Hey,
Als ich meinen PC heute gestartet hab ging was komisches vor sich.. nach.. Irgendwelche Fehler, SMART_HDD-icon auf 'm Dekstop, etc..

Nach 'm googlen kam ich drauf, dass es das Problem schon häufiger gibt.. Smart_HDD..

Nur habe ich keinen Schwarzen Desktop, meine Icons auf dem Desktop sind noch da.. jedoch sind die angepinnten Programme an der Taskleiste weg und beim öffnen des Startmenüs fehlt "auf der rechten Seite" alles.. (Systemsteuerung, Computer, ...)..

Das erste was ich gemacht hab war erstmal die Prozesse gecheckt.. und sofort was entdeckt.. "oJhobtIaKYXpMoR.exe"
Erstmal den Prozess beendet und aus 'm Startmenü genommen (regedit).

Dann nach weiterem Lesen hier habe ich mir Malwarebytes Anti-Malware runtergeladen und nen Quick Scan durchlaufen lassen..

Meine Frage wäre, was ich jetzt noch machen muss um den endgültig loszuwerden..?


Hier der Quick scan Log:

 Malwarebytes Anti-Malware  (Test) 1.60.1.1000
www.malwarebytes.org

Datenbank Version: v2012.04.10.03

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 8.0.7601.17514
James :: JAMES-PC [Administrator]

Schutz: Aktiviert

10.04.2012 11:09:47
mbam-log-2012-04-10 (11-09-47).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 223547
Laufzeit: 14 Minute(n), 23 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 3
HKCU\SOFTWARE\BIFROST1.2 (Bifrose.Trace) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\Bifrost666 (Bifrose.Trace) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Bifrost666 (Bifrose.Trace) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 2
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced|Start_ShowMyComputer (PUM.Hijack.StartMenu) -> Bösartig: (0) Gut: (1) -> Erfolgreich ersetzt und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced|Start_ShowSearch (PUM.Hijack.StartMenu) -> Bösartig: (0) Gut: (1) -> Erfolgreich ersetzt und in Quarantäne gestellt.

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 6
C:\ProgramData\oJhobtIaKYXpMoR.exe (Backdoor.Agent.RCGen) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\t360OKgu2RKIgs.exe (Backdoor.Agent.RCGen) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\James\AppData\Local\Temp\cgs8h0.exe (Rootkit.0Access) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\James\AppData\Local\Temp\hj8ol0.exe (Backdoor.Agent.RCGen) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\James\AppData\Local\Temp\msimg32.dll (Rootkit.0Access) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\James\AppData\Roaming\addon.dat (Malware.Trace) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)
         

mfg



Edit:
Achja.. was ich noch hinzufügen wollte.. das mit dem Bifrost is kein Trojaner von außerhalb.. sondern da hab ich mal selber damit rumgespielt und das läuft hier im Heimnetzwerk..

Hab noch nen OLT Scan durchgeführt.
Logfile:

OTL Logfile:

OTL logfile created on: 10.04.2012 12:22:03 - Run 1
OTL by OldTimer - Version 3.2.39.2     Folder = C:\Users\James\Desktop
64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
5,99 Gb Total Physical Memory | 3,08 Gb Available Physical Memory | 51,46% Memory free
11,98 Gb Paging File | 8,46 Gb Available in Paging File | 70,58% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 596,07 Gb Total Space | 67,70 Gb Free Space | 11,36% Space Free | Partition Type: NTFS
Drive D: | 931,51 Gb Total Space | 789,08 Gb Free Space | 84,71% Space Free | Partition Type: NTFS
Drive F: | 596,17 Gb Total Space | 0,19 Gb Free Space | 0,03% Space Free | Partition Type: NTFS
 
