2608EBB3 -- C:\Users\Bonnstar007\Desktop\Treiber\WIN7\Packages\Drivers\SBDrv\SB7xx\RAID\LH\ahcix86s.sys
 
< MD5 for: ATAPI.SYS  >
[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\ERDNT\cache\atapi.sys
[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\drivers\atapi.sys
[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_x86_neutral_fab873f3e8a3315c\atapi.sys
[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_dd0e7e3d82dd640d\atapi.sys
[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_df3f92057fcbe7a7\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\ERDNT\cache\cngaudit.dll
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\System32\cngaudit.dll
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
 
< MD5 for: EXPLORER.EXE  >
[2011.02.26 07:19:21 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_54149f9ef14031fc\explorer.exe
[2009.07.14 03:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_518afd35db100430\explorer.exe
[2011.02.26 07:51:13 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=255CF508D7CFB10E0794D6AC93280BD8 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_525b5180f3f95373\explorer.exe
[2009.10.31 07:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- C:\Windows\ERDNT\cache\explorer.exe
[2009.10.31 07:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_51a66d6ddafc2ed1\explorer.exe
[2011.02.26 07:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_51a3a583dafd0cef\explorer.exe
[2010.11.20 14:17:09 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_53bc10fdd7fe87ca\explorer.exe
[2011.02.25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\explorer.exe
[2011.02.25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_5389023fd8245f84\explorer.exe
[2010.11.23 00:21:33 | 000,004,608 | ---- | M] () MD5=9214399E2FDE9C7549C2D5FD0E24F808 -- C:\Users\Bonnstar007\AppData\Local\Xenocode\ApplianceCaches\GameCamV2.exe_v7AC6EAFE\Native\STUBEXE\@WINDIR@\explorer.exe
[2009.08.03 07:49:47 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_526619d4f3f142e6\explorer.exe
[2009.08.03 07:35:50 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_51e07e31dad00878\explorer.exe
[2009.10.31 08:00:51 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_52283b2af41f3691\explorer.exe
 
< MD5 for: IASTORV.SYS  >
[2011.03.11 07:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- C:\Windows\System32\drivers\iaStorV.sys
[2011.03.11 07:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_0bcee2057afcc090\iaStorV.sys
[2011.03.11 07:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_b0daddb9e6380745\iaStorV.sys
[2011.03.11 07:43:55 | 000,332,160 | ---- | M] (Intel Corporation) MD5=71F1A494FEDF4B33C02C4A6A28D6D9E9 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_aef580fde910b4b0\iaStorV.sys
[2011.03.11 07:28:00 | 000,332,160 | ---- | M] (Intel Corporation) MD5=778D0E6D7D9EBA0C403BADBAAD41DB20 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_b152a892ff64119f\iaStorV.sys
[2009.07.14 03:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_aee7a89be91b9000\iaStorV.sys
[2010.11.20 14:29:54 | 000,332,160 | ---- | M] (Intel Corporation) MD5=A3CAE5D281DB4CFF7CFF8233507EE5AD -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_668286aa35d55928\iaStorV.sys
[2010.11.20 14:29:54 | 000,332,160 | ---- | M] (Intel Corporation) MD5=A3CAE5D281DB4CFF7CFF8233507EE5AD -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_b118bc63e60a139a\iaStorV.sys
[2011.03.11 07:52:21 | 000,332,160 | ---- | M] (Intel Corporation) MD5=B9039A34C2F8769490DCC494E2402445 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_afae2d45020c148b\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\System32\netlogon.dll
[2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_ffbf212e963c0162\netlogon.dll
[2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\ERDNT\cache\netlogon.dll
[2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_fd8e0d66994d7dc8\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2011.03.11 07:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- C:\Windows\System32\drivers\nvstor.sys
[2011.03.11 07:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_0276fc3b3ea60d41\nvstor.sys
[2011.03.11 07:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_3ba44e691d6eb11d\nvstor.sys
[2011.03.11 07:44:01 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4520B63899E867F354EE012D34E11536 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_39bef1ad20475e88\nvstor.sys
[2011.03.11 07:28:10 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=66D468654A58594F5F3BA63D5AD5B1AF -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_3c1c1942369abb77\nvstor.sys
[2011.03.11 07:52:25 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=8A7583A3B58D3EEB28BB26626526BC91 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_3a779df43942be63\nvstor.sys
[2010.11.20 14:30:06 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=9283C58EBAA2618F93482EB5DABCEC82 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_dd659ed032d28a14\nvstor.sys
[2010.11.20 14:30:06 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=9283C58EBAA2618F93482EB5DABCEC82 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_3be22d131d40bd72\nvstor.sys
[2009.07.14 03:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_39b1194b205239d8\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\ERDNT\cache\scecli.dll
[2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_37e4387f3a6f0483\scecli.dll
[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\System32\scecli.dll
[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_3a154c47375d881d\scecli.dll
 
