Guten Abend Trojaner-Board,

Ich habe selbes Problem wie viele Treffer auf Google; meine externe Festplatte zeigt mir nur noch Verknüpfungen an, der Speicherplatz wird aber noch gebraucht und über iTunes kann ich auch auf die Musik, die auf der externen Platte gespeichert ist zugreifen.

Folge jetzt gerade den Anweisungen im "Für alle Hilfesuchenden"-Thread.

-defogger gibt keinen Fehler an
-dds.txt, attach.txt und gmer.txt hier im Thema und den Malwarebytes-Anti Malware Log angehängt

-dds.txt:
[code].DDS Logfile:

DDS (Ver_2011-08-26.01) - NTFSx86 
Internet Explorer: 8.0.7601.17514  BrowserJavaVersion: 1.6.0_22
Run by Nino at 17:46:00 on 2012-04-24
Microsoft Windows 7 Starter   6.1.7601.1.1252.41.3082.18.1013.408 [GMT -4:00]
.
AV: AntiVir Desktop *Disabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: AntiVir Desktop *Disabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\WLANExt.exe
C:\Windows\system32\conhost.exe
C:\Windows\System32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
C:\Windows\system32\conhost.exe
C:\ProgramData\Banda Ancha Movil\OnlineUpdate\ouc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Launch Manager\dsiwmis.exe
C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
C:\Program Files\Acer\Registration\GREGsvc.exe
C:\ProgramData\DatacardService\HWDeviceService.exe
C:\Program Files\Symantec\Norton Online Backup\NOBuAgent.exe
C:\Program Files\Acer\Acer VCM\RS_Service.exe
C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\Acer\Acer Updater\UpdaterService.exe
C:\Program Files\Microsoft Application Virtualization Client\sftlist.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.exe
C:\ProgramData\DatacardService\DCSHelper.exe
C:\Program Files\EgisTec IPS\PmmUpdate.exe
C:\Program Files\EgisTec MyWinLocker\x86\mwlDaemon.exe
C:\Program Files\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Launch Manager\LManager.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Launch Manager\LMworker.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Acer\Acer VCM\AcerVCM.exe
C:\Program Files\EgisTec IPS\EgisUpdate.exe
C:\Windows\system32\igfxext.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\UI0Detect.exe
C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\System32\svchost.exe -k swprv
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Adobe\Reader 9.0\Reader\AcroRd32Info.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\conhost.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.com
uDefault_Page_URL = hxxp://acer.msn.com
mDefault_Page_URL = hxxp://acer.msn.com
mStart Page = hxxp://www.google.com
uInternet Settings,ProxyOverride = *.local
uWinlogon: Shell=c:\program files\oceanis\systemsetting\WallPaperAgent.exe
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Windows 7 Starter Helper: {d381ff29-7cfb-4d4e-b92a-c4eddc696614} - c:\program files\oceanis\systemsetting\StarterHelper.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun
uRun: [Steam] "c:\program files\steam\Steam.exe" -silent
uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background
mRun: [SuiteTray] "c:\program files\egistec mywinlockersuite\x86\SuiteTray.exe"
mRun: [EgisUpdate] "c:\program files\egistec ips\EgisUpdate.exe" -d
mRun: [EgisTecPMMUpdate] "c:\program files\egistec ips\PmmUpdate.exe"
mRun: [mwlDaemon] c:\program files\egistec mywinlocker\x86\mwlDaemon.exe