Computer Name: JAMES-PC | User Name: James | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\James\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Users\James\AppData\Local\Facebook\Messenger\2.0.4478.0\FacebookMessenger.exe (Facebook)
PRC - C:\Program Files (x86)\Opera 10.10 Beta\opera.exe (Opera Software)
PRC - C:\Users\James\AppData\LocalLow\Flagfox\IE\FlagfoxUpdater.exe ()
PRC - D:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - D:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
PRC - D:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Winamp\winamp.exe (Nullsoft, Inc.)
PRC - C:\Windows\SysWOW64\PnkBstrA.exe ()
PRC - C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe (MAGIX AG)
PRC - C:\Program Files (x86)\Common Files\G DATA\AVKProxy\AVKProxy.exe (G Data Software AG)
PRC - C:\Program Files (x86)\G DATA\InternetSecurity\AVKTray\AVKTray.exe (G Data Software AG)
PRC - C:\Program Files (x86)\Common Files\G DATA\GDScan\GDScan.exe (G Data Software AG)
PRC - C:\Program Files (x86)\G DATA\InternetSecurity\Firewall\GDFirewallTray.exe (G Data Software AG)
PRC - C:\Program Files (x86)\G DATA\InternetSecurity\AVK\AVKService.exe (G Data Software AG)
PRC - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
PRC - C:\Program Files (x86)\avmwlanstick\WlanNetService.exe (AVM Berlin)
PRC - C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe (Creative Technology Ltd)
PRC - C:\Program Files (x86)\Razer\Lycosa\razerhid.exe (Razer USA Ltd.)
PRC - C:\Program Files (x86)\NETGEAR\WNA1100\WifiSvc.exe ()
PRC - C:\Program Files (x86)\Razer\Lycosa\razertra.exe ()
PRC - C:\Program Files (x86)\Analog Devices\SoundMAX\SoundMAX.exe (Analog Devices, Inc.)
PRC - C:\Programme\Mouse\Amoumain.exe ()
PRC - C:\Program Files (x86)\RocketDock\RocketDock.exe ()
PRC - C:\Windows\vsnpstd3.exe ()
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Users\James\AppData\Local\Temp\WLZ2DD.tmp\winamp.lng ()
MOD - C:\Users\James\AppData\Local\Temp\WLZ2DD.tmp\vis_milk2.lng ()
MOD - C:\Users\James\AppData\Local\Temp\WLZ2DD.tmp\vis_avs.lng ()
MOD - C:\Users\James\AppData\Local\Temp\WLZ2DD.tmp\pmp_wifi.lng ()
MOD - C:\Users\James\AppData\Local\Temp\WLZ2DD.tmp\pmp_ipod.lng ()
MOD - C:\Users\James\AppData\Local\Temp\WLZ2DD.tmp\pmp_android.lng ()
MOD - C:\Users\James\AppData\Local\Temp\WLZ2DD.tmp\pmp_usb.lng ()
MOD - C:\Users\James\AppData\Local\Temp\WLZ2DD.tmp\vis_nsfs.lng ()
MOD - C:\Users\James\AppData\Local\Temp\WLZ2DD.tmp\out_wave.lng ()
MOD - C:\Users\James\AppData\Local\Temp\WLZ2DD.tmp\tagz.lng ()
MOD - C:\Users\James\AppData\Local\Temp\WLZ2DD.tmp\pmp_activesync.lng ()
MOD - C:\Users\James\AppData\Local\Temp\WLZ2DD.tmp\winampa.lng ()
MOD - C:\Users\James\AppData\Local\Temp\WLZ2DD.tmp\pmp_p4s.lng ()
MOD - C:\Users\James\AppData\Local\Temp\WLZ2DD.tmp\pmp_njb.lng ()
MOD - C:\Users\James\AppData\Local\Temp\WLZ2DD.tmp\playlist.lng ()
MOD - C:\Users\James\AppData\Local\Temp\WLZ2DD.tmp\ml_local.lng ()
MOD - C:\Users\James\AppData\Local\Temp\WLZ2DD.tmp\ml_disc.lng ()
MOD - C:\Users\James\AppData\Local\Temp\WLZ2DD.tmp\ml_pmp.lng ()
MOD - C:\Users\James\AppData\Local\Temp\WLZ2DD.tmp\ombrowser.lng ()
MOD - C:\Users\James\AppData\Local\Temp\WLZ2DD.tmp\ml_plg.lng ()
MOD - C:\Users\James\AppData\Local\Temp\WLZ2DD.tmp\in_mp3.lng ()
MOD - C:\Users\James\AppData\Local\Temp\WLZ2DD.tmp\in_mod.lng ()
MOD - C:\Users\James\AppData\Local\Temp\WLZ2DD.tmp\out_ds.lng ()
MOD - C:\Users\James\AppData\Local\Temp\WLZ2DD.tmp\in_wm.lng ()
MOD - C:\Users\James\AppData\Local\Temp\WLZ2DD.tmp\ml_wire.lng ()
MOD - C:\Users\James\AppData\Local\Temp\WLZ2DD.tmp\ml_online.lng ()
MOD - C:\Users\James\AppData\Local\Temp\WLZ2DD.tmp\ml_playlists.lng ()
MOD - C:\Users\James\AppData\Local\Temp\WLZ2DD.tmp\in_nsv.lng ()
MOD - C:\Users\James\AppData\Local\Temp\WLZ2DD.tmp\in_vorbis.lng ()
MOD - C:\Users\James\AppData\Local\Temp\WLZ2DD.tmp\ml_downloads.lng ()
MOD - C:\Users\James\AppData\Local\Temp\WLZ2DD.tmp\ml_history.lng ()
MOD - C:\Users\James\AppData\Local\Temp\WLZ2DD.tmp\ml_devices.lng ()
MOD - C:\Users\James\AppData\Local\Temp\WLZ2DD.tmp\ml_transcode.lng ()
MOD - C:\Users\James\AppData\Local\Temp\WLZ2DD.tmp\ml_autotag.lng ()
MOD - C:\Users\James\AppData\Local\Temp\WLZ2DD.tmp\in_wav.lng ()
MOD - C:\Users\James\AppData\Local\Temp\WLZ2DD.tmp\out_disk.lng ()
MOD - C:\Users\James\AppData\Local\Temp\WLZ2DD.tmp\in_wave.lng ()
MOD - C:\Users\James\AppData\Local\Temp\WLZ2DD.tmp\ml_rg.lng ()
MOD - C:\Users\James\AppData\Local\Temp\WLZ2DD.tmp\ml_impex.lng ()
MOD - C:\Users\James\AppData\Local\Temp\WLZ2DD.tmp\ml_bookmarks.lng ()
MOD - C:\Users\James\AppData\Local\Temp\WLZ2DD.tmp\in_mp4.lng ()
MOD - C:\Users\James\AppData\Local\Temp\WLZ2DD.tmp\ml_enqplay.lng ()
MOD - C:\Users\James\AppData\Local\Temp\WLZ2DD.tmp\in_wv.lng ()
MOD - C:\Users\James\AppData\Local\Temp\WLZ2DD.tmp\in_mkv.lng ()
MOD - C:\Users\James\AppData\Local\Temp\WLZ2DD.tmp\ml_orb.lng ()
MOD - C:\Users\James\AppData\Local\Temp\WLZ2DD.tmp\ml_nowplaying.lng ()
MOD - C:\Users\James\AppData\Local\Temp\WLZ2DD.tmp\ml_addons.lng ()
MOD - C:\Users\James\AppData\Local\Temp\WLZ2DD.tmp\in_swf.lng ()
MOD - C:\Users\James\AppData\Local\Temp\WLZ2DD.tmp\gen_jumpex.lng ()
MOD - C:\Users\James\AppData\Local\Temp\WLZ2DD.tmp\gen_classicart.lng ()
MOD - C:\Users\James\AppData\Local\Temp\WLZ2DD.tmp\gen_ff.lng ()
MOD - C:\Users\James\AppData\Local\Temp\WLZ2DD.tmp\gen_ml.lng ()
MOD - C:\Users\James\AppData\Local\Temp\WLZ2DD.tmp\in_midi.lng ()
MOD - C:\Users\James\AppData\Local\Temp\WLZ2DD.tmp\in_cdda.lng ()
MOD - C:\Users\James\AppData\Local\Temp\WLZ2DD.tmp\gen_skinmanager.lng ()
MOD - C:\Users\James\AppData\Local\Temp\WLZ2DD.tmp\gen_hotkeys.lng ()
MOD - C:\Users\James\AppData\Local\Temp\WLZ2DD.tmp\gen_undo.lng ()
MOD - C:\Users\James\AppData\Local\Temp\WLZ2DD.tmp\gen_timerestore.lng ()
MOD - C:\Users\James\AppData\Local\Temp\WLZ2DD.tmp\gen_nopro.lng ()
MOD - C:\Users\James\AppData\Local\Temp\WLZ2DD.tmp\gen_tray.lng ()
MOD - C:\Users\James\AppData\Local\Temp\WLZ2DD.tmp\gen_orgler.lng ()
MOD - C:\Users\James\AppData\Local\Temp\WLZ2DD.tmp\gen_crasher.lng ()
MOD - C:\Users\James\AppData\Local\Temp\WLZ2DD.tmp\in_dshow.lng ()
MOD - C:\Users\James\AppData\Local\Temp\WLZ2DD.tmp\in_flac.lng ()
MOD - C:\Users\James\AppData\Local\Temp\WLZ2DD.tmp\in_avi.lng ()
MOD - C:\Users\James\AppData\Local\Temp\WLZ2DD.tmp\gen_find_on_disk.lng ()
MOD - C:\Users\James\AppData\Local\Temp\WLZ2DD.tmp\in_linein.lng ()
MOD - C:\Users\James\AppData\Local\Temp\WLZ2DD.tmp\in_flv.lng ()
MOD - C:\Users\James\AppData\Local\Temp\WLZ2DD.tmp\burnlib.lng ()
MOD - C:\Users\James\AppData\Local\Temp\WLZ2DD.tmp\dsp_sps.lng ()
MOD - C:\Users\James\AppData\Local\Temp\WLZ2DD.tmp\auth.lng ()
MOD - C:\Users\James\AppData\Local\Temp\WLZ2DD.tmp\enc_fhgaac.lng ()
MOD - C:\Users\James\AppData\Local\Temp\WLZ2DD.tmp\enc_wma.lng ()
MOD - C:\Users\James\AppData\Local\Temp\WLZ2DD.tmp\enc_lame.lng ()
MOD - C:\Users\James\AppData\Local\Temp\WLZ2DD.tmp\enc_wav.lng ()
MOD - C:\Users\James\AppData\Local\Temp\WLZ2DD.tmp\enc_vorbis.lng ()
MOD - C:\Users\James\AppData\Local\Temp\WLZ2DD.tmp\enc_flac.lng ()
MOD - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_228.dll ()
MOD - C:\Program Files (x86)\Opera 10.10 Beta\gstreamer\plugins\gstwebmdec.dll ()
MOD - C:\Program Files (x86)\Opera 10.10 Beta\gstreamer\plugins\gstautodetect.dll ()
MOD - C:\Program Files (x86)\Opera 10.10 Beta\gstreamer\plugins\gstwaveform.dll ()
MOD - C:\Program Files (x86)\Opera 10.10 Beta\gstreamer\gstreamer.dll ()
MOD - C:\Program Files (x86)\Opera 10.10 Beta\gstreamer\plugins\gstoggdec.dll ()
MOD - C:\Program Files (x86)\Opera 10.10 Beta\gstreamer\plugins\gstffmpegcolorspace.dll ()
MOD - C:\Program Files (x86)\Opera 10.10 Beta\gstreamer\plugins\gstcoreplugins.dll ()
MOD - C:\Program Files (x86)\Opera 10.10 Beta\gstreamer\plugins\gstaudioresample.dll ()
MOD - C:\Program Files (x86)\Opera 10.10 Beta\gstreamer\plugins\gstaudioconvert.dll ()
MOD - C:\Program Files (x86)\Opera 10.10 Beta\gstreamer\plugins\gstwavparse.dll ()
MOD - C:\Program Files (x86)\Opera 10.10 Beta\gstreamer\plugins\gstdirectsound.dll ()
MOD - C:\Program Files (x86)\Opera 10.10 Beta\gstreamer\plugins\gstdecodebin2.dll ()
MOD - C:\Program Files (x86)\Opera 10.10 Beta\gstreamer\plugins\gsttypefindfunctions.dll ()
MOD - C:\Program Files (x86)\SplitMediaLabs\XSplit\avcodec-54.dll ()
MOD - C:\Program Files (x86)\SplitMediaLabs\XSplit\avformat-54.dll ()
MOD - C:\Program Files (x86)\SplitMediaLabs\XSplit\swscale-2.dll ()
MOD - C:\Program Files (x86)\SplitMediaLabs\XSplit\avutil-51.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\42ae8760f0a74ab774e82a64368aa1f6\System.Web.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\6c51e152e7404188914c9fa4d8503ff9\System.Windows.Forms.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\ab87129c2b603f218e4aa5300c9b1bdd\System.Drawing.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\9866d1f6178e1cde25642f1ac293ff8d\System.Xml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\e620323cacb5b6bfd93fd28d263440e4\System.Configuration.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\faf4e8730ecbd07570111bb7c3b20565\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\a1a82db68b3badc7c27ea1f6579d22c5\mscorlib.ni.dll ()