< MD5 for: USER32.DLL  >
[2009.07.14 03:16:17 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=34B7E222E81FAFA885F0C5F2CFA56861 -- C:\Windows\ERDNT\cache\user32.dll
[2009.07.14 03:16:17 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=34B7E222E81FAFA885F0C5F2CFA56861 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_cd0ec264ceb014a3\user32.dll
[2010.11.20 14:21:33 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 -- C:\Windows\System32\user32.dll
[2010.11.20 14:21:33 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_cf3fd62ccb9e983d\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\System32\userinit.exe
[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\ERDNT\cache\userinit.exe
[2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2009.10.28 08:17:59 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD -- C:\Windows\ERDNT\cache\winlogon.exe
[2009.10.28 08:17:59 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_6fc699643622d177\winlogon.exe
[2009.10.28 07:52:08 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=3BABE6767C78FBF5FB8435FEED187F30 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_703394514f56f7c2\winlogon.exe
[2010.11.20 14:17:54 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\System32\winlogon.exe
[2010.11.20 14:17:54 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_71ca6b0233339500\winlogon.exe
[2009.07.14 03:14:45 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=8EC6A4AB12B8F3759E21F8E3A388F2CF -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_6f99573a36451166\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2009.07.14 01:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\System32\drivers\ws2ifsl.sys
[2009.07.14 01:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_4f5cf6f829213bb2\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\system32\*.dll /lockedfiles >
 
< %USERPROFILE%\*.* >
[2012.03.26 17:45:43 | 003,670,016 | -HS- | M] () -- C:\Users\Bonnstar007\ntuser.dat
[2012.03.26 17:45:43 | 000,262,144 | -HS- | M] () -- C:\Users\Bonnstar007\ntuser.dat.LOG1
[2010.05.28 19:28:28 | 000,000,000 | -HS- | M] () -- C:\Users\Bonnstar007\ntuser.dat.LOG2
[2011.11.09 00:23:03 | 000,065,536 | -HS- | M] () -- C:\Users\Bonnstar007\ntuser.dat{44a77226-09d2-11e1-8d10-001d922e28c2}.TM.blf
[2011.11.09 00:23:03 | 000,524,288 | -HS- | M] () -- C:\Users\Bonnstar007\ntuser.dat{44a77226-09d2-11e1-8d10-001d922e28c2}.TMContainer00000000000000000001.regtrans-ms
[2011.11.09 00:23:03 | 000,524,288 | -HS- | M] () -- C:\Users\Bonnstar007\ntuser.dat{44a77226-09d2-11e1-8d10-001d922e28c2}.TMContainer00000000000000000002.regtrans-ms
[2010.05.28 19:28:29 | 000,065,536 | -HS- | M] () -- C:\Users\Bonnstar007\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TM.blf
[2010.05.28 19:28:29 | 000,524,288 | -HS- | M] () -- C:\Users\Bonnstar007\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000001.regtrans-ms
[2010.05.28 19:28:29 | 000,524,288 | -HS- | M] () -- C:\Users\Bonnstar007\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000002.regtrans-ms
[2010.05.28 20:30:40 | 000,000,020 | -HS- | M] () -- C:\Users\Bonnstar007\ntuser.ini
[2012.02.03 22:45:27 | 000,010,599 | ---- | M] () -- C:\Users\Bonnstar007\Schenkel_elster_2048.pfx
 