mRun: [Norton Online Backup] c:\program files\symantec\norton online backup\NOBuClient.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [RtHDVCpl] c:\program files\realtek\audio\hda\RtHDVCpl.exe -s
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [LManager] c:\program files\launch manager\LManager.exe
mRun: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
mRun: [Acer ePower Management] c:\program files\acer\acer epower management\ePowerTray.exe
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe"
mRun: [FILSHtray] "c:\program files\filshtray\FILSHtray.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\acervc~1.lnk - c:\program files\acer\acer vcm\AcerVCM.exe
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: Free YouTube to MP3 Converter - c:\users\nino\appdata\roaming\dvdvideosoftiehelpers\freeyoutubetomp3converter.htm
IE: {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - c:\program files\pokerstars\PokerStarsUpdate.exe
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
TCP: DhcpNameServer = 192.168.1.1
TCP: Interfaces\{0DBFD4F9-63FE-4A8B-843D-CB900932C2A0} : DhcpNameServer = 192.168.1.1
TCP: Interfaces\{0DBFD4F9-63FE-4A8B-843D-CB900932C2A0}\075627D6163657C647572716 : DhcpNameServer = 200.74.121.11 190.160.0.11 190.160.0.14
TCP: Interfaces\{0DBFD4F9-63FE-4A8B-843D-CB900932C2A0}\3416665602C4F657E67656 : DhcpNameServer = 192.168.1.1
TCP: Interfaces\{0DBFD4F9-63FE-4A8B-843D-CB900932C2A0}\3495E445849414 : DhcpNameServer = 192.168.1.1
TCP: Interfaces\{0DBFD4F9-63FE-4A8B-843D-CB900932C2A0}\84160707970284F657270216C6C60246169712121202130247F60293 : DhcpNameServer = 216.230.147.90 216.230.128.32
TCP: Interfaces\{0DBFD4F9-63FE-4A8B-843D-CB900932C2A0}\84160707970284F657273702164702C4F6370214D69676F63702130247F60293 : DhcpNameServer = 216.230.147.90 216.230.128.32
TCP: Interfaces\{328B426D-7B3A-469C-8DC1-C6E9B42C0B5A} : NameServer = 200.63.56.3 200.63.56.4
TCP: Interfaces\{99C7F557-E6D5-4620-B3D6-40766ECC5F96} : DhcpNameServer = 192.168.1.1
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\program files\acer\acer vcm\Skype4COM.dll
Notify: igfxcui - igfxdev.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\users\nino\appdata\roaming\mozilla\firefox\profiles\bh7r0qcs.default\
FF - prefs.js: browser.startup.homepage - hxxp://startsear.ch
FF - prefs.js: keyword.URL - hxxp://startsear.ch/?q=
FF - prefs.js: network.proxy.ftp - 81.63.140.37
FF - prefs.js: network.proxy.ftp_port - 3128
FF - prefs.js: network.proxy.http - 81.63.140.37
FF - prefs.js: network.proxy.http_port - 3128
FF - prefs.js: network.proxy.socks - 81.63.140.37
FF - prefs.js: network.proxy.socks_port - 3128
FF - prefs.js: network.proxy.ssl - 81.63.140.37
FF - prefs.js: network.proxy.ssl_port - 3128
FF - prefs.js: network.proxy.type - 4
FF - plugin: c:\progra~1\micros~4\office14\NPSPWRAP.DLL
FF - plugin: c:\program files\adobe\reader 9.0\reader\air\nppdf32.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\microsoft silverlight\4.1.10111.0\npctrlui.dll
FF - plugin: c:\program files\veetle\player\npvlc.dll
FF - plugin: c:\program files\veetle\plugins\npVeetle.dll
FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_2_202_233.dll
.
============= SERVICES / DRIVERS ===============
.
R1 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\drivers\mwlPSDFilter.sys [2009-6-2 18992]
R1 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\drivers\mwlPSDNserv.sys [2009-6-2 16432]