MOD - C:\Program Files (x86)\Winamp\System\jnetlib.w5s ()
MOD - C:\Program Files (x86)\Winamp\System\auth.w5s ()
MOD - C:\Program Files (x86)\Winamp\System\jpeg.w5s ()
MOD - C:\Program Files (x86)\Winamp\Plugins\pmp_wifi.dll ()
MOD - C:\Program Files (x86)\Winamp\System\png.w5s ()
MOD - C:\Program Files (x86)\Winamp\System\xml.w5s ()
MOD - C:\Program Files (x86)\Winamp\System\playlist.w5s ()
MOD - C:\Program Files (x86)\Winamp\tataki.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\pmp_usb.dll ()
MOD - C:\Program Files (x86)\Winamp\zlib.dll ()
MOD - C:\Program Files (x86)\Winamp\System\devices.w5s ()
MOD - C:\Program Files (x86)\Winamp\System\timer.w5s ()
MOD - C:\Program Files (x86)\Winamp\System\albumart.w5s ()
MOD - C:\Program Files (x86)\Winamp\System\tagz.w5s ()
MOD - C:\Program Files (x86)\Winamp\System\gif.w5s ()
MOD - C:\Program Files (x86)\Winamp\System\bmp.w5s ()
MOD - C:\Program Files (x86)\Winamp\System\dlmgr.w5s ()
MOD - C:\Program Files (x86)\Winamp\System\gracenote.w5s ()
MOD - C:\Program Files (x86)\Winamp\System\filereader.w5s ()
MOD - C:\Program Files (x86)\Winamp\System\primo.w5s ()
MOD - C:\Program Files (x86)\Winamp\Plugins\pmp_ipod.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\pmp_p4s.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\pmp_android.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\pmp_njb.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\out_ds.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\out_disk.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\out_wave.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\ml_pmp.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\ml_rg.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\ml_transcode.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_wm.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\ml_local.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_mp3.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_vorbis.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\ml_devices.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\ml_disc.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_mod.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\ml_online.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_midi.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\ml_plg.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\ml_playlists.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_nsv.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_flac.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\ml_impex.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_mp4.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\ml_history.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_mkv.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_flv.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\ml_autotag.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\ml_bookmarks.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_swf.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_wave.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_linein.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\gen_ff.dll ()
MOD - C:\Program Files (x86)\Winamp\nsutil.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\freeform\wacs\freetype\freetype.wac ()
MOD - C:\Program Files (x86)\Winamp\Plugins\gen_ml.dll ()
MOD - C:\Program Files (x86)\Winamp\libsndfile.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\gen_jumpex.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_cdda.dll ()
MOD - C:\Program Files (x86)\Winamp\nde.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_dshow.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_avi.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\gen_orgler.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\gen_hotkeys.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\gen_tray.dll ()
MOD - C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.mshtml.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\System.resources\2.0.0.0_de_b77a5c561934e089\System.resources.dll ()
MOD - C:\Program Files (x86)\Razer\Lycosa\razertra.exe ()
MOD - C:\Programme\Mouse\Amoumain.exe ()
MOD - C:\Program Files (x86)\RocketDock\RocketDock.exe ()
MOD - C:\Program Files (x86)\RocketDock\RocketDock.dll ()
MOD - C:\Windows\vsnpstd3.exe ()
MOD - C:\Programme\Mouse\Amoures.dll ()
MOD - C:\Windows\SysWOW64\Amhooker.dll ()
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - (AppMgmt) -- C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SRV:64bit: - (AEADIFilters) -- C:\Windows\SysNative\AEADISRV.EXE (Andrea Electronics Corporation)
SRV:64bit: - (msvsmon90) -- C:\Program Files\Microsoft Visual Studio 9.0\Common7\IDE\Remote Debugger\x64\msvsmon.exe (Microsoft Corporation)
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (Steam Client Service) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (FlagfoxUpdater) -- C:\Users\James\AppData\LocalLow\Flagfox\IE\FlagfoxUpdater.exe ()
SRV - (Creative Audio Engine Licensing Service) -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe (Creative Labs)
SRV - (Creative ALchemy AL6 Licensing Service) -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe (Creative Labs)
SRV - (MBAMService) -- D:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (Radio.fx) -- C:\Program Files (x86)\Tobit Radio.fx\Server\rfx-server.exe ()
SRV - (NAUpdate) @C:\Program Files (x86) -- C:\Program Files (x86)\Nero\Update\NASvc.exe (Nero AG)
SRV - (FLEXnet Licensing Service 64) -- C:\Programme\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe (Acresso Software Inc.)
SRV - (FLEXnet Licensing Service) -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.)
SRV - (PnkBstrA) -- C:\Windows\SysWOW64\PnkBstrA.exe ()
SRV - (TeamViewer6) -- C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe (TeamViewer GmbH)
SRV - (Fabs) -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe (MAGIX AG)
SRV - (FirebirdServerMAGIXInstance) -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe (MAGIX®)
SRV - (AVKProxy) -- C:\Program Files (x86)\Common Files\G DATA\AVKProxy\AVKProxy.exe (G Data Software AG)
SRV - (GDScan) -- C:\Program Files (x86)\Common Files\G DATA\GDScan\GDScan.exe (G Data Software AG)
SRV - (AVKService) -- C:\Program Files (x86)\G DATA\InternetSecurity\AVK\AVKService.exe (G Data Software AG)
SRV - (GDFwSvc) -- C:\Program Files (x86)\G DATA\InternetSecurity\Firewall\GDFwSvcx64.exe (G Data Software AG)
SRV - (AVKWCtl) -- C:\Program Files (x86)\G DATA\InternetSecurity\AVK\AVKWCtlX64.exe (G Data Software AG)
SRV - (Stereo Service) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
SRV - (BITCOMET_HELPER_SERVICE) -- C:\Program Files (x86)\BitComet\tools\BitCometService.exe (www.BitComet.com)
SRV - (AVM WLAN Connection Service) -- C:\Program Files (x86)\avmwlanstick\WlanNetService.exe (AVM Berlin)
SRV - (CTAudSvcService) -- C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe (Creative Technology Ltd)
SRV - (WSWNA1100) -- C:\Program Files (x86)\NETGEAR\WNA1100\WifiSvc.exe ()
SRV - (jswpsapi) -- C:\Program Files (x86)\NETGEAR\WNA1100\jswpsapi.exe (Atheros Communications, Inc.)
SRV - (Netzmanager Service) -- C:\Programme\Netzmanager\NMInfraIS2\Netzmanager_Service.exe (Deutsche Telekom AG)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (TeamViewer5) -- C:\Program Files (x86)\TeamViewer\Version5\TeamViewer_Service.exe (TeamViewer GmbH)
SRV - (nHancer) -- C:\Programme\nHancer\nHancerService.exe (KSE - Korndörfer Software Engineering)
SRV - (wlidsvc) -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corporation)
SRV - (DAUpdaterSvc) -- C:\Program Files (x86)\Dragon Age\bin_ship\DAUpdaterSvc.Service.exe (BioWare)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (ICQ Service) -- C:\Program Files (x86)\ICQ6Toolbar\ICQ Service.exe ()
SRV - (SQLWriter) -- C:\Programme\Microsoft SQL Server\90\Shared\sqlwriter.exe (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - (MBAMProtector) -- C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation)
DRV:64bit: - (ssudserd) SAMSUNG Mobile USB Diagnostic Serial Port(DEVGURU Ver.) -- C:\Windows\SysNative\drivers\ssudserd.sys (DEVGURU Co., LTD.(www.devguru.co.kr))
DRV:64bit: - (ssudmdm) SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.) -- C:\Windows\SysNative\drivers\ssudmdm.sys (DEVGURU Co., LTD.(www.devguru.co.kr))
DRV:64bit: - (dg_ssudbus) SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.) -- C:\Windows\SysNative\drivers\ssudbus.sys (DEVGURU Co., LTD.(www.devguru.co.kr))
DRV:64bit: - (GRD) -- C:\Windows\SysNative\drivers\GRD.sys (G Data Software)