< %USERPROFILE%\Local Settings\Temp\*.exe >
 
< %USERPROFILE%\Local Settings\Temp\*.dll >
 
< %USERPROFILE%\Application Data\*.exe >
 
< HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs >
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Required: DebugWindows [binary data]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Windows: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
 
<           >

< End of report >
         

--- --- ---

hi

dieses script sowie evtl. folgende scripts sind nur für den jeweiligen user.
wenn ihr probleme habt, eröffnet eigene topics und wartet auf, für euch angepasste scripts.


• Starte bitte die OTL.exe
• Kopiere nun das Folgende in die Textbox.

:OTL
O4 - HKCU..\Run: [SkypePM] C:\Users\Bonnstar007\AppData\Local\Skype\SkypePM.exe (Microsoft Corporation)
 :Files
C:\Users\Bonnstar007\AppData\Local\Skype
:Commands
[purity]
[EMPTYFLASH] 
[emptytemp]
[Reboot]
         

• Schliesse bitte nun alle Programme.
• Klicke nun bitte auf den Fix Button.
• OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
• Nach dem Neustart findest Du ein Textdokument, dessen inhalt in deiner nächsten antwort hier reinkopieren.
starte in den normalen modus.

falls du keine symbole hast, dann rechtsklick, ansicht, desktop symbole einblenden

Hinweis: Die Datei bitte wie in der Anleitung zum UpChannel angegeben auch da hochladen. Bitte NICHT die ZIP-Datei hier als Anhang
in den Thread posten!



Drücke bitte die + E Taste.

• Öffne dein Systemlaufwerk ( meistens C: )
• Suche nun
  folgenden Ordner: _OTL und öffne diesen.
• Mache einen Rechtsklick auf den Ordner Movedfiles --> Senden an --> Zip-Komprimierter Ordner
• 
  Dies wird eine Movedfiles.zip Datei in _OTL erstellen
• Lade diese bitte in unseren Uploadchannel
  hoch. ( Durchsuchen --> C:\_OTL\Movedfiles.zip )

Teile mir mit ob der Upload problemlos geklappt hat. Danke im voraus

hier ist die datei...

All processes killed
========== OTL ==========
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\SkypePM deleted successfully.
C:\Users\Bonnstar007\AppData\Local\Skype\SkypePM.exe moved successfully.
========== COMMANDS ==========

[EMPTYFLASH]

User: All Users

User: Bonnstar007
->Flash cache emptied: 858 bytes

User: Default

User: Default User

User: Public

User: UpdatusUser

Total Flash Files Cleaned = 0,00 mb


[EMPTYTEMP]

User: All Users

User: Bonnstar007
->Temp folder emptied: 45170100 bytes
->Temporary Internet Files folder emptied: 3116483 bytes
->Java cache emptied: 6517323 bytes
->FireFox cache emptied: 49992831 bytes
->Apple Safari cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Public
->Temp folder emptied: 0 bytes

User: UpdatusUser
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 200704 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 1805184 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 102,00 mb


OTL by OldTimer - Version 3.2.39.2 log created on 03262012_180018

upload fehlt, nachholen.

ich bin immer noch immer abgesicherten Modus...

warum, hab ich nicht geschrieben dass du in den normalen modus starten sollst?

doch...sorry.

Datei ist hochgeladen....

danke

Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich
ziehen und eine Bereinigung der Infektion noch erschweren.