R1 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\drivers\mwlPSDVDisk.sys [2009-6-2 60976]
R1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\drivers\vwififlt.sys [2009-7-13 48128]
R2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files\avira\antivir desktop\sched.exe [2011-5-19 136360]
R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2011-5-19 269480]
R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2011-5-19 66616]
R2 cvhsvc;Client Virtualization Handler;c:\program files\common files\microsoft shared\virtualization handler\CVHSVC.EXE [2012-1-4 822624]
R2 DsiWMIService;Dritek WMI Service;c:\program files\launch manager\dsiwmis.exe [2011-1-11 321104]
R2 ePowerSvc;Acer ePower Service;c:\program files\acer\acer epower management\ePowerSvc.exe [2011-2-14 735776]
R2 GREGService;GREGService;c:\program files\acer\registration\GREGsvc.exe [2010-1-8 23584]
R2 HWDeviceService.exe;HWDeviceService.exe;c:\programdata\datacardservice\hwdeviceservice.exe -/service --> c:\programdata\datacardservice\HWDeviceService.exe -/service [?]
R2 NOBU;Norton Online Backup;c:\program files\symantec\norton online backup\NOBuAgent.exe [2010-6-1 2057560]
R2 RS_Service;Raw Socket Service;c:\program files\acer\acer vcm\RS_Service.exe [2011-1-11 260640]
R2 sftlist;Application Virtualization Client;c:\program files\microsoft application virtualization client\sftlist.exe [2011-10-1 508776]
R2 Updater Service;Updater Service;c:\program files\acer\acer updater\UpdaterService.exe [2011-1-11 243232]
R3 huawei_enumerator;huawei_enumerator;c:\windows\system32\drivers\ew_jubusenum.sys [2011-6-15 72576]
R3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\drivers\L1C62x86.sys [2011-1-11 68208]
R3 Sftfs;Sftfs;c:\windows\system32\drivers\Sftfslh.sys [2011-10-1 579944]
R3 Sftplay;Sftplay;c:\windows\system32\drivers\Sftplaylh.sys [2011-10-1 194408]
R3 Sftredir;Sftredir;c:\windows\system32\drivers\Sftredirlh.sys [2011-10-1 21864]
R3 Sftvol;Sftvol;c:\windows\system32\drivers\Sftvollh.sys [2011-10-1 19304]
R3 sftvsa;Application Virtualization Service Agent;c:\program files\microsoft application virtualization client\sftvsa.exe [2011-10-1 219496]
S2 Banda Ancha Movil. RunOuc;Banda Ancha Movil. OUC;c:\program files\banda ancha movil\updatedog\ouc.exe [2011-6-15 218624]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\macromed\flash\FlashPlayerUpdateService.exe [2012-4-24 253088]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-13 229888]
S3 EUCR;EUCR;c:\windows\system32\drivers\EUCR6SK.sys [2011-1-11 82768]
S3 ew_hwusbdev;Huawei MobileBroadband USB PNP Device;c:\windows\system32\drivers\ew_hwusbdev.sys [2011-6-15 102784]
S3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\drivers\ewusbnet.sys [2011-6-15 208896]
S3 MWLService;MyWinLocker Service;c:\program files\egistec mywinlocker\x86\MWLService.exe [2010-5-26 305520]
S3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\drivers\netaapl.sys [2011-8-2 18432]
S3 osppsvc;Office Software Protection Platform;c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\OSPPSVC.EXE [2010-1-9 4640000]
S3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\TsUsbFlt.sys [2011-4-18 52224]
.
=============== Created Last 30 ================
.
2012-04-24 14:22:15	6734704	----a-w-	c:\programdata\microsoft\windows defender\definition updates\{3027710d-5bd4-4231-a684-5ca0699002b0}\mpengine.dll