DRV:64bit: - (GDPkIcpt) -- C:\Windows\SysNative\drivers\PktIcpt.sys (G Data Software AG)
DRV:64bit: - (HookCentre) -- C:\Windows\SysNative\drivers\HookCentre.sys (G Data Software AG)
DRV:64bit: - (GDMnIcpt) -- C:\Windows\SysNative\drivers\MiniIcpt.sys (G Data Software AG)
DRV:64bit: - (GDBehave) -- C:\Windows\SysNative\drivers\GDBehave.sys (G Data Software AG)
DRV:64bit: - (gdwfpcd) -- C:\Windows\SysNative\drivers\gdwfpcd64.sys (G Data Software AG)
DRV:64bit: - (GdNetMon) -- C:\Windows\SysNative\drivers\GdNetMon64.sys (G Data Software AG)
DRV:64bit: - (atksgt) -- C:\Windows\SysNative\drivers\atksgt.sys ()
DRV:64bit: - (lirsgt) -- C:\Windows\SysNative\drivers\lirsgt.sys ()
DRV:64bit: - (EuMusDesignVirtualAudioCableWdm) Virtual Audio Cable (WDM) -- C:\Windows\SysNative\drivers\vrtaucbl.sys (Eugene V. Muzychenko)
DRV:64bit: - (tap0901) -- C:\Windows\SysNative\drivers\tap0901.sys (The OpenVPN Project)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (USBAAPL64) -- C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (RdpVideoMiniport) -- C:\Windows\SysNative\drivers\rdpvideominiport.sys (Microsoft Corporation)
DRV:64bit: - (NVHDA) -- C:\Windows\SysNative\drivers\nvhda64v.sys (NVIDIA Corporation)
DRV:64bit: - (fwlanusb4) -- C:\Windows\SysNative\drivers\fwlanusb4.sys (AVM GmbH)
DRV:64bit: - (avmeject) -- C:\Windows\SysNative\drivers\avmeject.sys (AVM Berlin)
DRV:64bit: - (NPF) -- C:\Windows\SysNative\drivers\npf.sys (CACE Technologies, Inc.)
DRV:64bit: - (TFsExDisk) -- C:\Windows\SysNative\drivers\TFsExDisk.sys (Teruten Inc)
DRV:64bit: - (dgderdrv) -- C:\Windows\SysNative\drivers\dgderdrv.sys (Devguru Co., Ltd)
DRV:64bit: - (sscemdm) -- C:\Windows\SysNative\drivers\sscemdm.sys (MCCI Corporation)
DRV:64bit: - (ssceserd) SAMSUNG Mobile Modem Diagnostic Serial Port V2 (WDM) -- C:\Windows\SysNative\drivers\ssceserd.sys (MCCI Corporation)
DRV:64bit: - (sscebus) SAMSUNG USB Composite Device V2 driver (WDM) -- C:\Windows\SysNative\drivers\sscebus.sys (MCCI Corporation)
DRV:64bit: - (sscemdfl) -- C:\Windows\SysNative\drivers\sscemdfl.sys (MCCI Corporation)
DRV:64bit: - (athur) -- C:\Windows\SysNative\drivers\athurx.sys (Atheros Communications, Inc.)
DRV:64bit: - (vhidmini) -- C:\Windows\SysNative\drivers\vHidDev.sys (Windows (R) Win 7 DDK provider)
DRV:64bit: - (sptd) -- C:\Windows\SysNative\drivers\sptd.sys ()
DRV:64bit: - (Lycosa) -- C:\Windows\SysNative\drivers\Lycosa.sys (Razer USA Ltd.)
DRV:64bit: - (hamachi) -- C:\Windows\SysNative\drivers\hamachi.sys (LogMeIn, Inc.)
DRV:64bit: - (XENfiltv) -- C:\Windows\SysNative\drivers\XENfiltv.sys (Creative Technology Ltd.)
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (SNPSTD3) USB PC Camera (SNPSTD3) -- C:\Windows\SysNative\drivers\snpstd3.sys (Sonix Co. Ltd.)
DRV:64bit: - (yukonw7) -- C:\Windows\SysNative\drivers\yk62x64.sys (Marvell)
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (ADIHdAudAddService) -- C:\Windows\SysNative\drivers\ADIHdAud.sys (Analog Devices, Inc.)
DRV:64bit: - (GearAspiWDM) -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (cpuz132) -- C:\Windows\SysNative\drivers\cpuz132_x64.sys (Windows (R) Codename Longhorn DDK provider)
DRV:64bit: - (ENTECH64) -- C:\Windows\SysNative\drivers\Entech64.sys (EnTech Taiwan)
DRV:64bit: - (adfs) -- C:\Windows\SysNative\drivers\adfs.sys (Adobe Systems, Inc.)
DRV:64bit: - (JSWPSLWF) -- C:\Windows\SysNative\drivers\jswpslwfx.sys (Atheros Communications, Inc.)
DRV:64bit: - (Amusbprt) -- C:\Windows\SysNative\drivers\Amusbx64.sys (A4Tech Co.,Ltd.)
DRV:64bit: - (Amfilter) -- C:\Windows\SysNative\drivers\Amfltx64.sys ((Standard mouse types))
DRV:64bit: - (SCMNdisP) -- C:\Windows\SysNative\drivers\SCMNdisP.sys (Windows (R) Codename Longhorn DDK provider)
DRV:64bit: - (MTsensor) -- C:\Windows\SysNative\drivers\ASACPI.sys ()
DRV - (RivaTuner64) -- C:\Program Files (x86)\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition\RivaTuner64.sys ()
DRV - (GRD) -- C:\Windows\SysWOW64\drivers\GRD.sys (G Data Software)
DRV - (TFsExDisk) -- C:\Windows\SysWOW64\drivers\TFsExDisk.Sys (Teruten Inc)
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
DRV - (SNPSTD3) USB PC Camera (SNPSTD3) -- C:\Windows\SysWOW64\drivers\snpstd3.sys (Sonix Co. Ltd.)
DRV - (UltraMonUtility) -- C:\Program Files (x86)\Common Files\Realtime Soft\UltraMonMirrorDrv\x64\UltraMonUtility.sys (Realtime Soft Ltd)
DRV - (adfs) -- C:\Windows\SysWow64\drivers\adfs.sys (Adobe Systems, Inc.)
DRV - (NPF) -- C:\Windows\SysWOW64\drivers\npf.sys (CACE Technologies)
DRV - (Winsock) -- C:\Windows\SysWow64\WINSOCK.SRG ()
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://qip.ru
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://search.qip.ru
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://search.qip.ru/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://search.qip.ru
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://qip.ru
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 09 1F 15 BE FD 57 CA 01  [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://search.qip.ru/ie
IE - HKCU\..\URLSearchHook:  - No CLSID value found
IE - HKCU\..\URLSearchHook: {38542454-dfb6-44f5-b052-d4e071a3d073} - No CLSID value found
IE - HKCU\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKCU\..\SearchScopes,DefaultScope = {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = hxxp://www.icq.com/search/results.php?q={searchTerms}&ch_id=osd
IE - HKCU\..\SearchScopes\{A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE}: "URL" = hxxp://search.qip.ru/search?query={searchTerms}&from=IE
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "QIP Search"
FF - prefs.js..browser.search.selectedEngine: "QIP Search"
FF - prefs.js..browser.startup.homepage: "hxxp://de.start3.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:de:official"
FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.8.1
FF - prefs.js..extensions.enabledItems: {9AA46F4F-4DC7-4c06-97AF-5035170633FE}:21.1.10084.997
FF - prefs.js..extensions.enabledItems: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.8.20100408.6
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1
FF - prefs.js..extensions.enabledItems: firebug@software.joehewitt.com:1.5.4
FF - prefs.js..extensions.enabledItems: {32a1fd71-835e-4b11-8e54-886fda0b4c89}:1.1
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.3
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..extensions.enabledItems: {e0204bd5-9d31-402b-a99d-a6aa8ffebdca}:1.2.5
FF - prefs.js..keyword.URL: "hxxp://search.qip.ru/search?from=FF&query="
FF - prefs.js..network.proxy.autoconfig_url: "file:///c:/tor.pac"
FF - prefs.js..network.proxy.http: "127.0.0.1"
FF - prefs.js..network.proxy.http_port: 8118
FF - prefs.js..network.proxy.no_proxies_on: "127.0.0.1"
FF - prefs.js..network.proxy.socks: "127.0.0.1"
FF - prefs.js..network.proxy.socks_port: 9050
FF - prefs.js..network.proxy.socks_remote_dns: true
FF - prefs.js..network.proxy.ssl: "127.0.0.1"
FF - prefs.js..network.proxy.ssl_port: 8118
FF - user.js - File not found
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_2_202_228.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_228.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0:  File not found
FF - HKLM\Software\MozillaPlugins\@idsoftware.com/QuakeLive: C:\ProgramData\id Software\QuakeLive\npquakezero.dll (id Software Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@ngm.nexoneu.com/NxGame: C:\ProgramData\NexonEU\NGM\npNxGameeu.dll (Nexon)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\@parallelgraphics.com/Cortona: C:\Program Files (x86)\Common Files\ParallelGraphics\Cortona\npCortona.dll (ParallelGraphics)
FF - HKCU\Software\MozillaPlugins\@bitmanagement.com/BS Contact: C:\Users\James\AppData\Local\Bitmanagement Software\BS Contact\x64\npBSContact.dll (Bitmanagement Software GmbH)
FF - HKCU\Software\MozillaPlugins\@bitmanagement.com/BSVersion,version=1.006: C:\Users\James\AppData\Local\Bitmanagement Software\BS Contact\x64\npBSVersion_6.dll (Bitmanagement Software GmbH)
FF - HKCU\Software\MozillaPlugins\@octoshape.com/Octoshape Streaming Services,version=1.0: C:\Users\James\AppData\Roaming\Octoshape\Octoshape Streaming Services\sua-1010120-0-npoctoshape.dll (Octoshape ApS)
FF - HKCU\Software\MozillaPlugins\facebook.com/fbDesktopPlugin: C:\Users\James\AppData\Local\Facebook\Messenger\2.0.4478.0\npFbDesktopPlugin.dll (Facebook, Inc.)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{00F0643E-B367-4779-B45D-7046EBA37A88}: D:\Program Files (x86)\Steganos Password Manager 12\spmplugin3 [2011.12.28 16:08:11 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.04.09 01:14:47 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011.12.21 18:48:34 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 3.1.17\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2012.04.05 14:48:36 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 3.1.17\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins [2011.12.21 18:48:34 | 000,000,000 | ---D | M]
 