Bitte downloade dir Combofix.exe und speichere es unbedingt auf deinem Desktop.

• Besuche folgende Seite für Downloadlinks und Anweisungen für dieses
  Tool
  
  Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  
• Hinweis:
  Gehe sicher das all deine Anti Virus und Anti Malware Programme abgeschalten sind, damit diese Combofix nicht bei der Arbeit stören.
• Poste bitte die C:\Combofix.txt in deiner nächsten Antwort.

So hier ist das Logfile von Combofix:

Combofix Logfile:

ComboFix 12-03-26.02 - Bonnstar007 26.03.2012  18:26:59.4.2 - x86
Microsoft Windows 7 Ultimate   6.1.7601.1.1252.49.1031.18.2047.1116 [GMT 2:00]
ausgeführt von:: c:\users\Bonnstar007\Downloads\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Bonnstar007\AppData\Local\TempDIR
c:\users\Bonnstar007\AppData\Roaming\Microsoft\Windows\Recent\Thumbs.db
c:\users\Bonnstar007\AppData\Roaming\PCFix
c:\users\Bonnstar007\AppData\Roaming\PCFix\log.dat
c:\users\Bonnstar007\AppData\Roaming\PCFix\unresolvederrors.dat
c:\users\Bonnstar007\Documents\~WRL0001.tmp
c:\users\Bonnstar007\Documents\~WRL0349.tmp
c:\users\Bonnstar007\Documents\~WRL0674.tmp
c:\users\Bonnstar007\Documents\~WRL1957.tmp
c:\users\Bonnstar007\Documents\~WRL2529.tmp
c:\users\Bonnstar007\Documents\~WRL3410.tmp
c:\users\Bonnstar007\Documents\~WRL3765.tmp
c:\users\Bonnstar007\Documents\~WRL3868.tmp
c:\windows\IsUn0407.exe
.
.
(((((((((((((((((((((((   Dateien erstellt von 2012-02-26 bis 2012-03-26  ))))))))))))))))))))))))))))))
.
.
2012-03-26 16:37 . 2012-03-26 16:37	--------	d-----w-	c:\users\Public\AppData\Local\temp
2012-03-26 16:37 . 2012-03-26 16:37	--------	d-----w-	c:\users\Default\AppData\Local\temp
2012-03-26 14:59 . 2012-03-26 16:28	56200	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{4FB7BEF0-EA10-43B3-B439-FCF3FEC9395B}\offreg.dll
2012-03-23 06:48 . 2011-05-23 22:23	3166720	----a-w-	c:\windows\system32\DxtoryCodec.dll
2012-03-23 06:48 . 2012-03-23 06:48	--------	d-----w-	c:\program files\Dxtory Software
2012-03-23 06:00 . 2012-03-14 02:15	6582328	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{4FB7BEF0-EA10-43B3-B439-FCF3FEC9395B}\mpengine.dll
2012-03-22 19:12 . 2012-03-22 19:12	--------	d-----w-	c:\program files\ATI Technologies
2012-03-22 18:37 . 2012-03-22 18:37	--------	d-----w-	c:\users\UpdatusUser
2012-03-22 18:34 . 2012-01-17 12:46	27968	----a-w-	c:\windows\system32\nvhdap32.dll
2012-03-22 18:34 . 2012-01-17 12:45	148800	----a-w-	c:\windows\system32\drivers\nvhda32v.sys
2012-03-22 18:34 . 2012-01-17 12:45	876864	----a-w-	c:\windows\system32\nvhdagenco3220103.dll
2012-03-22 18:30 . 2012-02-29 20:58	2515790	----a-w-	c:\windows\system32\nvcoproc.bin
2012-03-22 18:30 . 2012-02-29 20:56	3881792	----a-w-	c:\windows\system32\nvcpl.dll
2012-03-22 18:30 . 2012-02-29 20:55	2719040	----a-w-	c:\windows\system32\nvsvc.dll
2012-03-22 18:30 . 2012-02-29 20:53	108352	----a-w-	c:\windows\system32\nvmctray.dll
2012-03-22 18:30 . 2012-02-29 20:53	645440	----a-w-	c:\windows\system32\nvvsvc.exe
2012-03-22 18:30 . 2012-02-29 20:53	62272	----a-w-	c:\windows\system32\nvshext.dll
2012-03-22 18:29 . 2012-03-22 18:29	--------	d-----w-	c:\programdata\NVIDIA Corporation
2012-03-22 12:59 . 2012-03-22 12:59	--------	d-----w-	c:\programdata\Futuremark