2012-04-24 12:59:44	418464	----a-w-	c:\windows\system32\FlashPlayerApp.exe
2012-04-23 20:26:01	--------	d-----w-	c:\users\nino\appdata\roaming\Malwarebytes
2012-04-23 20:24:52	--------	d-----w-	c:\programdata\Malwarebytes
2012-04-23 20:24:47	22344	----a-w-	c:\windows\system32\drivers\mbam.sys
2012-04-23 20:24:46	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2012-04-16 15:21:35	0	----a-w-	c:\windows\system32\shoD5F5.tmp
2012-04-16 15:00:31	--------	d-----w-	c:\program files\iPod
2012-04-16 14:52:33	159744	----a-w-	c:\program files\internet explorer\plugins\npqtplugin7.dll
2012-04-16 14:52:33	159744	----a-w-	c:\program files\internet explorer\plugins\npqtplugin6.dll
2012-04-16 14:52:33	159744	----a-w-	c:\program files\internet explorer\plugins\npqtplugin5.dll
2012-04-16 14:52:33	159744	----a-w-	c:\program files\internet explorer\plugins\npqtplugin4.dll
2012-04-16 14:52:33	159744	----a-w-	c:\program files\internet explorer\plugins\npqtplugin3.dll
2012-04-16 14:52:33	159744	----a-w-	c:\program files\internet explorer\plugins\npqtplugin2.dll
2012-04-16 14:52:33	159744	----a-w-	c:\program files\internet explorer\plugins\npqtplugin.dll
2012-04-15 23:40:27	592824	----a-w-	c:\program files\mozilla firefox\gkmedias.dll
2012-04-15 23:40:27	44472	----a-w-	c:\program files\mozilla firefox\mozglue.dll
2012-04-15 23:40:26	548864	----a-w-	c:\program files\mozilla firefox\msvcp80.dll
2012-04-15 23:40:26	479232	----a-w-	c:\program files\mozilla firefox\msvcm80.dll
2012-04-15 23:40:25	626688	----a-w-	c:\program files\mozilla firefox\msvcr80.dll
2012-04-12 05:46:43	0	----a-w-	c:\windows\system32\shoB3C7.tmp
2012-04-12 05:37:06	5120	----a-w-	c:\windows\system32\wmi.dll
2012-04-12 05:37:06	19824	----a-w-	c:\windows\system32\drivers\fs_rec.sys
2012-04-12 05:37:06	172544	----a-w-	c:\windows\system32\wintrust.dll
2012-04-12 05:37:05	159232	----a-w-	c:\windows\system32\imagehlp.dll
2012-04-12 05:36:20	3968368	----a-w-	c:\windows\system32\ntkrnlpa.exe
2012-04-12 05:36:19	3913072	----a-w-	c:\windows\system32\ntoskrnl.exe
2012-04-10 03:39:21	--------	d-----w-	c:\program files\Oceanis
2012-04-08 02:15:49	--------	d-----w-	c:\program files\OpenTTD
2012-04-06 07:47:12	0	----a-w-	c:\windows\system32\shoD7A7.tmp
2012-04-04 05:32:41	0	----a-w-	c:\windows\system32\sho47D5.tmp
2012-03-26 15:41:34	103864	----a-w-	c:\program files\internet explorer\plugins\nppdf32.dll
.
==================== Find3M  ====================
.
2012-04-24 12:59:44	70304	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2012-02-28 05:38:52	981504	----a-w-	c:\windows\system32\wininet.dll
2012-02-28 03:52:27	1638912	----a-w-	c:\windows\system32\mshtml.tlb
2012-02-27 17:11:12	472808	----a-w-	c:\windows\system32\deployJava1.dll
2012-02-23 14:18:36	237072	------w-	c:\windows\system32\MpSigStub.exe
2012-02-17 05:34:22	826880	----a-w-	c:\windows\system32\rdpcore.dll
2012-02-17 04:14:08	183808	----a-w-	c:\windows\system32\drivers\rdpwd.sys
2012-02-17 04:13:22	24576	----a-w-	c:\windows\system32\drivers\tdtcp.sys
2012-02-15 14:01:50	4547944	----a-w-	c:\windows\system32\usbaaplrc.dll
2012-02-15 14:01:50	43520	----a-w-	c:\windows\system32\drivers\usbaapl.sys
2012-02-10 05:38:43	1077248	----a-w-	c:\windows\system32\DWrite.dll
2012-02-03 03:54:27	2343424	----a-w-	c:\windows\system32\win32k.sys
.
============= FINISH: 17:46:42.84 ===============
         