[2010.01.03 18:18:32 | 000,000,000 | ---D | M] (No name found) -- C:\Users\James\AppData\Roaming\mozilla\Extensions
[2010.01.03 18:18:32 | 000,000,000 | ---D | M] (No name found) -- C:\Users\James\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2012.03.30 16:17:31 | 000,000,000 | ---D | M] (No name found) -- C:\Users\James\AppData\Roaming\mozilla\Firefox\Profiles\l46hz2gy.default\extensions
[2010.10.29 20:09:19 | 000,000,000 | ---D | M] (QipAuthorizer) -- C:\Users\James\AppData\Roaming\mozilla\Firefox\Profiles\l46hz2gy.default\extensions\{32a1fd71-835e-4b11-8e54-886fda0b4c89}
[2010.09.13 14:20:22 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\James\AppData\Roaming\mozilla\Firefox\Profiles\l46hz2gy.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2012.03.30 16:17:31 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\James\AppData\Roaming\mozilla\Firefox\Profiles\l46hz2gy.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2011.06.02 14:09:26 | 000,000,000 | ---D | M] (Torbutton) -- C:\Users\James\AppData\Roaming\mozilla\Firefox\Profiles\l46hz2gy.default\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}
[2012.03.06 15:28:35 | 000,000,000 | ---D | M] (Flagfox) -- C:\Users\James\AppData\Roaming\mozilla\Firefox\Profiles\l46hz2gy.default\extensions\info@flagfox.net
[2012.03.30 16:17:31 | 000,000,000 | ---D | M] (No name found) -- C:\Users\James\AppData\Roaming\mozilla\Firefox\Profiles\l46hz2gy.default\extensions\staged
[2010.10.29 20:09:36 | 000,002,062 | ---- | M] () -- C:\Users\James\AppData\Roaming\Mozilla\Firefox\Profiles\l46hz2gy.default\searchplugins\qip-search.xml
[2011.11.27 13:25:53 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2011.09.24 17:01:47 | 000,000,000 | ---D | M] (G Data WebFilter) -- C:\Program Files (x86)\mozilla firefox\extensions\{9AA46F4F-4DC7-4c06-97AF-5035170633FE}
() (No name found) -- C:\USERS\JAMES\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\L46HZ2GY.DEFAULT\EXTENSIONS\{46551EC9-40F0-4E47-8E18-8E5CF550CFB8}.XPI
() (No name found) -- C:\USERS\JAMES\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\L46HZ2GY.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
() (No name found) -- C:\USERS\JAMES\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\L46HZ2GY.DEFAULT\EXTENSIONS\FIREBUG@SOFTWARE.JOEHEWITT.COM.XPI
[2012.04.09 01:14:47 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2009.06.01 13:22:18 | 000,874,008 | ---- | M] (ParallelGraphics) -- C:\Program Files (x86)\mozilla firefox\plugins\npCortona.dll
[2011.03.07 16:08:51 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2011.10.26 20:49:56 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npwachk.dll
[2009.09.03 19:37:30 | 010,437,264 | ---- | M] (PDFTron Systems Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\PDFNetC.dll
[2009.09.03 19:58:36 | 000,107,760 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\plugins\ScorchPDFWrapper.dll
[2012.03.04 13:10:07 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.03.04 13:10:07 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012.03.04 13:10:07 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2012.03.04 13:10:07 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.03.04 13:10:07 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.03.04 13:10:07 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?client=chrome&hl={language}&q={searchTerms}
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\James\AppData\Local\Google\Chrome\Application\13.0.782.112\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: Java Deployment Toolkit 6.0.240.7 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java(TM) Platform SE 6 U24 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files (x86)\Microsoft Silverlight\4.0.60531.0\npctrl.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\system32\Adobe\Director\np32dsw.dll
CHR - plugin: DivX Web Player (Enabled) = C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll
CHR - plugin: 2007 Microsoft Office system (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\NPOFF12.DLL
CHR - plugin: Chrome NaCl (Disabled) = C:\Users\James\AppData\Local\Google\Chrome\Application\13.0.782.112\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\James\AppData\Local\Google\Chrome\Application\13.0.782.112\pdf.dll
CHR - plugin: Cortona3D Viewer (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npCortona.dll
CHR - plugin: ScorchPlugin (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\NPSibelius.dll
CHR - plugin: Winamp Application Detector (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npwachk.dll
CHR - plugin: Octoshape Streaming Services (Enabled) = C:\Users\James\AppData\Roaming\Mozilla\plugins\npoctoshape.dll
CHR - plugin: Octoshape Streaming Services (Enabled) = C:\Users\James\AppData\Roaming\Octoshape\Octoshape Streaming Services\sua-1010120-0-npoctoshape.dll
CHR - plugin: NVIDIA 3D Vision (Enabled) = C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll
CHR - plugin: NVIDIA 3D VISION (Enabled) = C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll
CHR - plugin: Pando Web Plugin (Enabled) = C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Nexon Game Controller (Enabled) = C:\ProgramData\NexonEU\NGM\npNxGameeu.dll
CHR - plugin: QUAKE LIVE (Enabled) = C:\ProgramData\id Software\QuakeLive\npquakezero.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
CHR - Extension: Stylish = C:\Users\James\AppData\Local\Google\Chrome\User Data\Default\Extensions\fjnbnpbmkenffdnngjfgmeleoegfcffe\0.9_0\
CHR - Extension: Flagfox = C:\Users\James\AppData\Local\Google\Chrome\User Data\Default\Extensions\ildldcbkkbkhnjghnbidklpepakbepnd\4.1.129_0\
CHR - Extension: SciLor's Grooveshark(tm) Unlocker for Germany = C:\Users\James\AppData\Local\Google\Chrome\User Data\Default\Extensions\jbfloaameefimoafaijjlknlgongaoij\0.2_0\
 