2012-03-22 12:56 . 2012-03-22 12:57	--------	d-----w-	c:\program files\Futuremark
2012-03-22 12:56 . 2012-03-22 12:56	--------	d-----w-	c:\program files\Common Files\Wise Installation Wizard
2012-03-22 12:56 . 2010-05-26 10:41	2106216	----a-w-	c:\windows\system32\D3DCompiler_43.dll
2012-03-22 12:56 . 2010-05-26 10:41	470880	----a-w-	c:\windows\system32\d3dx10_43.dll
2012-03-18 15:56 . 2012-03-23 06:48	--------	d-----w-	c:\users\Bonnstar007\AppData\Local\Dxtory Software
2012-03-18 08:20 . 2012-03-22 18:44	--------	d-----w-	c:\program files\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition
2012-03-17 17:43 . 2012-03-17 17:52	--------	d-----w-	c:\users\Bonnstar007\AppData\Roaming\Carambis
2012-03-17 17:43 . 2012-03-17 17:43	--------	d-----w-	c:\program files\Carambis
2012-03-17 14:54 . 2012-03-17 14:54	592824	----a-w-	c:\program files\Mozilla Firefox\gkmedias.dll
2012-03-17 14:54 . 2012-03-17 14:54	44472	----a-w-	c:\program files\Mozilla Firefox\mozglue.dll
2012-03-17 14:23 . 2012-03-18 11:32	--------	d-----w-	c:\users\Bonnstar007\AppData\Roaming\NVIDIA
2012-03-14 22:24 . 2012-03-26 07:53	--------	d-----w-	c:\users\Bonnstar007\AppData\Local\Spotify
2012-03-14 22:23 . 2012-03-26 08:08	--------	d-----w-	c:\users\Bonnstar007\AppData\Roaming\Spotify
2012-03-14 18:36 . 2012-03-26 16:13	--------	d-----w-	c:\programdata\NVIDIA
2012-03-14 18:35 . 2012-02-29 20:53	2561344	----a-w-	c:\windows\system32\nvsvcr.dll
2012-03-14 18:33 . 2012-03-22 18:36	--------	d-----w-	C:\NVIDIA
2012-03-14 07:37 . 2011-11-19 14:50	3968368	----a-w-	c:\windows\system32\ntkrnlpa.exe
2012-03-14 07:37 . 2011-11-19 14:50	3913584	----a-w-	c:\windows\system32\ntoskrnl.exe
2012-03-14 06:15 . 2012-02-03 03:54	2343424	----a-w-	c:\windows\system32\win32k.sys
2012-03-14 06:15 . 2012-02-10 05:38	1077248	----a-w-	c:\windows\system32\DWrite.dll
2012-03-14 06:14 . 2012-01-25 05:32	58880	----a-w-	c:\windows\system32\rdpwsx.dll
2012-03-14 06:14 . 2012-01-25 05:32	129536	----a-w-	c:\windows\system32\rdpcorekmts.dll
2012-03-14 06:14 . 2012-01-25 05:27	8192	----a-w-	c:\windows\system32\rdrmemptylst.exe
2012-03-14 06:14 . 2012-02-17 05:34	919040	----a-w-	c:\windows\system32\rdpcorets.dll
2012-03-14 06:14 . 2012-02-17 05:34	826880	----a-w-	c:\windows\system32\rdpcore.dll
2012-03-14 06:14 . 2012-02-17 04:14	183808	----a-w-	c:\windows\system32\drivers\rdpwd.sys
2012-03-14 06:14 . 2012-02-17 04:13	24576	----a-w-	c:\windows\system32\drivers\tdtcp.sys
2012-03-13 21:48 . 2012-03-13 21:48	--------	d-----w-	c:\users\Bonnstar007\AppData\Roaming\Auslogics
2012-03-11 10:33 . 2007-04-30 15:29	49152	----a-w-	c:\program files\Mozilla Firefox\plugins\np32dsw.dll
2012-03-10 16:53 . 2012-03-10 16:53	--------	d-----w-	c:\users\Bonnstar007\AppData\Roaming\Leadertech
2012-03-09 19:55 . 2012-03-11 10:25	--------	d-----w-	c:\program files\PriceGong
2012-03-08 19:26 . 2012-03-08 19:26	--------	d-----w-	c:\users\Bonnstar007\Unigine Heaven
2012-02-29 12:26 . 2012-02-29 12:26	416064	----a-w-	c:\windows\system32\nvStreaming.exe
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-03-16 05:36 . 2011-05-14 07:15	414368	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2012-03-07 00:15 . 2010-12-28 19:40	41184	----a-w-	c:\windows\avastSS.scr