--- --- ---


-attach.txt

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-08-26.01)
.
Microsoft Windows 7 Starter 
Boot Device: \Device\HarddiskVolume2
Install Date: 14.04.2011 03:54:40
System Uptime: 24.04.2012 11:02:05 (6 hours ago)
.
Motherboard: Acer |  | JE02_PT_E
Processor: Intel(R) Atom(TM) CPU N455   @ 1.66GHz | CPU | 1666/667mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 136 GiB total, 98.142 GiB free.
D: is FIXED (NTFS) - 233 GiB total, 110.424 GiB free.
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
RP104: 17.04.2012 09:26:44 - Windows Update
RP105: 20.04.2012 20:30:09 - Windows Update
RP106: 24.04.2012 10:20:20 - Windows Update
.
==== Installed Programs ======================
.
Acer Crystal Eye webcam
Acer ePower Management
Acer eRecovery Management
Acer GameZone Console
Acer Registration
Acer ScreenSaver
Acer Updater
Acer VCM
Acrobat.com
Adobe AIR
Adobe Flash Player 10 ActiveX
Adobe Flash Player 11 Plugin
Adobe Reader 9.5.1 MUI
Airport Mania First Flight
Allway Sync version 11.3.5
Amazonia
Apple Application Support
Apple Mobile Device Support
Apple Software Update
Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver
Avira AntiVir Personal - Free Antivirus
Banda Ancha Movil
BitTorrent
Bonjour
Cake Mania
ConvertHelper 2.2
Dream Day First Home
Dungeon Crawl Stone Soup
ENE USB Card Reader Driver
eSobi v2
Farm Frenzy 2
FILSHtray Version 0.11
Galapago
GIMP 2.6.11
Hacer clic y ejecutar de Microsoft Office 2010
Heroes of Hellas
Herramienta de carga de Windows Live
Identity Card
Intel(R) Graphics Media Accelerator Driver
Intel(R) Rapid Storage Technology
iTunes
Java Auto Updater
Java(TM) 6 Update 22
Last.fm 1.5.4.27091
Launch Manager
Malwarebytes Anti-Malware Version 1.61.0.1400
Merriam Websters Spell Jam
Microsoft .NET Framework 4 Client Profile
Microsoft Application Error Reporting
Microsoft Office 2010
Microsoft Office ScreenTip Language 2010 - Deutsch
Microsoft Office Starter 2010 - Español
Microsoft Silverlight
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Mozilla Firefox 11.0 (x86 de)
Mp3tag v2.49
MyWinLocker
MyWinLocker Suite
Norton Online Backup
NVIDIA PhysX
Oceanis Change Background Windows 7
OpenOffice.org 3.3
OpenTTD 1.1.5
Poker Pop
PokerStars
QuickTime
Realtek High Definition Audio Driver
Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)
Shredder
Skype™ 4.1
Spin & Win
Steam
Synaptics Pointing Device Driver
Tibia
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217)
Veetle TV 0.9.18
VLC media player 1.1.9
vShare.tv plugin 1.0
Welcome Center
Windows Live Sync
WinRAR 4.00 (32-Bit)
YouTube Downloader 2.7.2
Zattoo4 4.0.5
.
==== Event Viewer Messages From Past Week ========
.
24.04.2012 10:16:56, Error: Service Control Manager [7026]  - El siguiente controlador de inicio del sistema o de inicio del arranque no se cargó correctamente:  cdrom
24.04.2012 10:16:23, Error: Service Control Manager [7009]  - Se agotó el tiempo de espera (30000 ms) para la conexión con el servicio Banda Ancha Movil. OUC.
24.04.2012 10:16:23, Error: Service Control Manager [7000]  - El servicio Banda Ancha Movil. OUC no pudo iniciarse debido al siguiente error:  El servicio no respondió a tiempo a la solicitud de inicio o de control.
24.04.2012 08:58:08, Error: Service Control Manager [7026]  - El siguiente controlador de inicio del sistema o de inicio del arranque no se cargó correctamente:  cdrom
24.04.2012 08:57:46, Error: Service Control Manager [7009]  - Se agotó el tiempo de espera (30000 ms) para la conexión con el servicio Banda Ancha Movil. OUC.
24.04.2012 08:57:46, Error: Service Control Manager [7000]  - El servicio Banda Ancha Movil. OUC no pudo iniciarse debido al siguiente error:  El servicio no respondió a tiempo a la solicitud de inicio o de control.
23.04.2012 21:41:12, Error: Service Control Manager [7011]  - Se agotó el tiempo de espera (30000 ms) para la respuesta de transacción del servicio Wlansvc.
23.04.2012 15:31:56, Error: Service Control Manager [7011]  - Se agotó el tiempo de espera (30000 ms) para la respuesta de transacción del servicio ShellHWDetection.
23.04.2012 10:25:35, Error: Service Control Manager [7026]  - El siguiente controlador de inicio del sistema o de inicio del arranque no se cargó correctamente:  cdrom
23.04.2012 10:24:57, Error: Service Control Manager [7009]  - Se agotó el tiempo de espera (30000 ms) para la conexión con el servicio Banda Ancha Movil. OUC.
23.04.2012 10:24:57, Error: Service Control Manager [7000]  - El servicio Banda Ancha Movil. OUC no pudo iniciarse debido al siguiente error:  El servicio no respondió a tiempo a la solicitud de inicio o de control.