O1 HOSTS File: ([2011.09.18 16:19:16 | 000,000,886 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 activation.guitar-pro.com
O1 - Hosts: 127.0.0.1 adobeereg.com
O2:64bit: - BHO: (G Data WebFilter) - {0124123D-61B4-456f-AF86-78C53A0790C5} - C:\Program Files (x86)\G Data\InternetSecurity\WebFilter\AVKWebIEx64.dll (G Data Software AG)
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (G Data WebFilter) - {0124123D-61B4-456f-AF86-78C53A0790C5} - C:\Program Files (x86)\G Data\InternetSecurity\WebFilter\AVKWebIE.dll (G Data Software AG)
O2 - BHO: (CGMFragment Class) - {0695F52A-89A2-4246-81B5-AFAD2D3B865F} - C:\PROGRA~2\Ematek\MetaWeb\MetaBHO.dll ()
O2 - BHO: (Flagfox) - {A02B5E09-122E-4A2D-B996-D997485B8C9E} - C:\Users\James\AppData\LocalLow\Flagfox\IE\Flagfox.dll (Dave G)
O2 - BHO: (QIPBHO Class) - {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - C:\Users\James\AppData\Roaming\Microsoft\Internet Explorer\qipsearchbar.dll (qip.ru)
O2 - BHO: (BHO) - {BA3295CF-17ED-4F49-9E95-D999A0ADBFDC} - C:\Program Files (x86)\Common Files\G DATA\AVKProxy\BanksafeBHO.dll (G Data Software AG)
O3:64bit: - HKLM\..\Toolbar: (G Data WebFilter) - {0124123D-61B4-456f-AF86-78C53A0790C5} - C:\Program Files (x86)\G Data\InternetSecurity\WebFilter\AVKWebIEx64.dll (G Data Software AG)
O3 - HKLM\..\Toolbar: (G Data WebFilter) - {0124123D-61B4-456f-AF86-78C53A0790C5} - C:\Program Files (x86)\G Data\InternetSecurity\WebFilter\AVKWebIE.dll (G Data Software AG)
O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll (ICQ)
O3 - HKLM\..\Toolbar: (Steganos Password Manager Toolbar) - {9C65D12D-CF9D-454D-8049-61965D8C6FFF} - D:\Program Files (x86)\Steganos Password Manager 12\SPMIEToolbar.dll (Steganos GmbH)
O4:64bit: - HKLM..\Run: [snpstd3] C:\Windows\vsnpstd3.exe ()
O4:64bit: - HKLM..\Run: [SoundMAX] C:\Program Files (x86)\Analog Devices\SoundMAX\soundmax.exe (Analog Devices, Inc.)
O4:64bit: - HKLM..\Run: [WheelMouse] C:\Programme\Mouse\Amoumain.exe ()
O4 - HKLM..\Run: [G Data AntiVirus Tray Application] C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe (G Data Software AG)
O4 - HKLM..\Run: [GDFirewallTray] C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe (G Data Software AG)
O4 - HKLM..\Run: [jswtrayutil] "C:\Program Files (x86)\NETGEAR\WNA1100\jswtrayutil.exe" File not found
O4 - HKLM..\Run: [Lycosa] C:\Program Files (x86)\Razer\Lycosa\razerhid.exe (Razer USA Ltd.)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] D:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKCU..\Run: [RocketDock] C:\Program Files (x86)\RocketDock\RocketDock.exe ()
O4 - Startup: C:\Users\James\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Facebook Messenger.lnk = C:\Users\James\AppData\Local\Facebook\Messenger\2.0.4478.0\FacebookMessenger.exe (Facebook)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutorun = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1
O8:64bit: - Extra context menu item: Free YouTube Download - C:\Users\James\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()
O8:64bit: - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\James\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MIF5BA~1\Office12\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Free YouTube Download - C:\Users\James\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\James\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MIF5BA~1\Office12\EXCEL.EXE/3000 File not found
O9 - Extra Button: Steganos Password Manager - {024538B9-3F39-49FF-9503-975F743210FA} - D:\Program Files (x86)\Steganos Password Manager 12\SPMIEToolbar.dll (Steganos GmbH)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MIF5BA~1\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MIF5BA~1\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MIF5BA~1\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files (x86)\ICQ6.5\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files (x86)\ICQ6.5\ICQ.exe (ICQ, LLC.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000006 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {E705A591-DA3C-4228-B0D5-A356DBA42FBF} hxxp://ccfiles.creative.com/Web/softwareupdate/su2/ocx/20015/CTSUEng.cab (Creative Software AutoUpdate 2)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B57C0BB1-9209-4D25-9E37-8003CC0126D4}: DhcpNameServer = 192.168.2.1
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{0c359d34-cb83-11de-9ae8-00248c77810c}\Shell - "" = AutoRun
O33 - MountPoints2\{0c359d34-cb83-11de-9ae8-00248c77810c}\Shell\AutoRun\command - "" = G:\setup.exe
O33 - MountPoints2\{6c1d6f79-d2a3-11de-a12a-00248c77810c}\Shell - "" = AutoRun
O33 - MountPoints2\{6c1d6f79-d2a3-11de-a12a-00248c77810c}\Shell\AutoRun\command - "" = H:\autoplay.exe
O33 - MountPoints2\{b1b0e85b-3221-11e1-afe2-0024211eaa99}\Shell - "" = AutoRun
O33 - MountPoints2\{b1b0e85b-3221-11e1-afe2-0024211eaa99}\Shell\AutoRun\command - "" = I:\pushinst.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.04.10 12:20:31 | 000,593,920 | ---- | C] (OldTimer Tools) -- C:\Users\James\Desktop\OTL.exe
[2012.04.10 10:47:54 | 000,000,000 | ---D | C] -- C:\Users\James\AppData\Roaming\Malwarebytes
[2012.04.10 10:47:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.04.10 10:47:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.04.10 10:47:41 | 000,023,152 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012.04.10 10:46:11 | 009,502,424 | ---- | C] (Malwarebytes Corporation                                    ) -- C:\Users\James\Desktop\mbam-setup-1.60.1.1000.exe
[2012.04.10 09:08:36 | 000,000,000 | ---D | C] -- C:\Users\James\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SMART HDD
[2012.04.10 09:03:20 | 000,418,464 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe
[2012.04.09 19:58:18 | 000,000,000 | ---D | C] -- C:\Users\James\AppData\Local\SplitMediaLabs
[2012.04.09 19:57:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XSplit
[2012.04.06 11:35:24 | 000,000,000 | ---D | C] -- C:\Users\James\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Facebook
[2012.04.04 22:17:09 | 000,000,000 | ---D | C] -- C:\Users\James\Desktop\Dust in the Wind Lyrics_data
[2012.04.04 12:37:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Gameforge
[2012.04.04 12:37:08 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Gameforge
[2012.03.29 15:36:07 | 000,000,000 | ---D | C] -- C:\Users\James\Documents\Wondershare PDF Password Remover
[2012.03.29 15:34:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wondershare
[2012.03.29 15:32:17 | 000,000,000 | ---D | C] -- C:\Users\James\Documents\Calibre Bibliothek
[2012.03.29 15:32:15 | 000,000,000 | ---D | C] -- C:\Users\James\AppData\Roaming\calibre
[2012.03.29 15:31:20 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Calibre2
[2012.03.29 15:31:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\calibre - E-book Management
[2012.03.29 15:15:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Python 2.6
[2012.03.18 11:40:13 | 000,000,000 | ---D | C] -- C:\Users\James\Desktop\tables_xp_free_fast
[2012.03.15 14:42:55 | 005,559,152 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntoskrnl.exe
[2012.03.15 14:42:55 | 003,968,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntkrnlpa.exe
[2012.03.15 14:42:54 | 003,913,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntoskrnl.exe
[2012.03.14 16:23:55 | 001,544,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\DWrite.dll
[2012.03.14 16:23:14 | 001,112,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdpcorets.dll
[2012.03.14 16:23:14 | 001,031,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdpcore.dll
[2012.03.14 16:23:14 | 000,826,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\rdpcore.dll
[2012.03.14 16:23:11 | 000,149,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdpcorekmts.dll
[2012.03.14 16:23:11 | 000,077,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdpwsx.dll
[2012.03.14 16:23:11 | 000,009,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdrmemptylst.exe
[3 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.04.10 12:20:32 | 000,593,920 | ---- | M] (OldTimer Tools) -- C:\Users\James\Desktop\OTL.exe