2012-03-07 00:15 . 2010-12-28 19:40	201352	----a-w-	c:\windows\system32\aswBoot.exe
2012-03-07 00:03 . 2011-03-12 10:52	612184	----a-w-	c:\windows\system32\drivers\aswSnx.sys
2012-03-07 00:03 . 2010-12-28 19:40	337880	----a-w-	c:\windows\system32\drivers\aswSP.sys
2012-03-07 00:02 . 2012-02-25 07:28	44376	----a-w-	c:\windows\system32\drivers\aswRdr2.sys
2012-03-07 00:01 . 2010-12-28 19:40	53848	----a-w-	c:\windows\system32\drivers\aswTdi.sys
2012-03-07 00:01 . 2010-12-28 19:40	57688	----a-w-	c:\windows\system32\drivers\aswMonFlt.sys
2012-03-07 00:01 . 2010-12-28 19:40	20696	----a-w-	c:\windows\system32\drivers\aswFsBlk.sys
2012-02-23 08:18 . 2010-02-09 20:01	237072	------w-	c:\windows\system32\MpSigStub.exe
2012-01-04 08:58 . 2012-02-16 05:50	442880	----a-w-	c:\windows\system32\ntshrui.dll
2011-12-30 05:27 . 2012-02-16 05:50	478720	----a-w-	c:\windows\system32\timedate.cpl
2012-03-17 14:54 . 2012-02-13 21:35	97208	----a-w-	c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2012-03-07 00:15	123536	----a-w-	c:\program files\Alwil Software\Avast5\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NokiaSuite.exe"="c:\program files\Nokia\Nokia Suite\NokiaSuite.exe" [2011-11-01 1053056]
"Dxtory Update Checker 2.0"="c:\program files\Dxtory Software\Dxtory2.0\UpdateChecker.exe" [2010-10-17 93696]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-11-01 59240]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-10-24 421888]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2011-08-01 1821576]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-01-16 421736]
.
c:\users\Bonnstar007\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
MagicDisc.lnk - c:\program files\MagicDisc\MagicDisc.exe [2011-9-17 576000]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
VPN Client.lnk - c:\windows\Installer\{B0BF7057-6869-4E4B-920C-EA2A58DA07F0}\Icon3E5562ED7.ico [2010-11-29 6144]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer9"=wdmaud.drv
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^Users^Bonnstar007^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^ATI Tray Tools.lnk]
path=c:\users\Bonnstar007\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ATI Tray Tools.lnk
backup=c:\windows\pss\ATI Tray Tools.lnk.Startup
backupExtension=.Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2012-01-03 07:37	843712	----a-w-	c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CloneCDTray]
2009-01-29 22:20	57344	----a-w-	c:\program files\SlySoft\CloneCD\CloneCDTray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]
2011-03-21 18:56	1230704	----a-w-	c:\program files\DivX\DivX Update\DivXUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2007-05-08 15:24	54840	----a-w-	c:\program files\HP\HP Software Update\hpwuSchd2.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ]
2011-08-01 08:28	124480	----a-w-	c:\program files\ICQ7.5\ICQ.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2012-01-16 16:22	421736	----a-w-	c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PDFPrint]
2011-04-28 07:59	220552	----a-w-	c:\program files\PDF24\pdf24.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PDFServiceEngine]