22.04.2012 23:05:14, Error: Service Control Manager [7026]  - El siguiente controlador de inicio del sistema o de inicio del arranque no se cargó correctamente:  cdrom
22.04.2012 23:04:28, Error: Service Control Manager [7009]  - Se agotó el tiempo de espera (30000 ms) para la conexión con el servicio Banda Ancha Movil. OUC.
22.04.2012 23:04:28, Error: Service Control Manager [7000]  - El servicio Banda Ancha Movil. OUC no pudo iniciarse debido al siguiente error:  El servicio no respondió a tiempo a la solicitud de inicio o de control.
22.04.2012 17:24:48, Error: Service Control Manager [7026]  - El siguiente controlador de inicio del sistema o de inicio del arranque no se cargó correctamente:  cdrom
22.04.2012 17:24:17, Error: Service Control Manager [7009]  - Se agotó el tiempo de espera (30000 ms) para la conexión con el servicio Banda Ancha Movil. OUC.
22.04.2012 17:24:17, Error: Service Control Manager [7000]  - El servicio Banda Ancha Movil. OUC no pudo iniciarse debido al siguiente error:  El servicio no respondió a tiempo a la solicitud de inicio o de control.
21.04.2012 12:47:40, Error: Service Control Manager [7011]  - Se agotó el tiempo de espera (30000 ms) para la respuesta de transacción del servicio WwanSvc.
21.04.2012 10:46:32, Error: Service Control Manager [7011]  - Se agotó el tiempo de espera (30000 ms) para la respuesta de transacción del servicio Wlansvc.
21.04.2012 08:59:06, Error: Service Control Manager [7026]  - El siguiente controlador de inicio del sistema o de inicio del arranque no se cargó correctamente:  cdrom
21.04.2012 08:58:44, Error: Service Control Manager [7009]  - Se agotó el tiempo de espera (30000 ms) para la conexión con el servicio Banda Ancha Movil. OUC.
21.04.2012 08:58:44, Error: Service Control Manager [7000]  - El servicio Banda Ancha Movil. OUC no pudo iniciarse debido al siguiente error:  El servicio no respondió a tiempo a la solicitud de inicio o de control.
20.04.2012 17:14:53, Error: Service Control Manager [7026]  - El siguiente controlador de inicio del sistema o de inicio del arranque no se cargó correctamente:  cdrom
20.04.2012 17:14:22, Error: Service Control Manager [7009]  - Se agotó el tiempo de espera (30000 ms) para la conexión con el servicio Banda Ancha Movil. OUC.
20.04.2012 17:14:22, Error: Service Control Manager [7000]  - El servicio Banda Ancha Movil. OUC no pudo iniciarse debido al siguiente error:  El servicio no respondió a tiempo a la solicitud de inicio o de control.
19.04.2012 23:39:08, Error: Service Control Manager [7026]  - El siguiente controlador de inicio del sistema o de inicio del arranque no se cargó correctamente:  cdrom
19.04.2012 23:38:25, Error: Service Control Manager [7009]  - Se agotó el tiempo de espera (30000 ms) para la conexión con el servicio Banda Ancha Movil. OUC.
19.04.2012 23:38:25, Error: Service Control Manager [7000]  - El servicio Banda Ancha Movil. OUC no pudo iniciarse debido al siguiente error:  El servicio no respondió a tiempo a la solicitud de inicio o de control.
19.04.2012 11:44:38, Error: Service Control Manager [7026]  - El siguiente controlador de inicio del sistema o de inicio del arranque no se cargó correctamente:  cdrom
19.04.2012 11:44:14, Error: Service Control Manager [7009]  - Se agotó el tiempo de espera (30000 ms) para la conexión con el servicio Banda Ancha Movil. OUC.
19.04.2012 11:44:14, Error: Service Control Manager [7000]  - El servicio Banda Ancha Movil. OUC no pudo iniciarse debido al siguiente error:  El servicio no respondió a tiempo a la solicitud de inicio o de control.
19.04.2012 10:01:23, Error: Service Control Manager [7009]  - Se agotó el tiempo de espera (30000 ms) para la conexión con el servicio Steam Client Service.
19.04.2012 10:01:23, Error: Service Control Manager [7000]  - El servicio Steam Client Service no pudo iniciarse debido al siguiente error:  El servicio no respondió a tiempo a la solicitud de inicio o de control.
19.04.2012 10:00:25, Error: Service Control Manager [7026]  - El siguiente controlador de inicio del sistema o de inicio del arranque no se cargó correctamente:  cdrom
19.04.2012 09:59:41, Error: Service Control Manager [7009]  - Se agotó el tiempo de espera (30000 ms) para la conexión con el servicio Banda Ancha Movil. OUC.
19.04.2012 09:59:41, Error: Service Control Manager [7000]  - El servicio Banda Ancha Movil. OUC no pudo iniciarse debido al siguiente error:  El servicio no respondió a tiempo a la solicitud de inicio o de control.