[2012.04.10 12:11:12 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.04.10 11:49:18 | 000,014,016 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.04.10 11:49:18 | 000,014,016 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.04.10 11:43:24 | 000,065,536 | ---- | M] () -- C:\Windows\SysNative\Ikeext.etl
[2012.04.10 11:42:48 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.04.10 11:40:53 | 529,883,135 | -HS- | M] () -- C:\hiberfil.sys
[2012.04.10 11:34:04 | 000,000,928 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-3267721374-1947955625-3066604951-1001UA.job
[2012.04.10 11:06:59 | 000,000,820 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.04.10 11:05:15 | 003,753,276 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.04.10 11:05:15 | 000,804,942 | ---- | M] () -- C:\Windows\SysNative\perfh00C.dat
[2012.04.10 11:05:15 | 000,783,888 | ---- | M] () -- C:\Windows\SysNative\perfh019.dat
[2012.04.10 11:05:15 | 000,766,982 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.04.10 11:05:15 | 000,721,604 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.04.10 11:05:15 | 000,176,118 | ---- | M] () -- C:\Windows\SysNative\perfc019.dat
[2012.04.10 11:05:15 | 000,175,066 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.04.10 11:05:15 | 000,174,662 | ---- | M] () -- C:\Windows\SysNative\perfc00C.dat
[2012.04.10 11:05:15 | 000,147,428 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.04.10 10:46:27 | 009,502,424 | ---- | M] (Malwarebytes Corporation                                    ) -- C:\Users\James\Desktop\mbam-setup-1.60.1.1000.exe
[2012.04.10 09:08:44 | 000,000,160 | ---- | M] () -- C:\ProgramData\-t360OKgu2RKIgsr
[2012.04.10 09:08:44 | 000,000,000 | ---- | M] () -- C:\ProgramData\-t360OKgu2RKIgs
[2012.04.10 09:08:36 | 000,000,653 | ---- | M] () -- C:\Users\James\Desktop\SMART_HDD.lnk
[2012.04.10 09:08:33 | 000,000,256 | ---- | M] () -- C:\ProgramData\t360OKgu2RKIgs
[2012.04.10 09:03:20 | 000,418,464 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe
[2012.04.10 09:03:20 | 000,070,304 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2012.04.09 17:34:02 | 000,000,906 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-3267721374-1947955625-3066604951-1001Core.job
[2012.04.08 12:28:03 | 000,019,312 | ---- | M] () -- C:\Users\James\Desktop\535694_317935221607068_290416377692286_837693_1167065899_n.jpg
[2012.04.07 12:47:47 | 000,000,577 | ---- | M] () -- C:\Users\James\Desktop\pp.html
[2012.04.06 11:35:24 | 000,001,344 | ---- | M] () -- C:\Users\James\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Facebook Messenger.lnk
[2012.04.05 18:40:50 | 000,037,063 | ---- | M] () -- C:\Users\James\Desktop\mith.JPG
[2012.04.05 18:25:36 | 000,098,835 | ---- | M] () -- C:\Users\James\Desktop\thomannbestellung.JPG
[2012.04.04 22:17:10 | 000,016,295 | ---- | M] () -- C:\Users\James\Desktop\Dust in the Wind Lyrics.aup
[2012.04.04 17:46:08 | 000,018,111 | ---- | M] () -- C:\Users\James\Desktop\kansas_dust_in_the_wind.gp3
[2012.03.29 08:24:22 | 003,695,494 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2012.03.27 22:31:57 | 000,013,780 | ---- | M] () -- C:\Users\James\Desktop\assi1.JPG
[2012.03.26 21:46:53 | 000,018,374 | ---- | M] () -- C:\Users\James\Desktop\stern-dreieck-autom_last.jpg
[2012.03.26 21:46:48 | 000,015,391 | ---- | M] () -- C:\Users\James\Desktop\stern-dreieck-autom_strg.jpg
[2012.03.15 17:26:47 | 003,076,856 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[3 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.04.10 10:47:43 | 000,000,820 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.04.10 09:08:44 | 000,000,160 | ---- | C] () -- C:\ProgramData\-t360OKgu2RKIgsr
[2012.04.10 09:08:44 | 000,000,000 | ---- | C] () -- C:\ProgramData\-t360OKgu2RKIgs
[2012.04.10 09:08:36 | 000,000,653 | ---- | C] () -- C:\Users\James\Desktop\SMART_HDD.lnk
[2012.04.10 09:08:32 | 000,000,256 | ---- | C] () -- C:\ProgramData\t360OKgu2RKIgs
[2012.04.10 09:03:43 | 000,000,884 | ---- | C] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.04.08 12:28:03 | 000,019,312 | ---- | C] () -- C:\Users\James\Desktop\535694_317935221607068_290416377692286_837693_1167065899_n.jpg
[2012.04.07 12:46:14 | 000,000,577 | ---- | C] () -- C:\Users\James\Desktop\pp.html
[2012.04.05 18:40:50 | 000,037,063 | ---- | C] () -- C:\Users\James\Desktop\mith.JPG
[2012.04.05 18:25:35 | 000,098,835 | ---- | C] () -- C:\Users\James\Desktop\thomannbestellung.JPG
[2012.04.04 22:17:09 | 000,016,295 | ---- | C] () -- C:\Users\James\Desktop\Dust in the Wind Lyrics.aup
[2012.04.04 17:46:08 | 000,018,111 | ---- | C] () -- C:\Users\James\Desktop\kansas_dust_in_the_wind.gp3
[2012.03.27 22:31:57 | 000,013,780 | ---- | C] () -- C:\Users\James\Desktop\assi1.JPG
[2012.03.26 21:46:53 | 000,018,374 | ---- | C] () -- C:\Users\James\Desktop\stern-dreieck-autom_last.jpg
[2012.03.26 18:45:02 | 000,015,391 | ---- | C] () -- C:\Users\James\Desktop\stern-dreieck-autom_strg.jpg
[2012.02.04 19:14:45 | 000,002,169 | ---- | C] () -- C:\Windows\XENcfg.ini
[2012.02.04 19:14:45 | 000,000,388 | ---- | C] () -- C:\Windows\XENMCcfg.ini
[2012.02.04 19:14:43 | 000,186,880 | ---- | C] () -- C:\Windows\SysWow64\APOMngr.DLL
[2012.02.04 19:14:43 | 000,073,728 | ---- | C] () -- C:\Windows\SysWow64\CmdRtr.DLL
[2012.01.06 12:16:35 | 000,000,283 | ---- | C] () -- C:\Users\James\AppData\Roaming\groovedown.settings
[2012.01.06 12:16:35 | 000,000,000 | ---- | C] () -- C:\Users\James\AppData\Roaming\gd.db
[2011.12.25 12:22:11 | 000,110,080 | ---- | C] () -- C:\Windows\SysWow64\advd.dll
[2011.12.25 12:22:11 | 000,023,040 | ---- | C] () -- C:\Windows\SysWow64\auth.dll
[2011.09.25 17:24:32 | 000,000,425 | ---- | C] () -- C:\Windows\BRWMARK.INI
[2011.09.25 17:24:32 | 000,000,027 | ---- | C] () -- C:\Windows\BRPP2KA.INI
[2011.09.16 11:54:48 | 000,030,568 | ---- | C] () -- C:\Windows\MusiccityDownload.exe
[2011.09.16 11:54:44 | 000,974,848 | ---- | C] () -- C:\Windows\SysWow64\cis-2.4.dll
[2011.09.16 11:54:44 | 000,081,920 | ---- | C] () -- C:\Windows\SysWow64\issacapi_bs-2.3.dll
[2011.09.16 11:54:44 | 000,065,536 | ---- | C] () -- C:\Windows\SysWow64\issacapi_pe-2.3.dll
[2011.09.16 11:54:44 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\issacapi_se-2.3.dll
[2011.08.03 03:31:54 | 000,311,912 | ---- | C] () -- C:\Windows\SysWow64\nvStreaming.exe
[2011.07.07 11:19:32 | 000,000,023 | ---- | C] () -- C:\Windows\BlendSettings.ini
[2011.06.17 09:26:55 | 000,032,768 | ---- | C] () -- C:\Windows\SysWow64\Amhooker.dll
[2011.06.15 22:34:37 | 000,000,032 | R--- | C] () -- C:\ProgramData\hash.dat
[2011.05.20 18:08:12 | 000,070,348 | ---- | C] () -- C:\Windows\War3Unin.dat
[2011.05.12 22:26:53 | 000,554,496 | ---- | C] () -- C:\Windows\SysWow64\dvmsg.dll
[2011.04.16 18:51:16 | 000,041,872 | ---- | C] () -- C:\Windows\SysWow64\xfcodec.dll
[2011.04.09 18:55:28 | 000,179,261 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat
[2011.03.04 19:50:45 | 000,000,774 | ---- | C] () -- C:\Users\James\AppData\Roaming\MPQEditor.ini
[2010.12.24 11:40:38 | 000,000,074 | ---- | C] () -- C:\Windows\ZMatrixSS.ini
[2010.11.09 16:03:17 | 000,001,908 | ---- | C] () -- C:\Windows\blueblox.ini
[2010.10.02 18:24:52 | 000,000,600 | ---- | C] () -- C:\Users\James\AppData\Local\PUTTY.RND
[2010.09.30 14:52:35 | 000,000,535 | ---- | C] () -- C:\Windows\ODBCINST.INI
[2010.09.30 14:52:35 | 000,000,288 | ---- | C] () -- C:\Windows\ODBC.INI
[2010.09.18 12:21:30 | 000,000,000 | ---- | C] () -- C:\Users\James\AppData\Local\debuggee.mdmp
[2010.09.02 13:31:56 | 000,000,000 | ---- | C] () -- C:\Users\James\AppData\Roaming\server666.exe
[2010.06.25 19:03:12 | 000,053,299 | ---- | C] () -- C:\Windows\SysWow64\pthreadVC.dll
[2010.06.12 21:57:20 | 000,120,200 | ---- | C] () -- C:\Windows\SysWow64\DLLDEV32i.dll
[2010.06.12 21:57:03 | 000,007,119 | ---- | C] () -- C:\Windows\mgxoschk.ini
[2010.05.16 18:04:01 | 000,126,464 | ---- | C] () -- C:\Windows\SysWow64\lame_enc.dll
[2010.05.16 18:02:22 | 000,003,584 | ---- | C] () -- C:\Users\James\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 136 bytes -> C:\ProgramData\TEMP:A157A892
@Alternate Data Stream - 12 bytes -> C:\Users\James\Documents:{726B6F7C-E889-4EFE-8CA3-AEF4943DBD38}
@Alternate Data Stream - 12 bytes -> C:\Users\James\AppData\Roaming\Brother:{726B6F7C-E889-4EFE-8CA3-AEF4943DBD38}