2008-06-25 16:09	393216	----a-w-	c:\program files\PDF Suite\PDFServiceEngine.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2011-10-24 13:28	421888	----a-w-	c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Companion]
2011-05-23 07:09	431616	----a-w-	c:\program files\Sony Ericsson\Sony Ericsson PC Companion\PCCompanion.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Spotify]
2012-03-14 22:24	4011184	----a-w-	c:\users\Bonnstar007\AppData\Roaming\Spotify\spotify.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]
2011-02-18 19:05	2423752	----a-w-	c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TomTomHOME.exe]
2011-04-22 12:21	247728	----a-w-	c:\program files\TomTom HOME 2\TomTomHOMERunner.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\setup\disabledrunkeys]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-01-19 135664]
R3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [2009-07-13 4194816]
R3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2010-05-27 209920]
R3 cpuz135;cpuz135;c:\windows\TEMP\cpuz135\cpuz135_x32.sys [x]
R3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys [2009-02-25 9728]
R3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys [2009-02-25 3072]
R3 Futuremark SystemInfo Service;Futuremark SystemInfo Service;c:\program files\Futuremark\Futuremark SystemInfo\FMSISvc.exe [2011-03-01 130976]
R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2010-01-19 135664]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2010-11-20 15872]
R3 s0017bus;Sony Ericsson Device 0017 driver (WDM);c:\windows\system32\DRIVERS\s0017bus.sys [2008-10-21 86824]
R3 s0017mdfl;Sony Ericsson Device 0017 USB WMC Modem Filter;c:\windows\system32\DRIVERS\s0017mdfl.sys [2008-10-21 15016]
R3 s0017mdm;Sony Ericsson Device 0017 USB WMC Modem Driver;c:\windows\system32\DRIVERS\s0017mdm.sys [2008-10-21 114600]
R3 s0017mgmt;Sony Ericsson Device 0017 USB WMC Device Management Drivers (WDM);c:\windows\system32\DRIVERS\s0017mgmt.sys [2008-10-21 108328]
R3 s0017nd5;Sony Ericsson Device 0017 USB Ethernet Emulation SEMC0017 (NDIS);c:\windows\system32\DRIVERS\s0017nd5.sys [2008-10-21 26024]
R3 s0017obex;Sony Ericsson Device 0017 USB WMC OBEX Interface;c:\windows\system32\DRIVERS\s0017obex.sys [2008-10-21 104616]
R3 s0017unic;Sony Ericsson Device 0017 USB Ethernet Emulation SEMC0017 (WDM);c:\windows\system32\DRIVERS\s0017unic.sys [2008-10-21 109736]
R3 s3017bus;Sony Ericsson Device 3017 driver (WDM);c:\windows\system32\DRIVERS\s3017bus.sys [2007-12-10 83880]
R3 Sony Ericsson PCCompanion;Sony Ericsson PCCompanion;c:\program files\Sony Ericsson\Sony Ericsson PC Companion\PCCService.exe [2011-04-20 152064]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-09-29 691696]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2010-02-17 12872]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2010-05-10 67656]
S2 acedrv11;acedrv11;c:\windows\system32\drivers\acedrv11.sys [2008-07-30 277736]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2010-05-27 176128]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2012-03-07 57688]
S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe [2012-02-29 2348352]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2012-02-29 382272]