18.04.2012 18:56:36, Error: Service Control Manager [7026]  - El siguiente controlador de inicio del sistema o de inicio del arranque no se cargó correctamente:  cdrom
18.04.2012 18:56:02, Error: Service Control Manager [7009]  - Se agotó el tiempo de espera (30000 ms) para la conexión con el servicio Banda Ancha Movil. OUC.
18.04.2012 18:56:02, Error: Service Control Manager [7000]  - El servicio Banda Ancha Movil. OUC no pudo iniciarse debido al siguiente error:  El servicio no respondió a tiempo a la solicitud de inicio o de control.
17.04.2012 23:46:28, Error: Service Control Manager [7026]  - El siguiente controlador de inicio del sistema o de inicio del arranque no se cargó correctamente:  cdrom
17.04.2012 23:46:06, Error: Service Control Manager [7009]  - Se agotó el tiempo de espera (30000 ms) para la conexión con el servicio Banda Ancha Movil. OUC.
17.04.2012 23:46:06, Error: Service Control Manager [7000]  - El servicio Banda Ancha Movil. OUC no pudo iniciarse debido al siguiente error:  El servicio no respondió a tiempo a la solicitud de inicio o de control.
17.04.2012 23:24:38, Error: Service Control Manager [7026]  - El siguiente controlador de inicio del sistema o de inicio del arranque no se cargó correctamente:  cdrom
17.04.2012 23:24:00, Error: Service Control Manager [7009]  - Se agotó el tiempo de espera (30000 ms) para la conexión con el servicio Banda Ancha Movil. OUC.
17.04.2012 23:24:00, Error: Service Control Manager [7000]  - El servicio Banda Ancha Movil. OUC no pudo iniciarse debido al siguiente error:  El servicio no respondió a tiempo a la solicitud de inicio o de control.
17.04.2012 23:16:22, Error: Service Control Manager [7026]  - El siguiente controlador de inicio del sistema o de inicio del arranque no se cargó correctamente:  cdrom
17.04.2012 23:15:48, Error: Service Control Manager [7009]  - Se agotó el tiempo de espera (30000 ms) para la conexión con el servicio Banda Ancha Movil. OUC.
17.04.2012 23:15:48, Error: Service Control Manager [7000]  - El servicio Banda Ancha Movil. OUC no pudo iniciarse debido al siguiente error:  El servicio no respondió a tiempo a la solicitud de inicio o de control.
17.04.2012 21:44:40, Error: Service Control Manager [7026]  - El siguiente controlador de inicio del sistema o de inicio del arranque no se cargó correctamente:  cdrom
17.04.2012 21:44:07, Error: Service Control Manager [7009]  - Se agotó el tiempo de espera (30000 ms) para la conexión con el servicio Banda Ancha Movil. OUC.
17.04.2012 21:44:07, Error: Service Control Manager [7000]  - El servicio Banda Ancha Movil. OUC no pudo iniciarse debido al siguiente error:  El servicio no respondió a tiempo a la solicitud de inicio o de control.
17.04.2012 21:34:51, Error: Service Control Manager [7011]  - Se agotó el tiempo de espera (30000 ms) para la respuesta de transacción del servicio ShellHWDetection.
17.04.2012 18:45:39, Error: Service Control Manager [7026]  - El siguiente controlador de inicio del sistema o de inicio del arranque no se cargó correctamente:  cdrom
17.04.2012 18:45:09, Error: Service Control Manager [7009]  - Se agotó el tiempo de espera (30000 ms) para la conexión con el servicio Banda Ancha Movil. OUC.
17.04.2012 18:45:09, Error: Service Control Manager [7000]  - El servicio Banda Ancha Movil. OUC no pudo iniciarse debido al siguiente error:  El servicio no respondió a tiempo a la solicitud de inicio o de control.
17.04.2012 12:32:45, Error: Service Control Manager [7026]  - El siguiente controlador de inicio del sistema o de inicio del arranque no se cargó correctamente:  cdrom
17.04.2012 12:32:08, Error: Service Control Manager [7009]  - Se agotó el tiempo de espera (30000 ms) para la conexión con el servicio Banda Ancha Movil. OUC.
17.04.2012 12:32:08, Error: Service Control Manager [7000]  - El servicio Banda Ancha Movil. OUC no pudo iniciarse debido al siguiente error:  El servicio no respondió a tiempo a la solicitud de inicio o de control.
17.04.2012 09:21:27, Error: Service Control Manager [7026]  - El siguiente controlador de inicio del sistema o de inicio del arranque no se cargó correctamente:  cdrom
17.04.2012 09:21:06, Error: Service Control Manager [7009]  - Se agotó el tiempo de espera (30000 ms) para la conexión con el servicio Banda Ancha Movil. OUC.
17.04.2012 09:21:06, Error: Service Control Manager [7000]  - El servicio Banda Ancha Movil. OUC no pudo iniciarse debido al siguiente error:  El servicio no respondió a tiempo a la solicitud de inicio o de control.
.
==== End Of File ===========================
         