< End of report >
         

--- --- ---

[/CODE]

C:\Users\James\AppData\Local\Temp\cgs8h0.exe (Rootkit.0Access) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\James\AppData\Local\Temp\hj8ol0.exe (Backdoor.Agent.RCGen) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\James\AppData\Local\Temp\msimg32.dll (Rootkit.0Access) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Du hast ein ZeroAccess im System.
Bereinigung nicht empfohlen. Angebracht wäre eine Datensicherung über Linux-Live-CD und anschließende Neuinstallation von Windows

Sicher dass das nicht von Bifrost kommt?
Weil das wäre sonst in Ordnung..

Ziemlich sicher nicht. Ich seh hier genug Fälle der Erpresser-Schädlinge, wo hin und wieder eine Variante raufkommt die offensichtlich auch den ZeroAccess installiert (also vermutlich entweder nachlädt oder schon dabei hat)

Hm ok.. Danke...
Aber gibts denn keine möglichkeit das zu bereinigen ohne Windows neu aufsetzen zu müsen.. Das dauert doch ewig die Daten auf ne externe zu kopieren.. vorallem wenn 's viele kleine Dateien sind ://

Das dauert doch ewig die Daten auf ne externe zu kopieren.. vorallem wenn 's viele kleine Dateien sind ://

Was meinst du wie ärgerlich ein Plattencrash ist und du kein Backup hast
Wie kann man nur so wichtige Daten nur einmal und dann nur auf der internen Platte haben. Oder sind die die Daten doch nicht so wichtig?

Kaum einer will was von Backups hören und wenn dann mal das System hinüber ist dann sind die Leute die zu faul für backups sind eigentlich immer die ersten die jammern...