S2 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [2011-04-22 92592]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32v.sys [2012-01-17 148800]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2010-06-23 275048]
S3 seehcri;Sony Ericsson seehcri Device Driver;c:\windows\system32\DRIVERS\seehcri.sys [2008-01-09 27632]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*Deregistered* - Avgtdix
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12	REG_MULTI_SZ   	Pml Driver HPZ12 Net Driver HPZ12
HPService	REG_MULTI_SZ   	HPSLPSVC
hpdevmgmt	REG_MULTI_SZ   	hpqcxs08 hpqddsvc
.
Inhalt des "geplante Tasks" Ordners
.
2012-03-26 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-19 19:48]
.
2012-03-26 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-19 19:48]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://de.ask.com/?l=dis&o=15768
uInternet Settings,ProxyOverride = *.local
IE: Free YouTube Download - c:\users\Bonnstar007\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm
IE: Free YouTube to MP3 Converter - c:\users\Bonnstar007\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: {{7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - c:\program files\ICQ7.5\ICQ.exe
TCP: Interfaces\{67C9BC67-1B53-4ECE-ABA1-F0E40B7AB444}: NameServer = 192.168.0.1
FF - ProfilePath - c:\users\Bonnstar007\AppData\Roaming\Mozilla\Firefox\Profiles\shcwt2u4.default\
FF - prefs.js: browser.startup.homepage - www.google.de
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
MSConfigStartUp-Malwarebytes' Anti-Malware (reboot) - c:\program files\Malwarebytes' Anti-Malware\mbam.exe
MSConfigStartUp-MediaPortal - c:\program files\Team MediaPortal\MediaPortal\MediaPortal.exe
MSConfigStartUp-PixelPlanet PdfPrinter-Monitor - c:\program files\Common Files\PixelPlanet\PdfPrinter 6\PdfPrinterMonitor.exe
MSConfigStartUp-Sony Ericsson PC Suite - c:\program files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-3669939592-1003003168-3923964640-1000\Software\SecuROM\License information*]
"datasecu"=hex:99,a8,6d,ee,9d,1f,23,6e,4e,40,54,26,52,54,c3,0e,5f,87,34,c4,ed,
   c9,d6,af,78,3c,1b,5c,4d,ba,4c,cf,98,fa,18,47,74,4f,94,0a,2d,3c,5f,a2,97,14,\
"rkeysecu"=hex:d2,af,3b,a2,f6,4e,80,aa,95,8a,ba,6e,36,25,b6,55
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2012-03-26  18:44:30
ComboFix-quarantined-files.txt  2012-03-26 16:44
ComboFix2.txt  2011-03-10 20:37
ComboFix3.txt  2010-12-29 20:37
.
Vor Suchlauf: 22 Verzeichnis(se), 13.075.513.344 Bytes frei
Nach Suchlauf: 24 Verzeichnis(se), 12.768.833.536 Bytes frei
.
- - End Of File - - 5CCB8A8C07ABA60FB9A5C4CF65D9A511
         

--- --- ---

download tdss killer:
http://www.trojaner-board.de/82358-t...entfernen.html
Klicke auf Change parameters
• Setze die Haken bei Verify driver digital signatures und Detect TDLFS file system
• Klick auf OK und anschließend auf Start scan
- bei funden erst mal immer skip wählen, log posten

so hier das logfile...

ich möchte das log, keine bild datei.
das log sollte auf c: sein tdsskiller-version-datum.txt

Die Datei ist zu groß 282kb. Wie soll ich diese hochladen?

hier reinkopieren, oder mit winrar etc packen und dann hochladen

so jetzt ist die gepackt...