-gmer.txt

GMER 1.0.15.15641 - hxxp://www.gmer.net
Rootkit scan 2012-04-24 18:34:16
Windows 6.1.7601 Service Pack 1 Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0 TOSHIBA_ rev.GJ00
Running: 5n8ocm4i.exe; Driver: C:\Users\Nino\AppData\Local\Temp\kwldqpog.sys


---- Kernel code sections - GMER 1.0.15 ----

.text           ntkrnlpa.exe!ZwSaveKey + 13C1                                                                    81C4D359 1 Byte  [06]
.text           ntkrnlpa.exe!KiDispatchInterrupt + 5A2                                                           81C86D52 19 Bytes  [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
?               C:\Users\Nino\AppData\Local\Temp\mbr.sys                                                         El sistema no puede encontrar el archivo especificado. !

---- User code sections - GMER 1.0.15 ----

.text           C:\Windows\Explorer.exe[2456] SHELL32.dll!SHCreateDefaultExtractIcon + 736B                      76BA33F4 4 Bytes  [90, 1B, 00, 10]

---- Devices - GMER 1.0.15 ----

Device                                                                                                           Ntfs.sys (Controlador del sistema de archivos NTFS/Microsoft Corporation)
Device                                                                                                           Sftfslh.sys (Microsoft Application Virtualization File System/Microsoft Corporation)

AttachedDevice  \Driver\kbdclass \Device\KeyboardClass0                                                          Wdf01000.sys (Motor en tiempo de ejecución del marco de controlador en modo kernel/Microsoft Corporation)
AttachedDevice  \Driver\kbdclass \Device\KeyboardClass1                                                          Wdf01000.sys (Motor en tiempo de ejecución del marco de controlador en modo kernel/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume1                                                           fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume1                                                           rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume2                                                           fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume2                                                           rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume3                                                           fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume3                                                           rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume4                                                           fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume4                                                           rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)

Device          \Driver\ACPI_HAL \Device\0000004b                                                                halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)

---- Registry - GMER 1.0.15 ----

Reg             HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\f07bcbb2bb5c                      
Reg             HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\f07bcbb2bb5c (not active ControlSet)  

---- EOF - GMER 1.0.15 ----
         

Ich hab jetzt noch alles gezippt angehängt.
Ein paar Dinge sind in Spanisch, weil das ganze System auf Spanisch läuft, ich hoffe, dass ist kein Problem, ist nur weniges und wenn von Nöten übersetz ich das, was ich finde auch gerne.

e: Der mbam log lief über C:\ sowie D:\, wo jeweils die Externe hängt.

Mit freundlichen Grüssen

Malwarebytes erstellt bei jedem Scanvorgang genau ein Log. Hast du in der Vergangenheit schonmal mit Malwarebytes gescannt?
Wenn ja dann stehen auch alle Logs zu jedem Scanvorgang im Reiter Logdateien. Bitte alle posten, die dort sichtbar sind.

Danke erstmal für die prompte Antwort

Ne, hab nur den Log, den ich angehängt habe.
Seltsamerweise funktioniert die Platte inzwischen wieder, jedoch ein bisschen komisch.



Bis anhin hat es mir nur die "acceso directo" (=Systemverknüpfungen) angezeigt.
Über die Ordner kann ich jetzt wieder auf die Daten zugreifen, die Transparenz verwirrt jedoch ein bisschen.
Zusätzlich zeigt es mir jetzt die desktop.ini an, wobei ich es noch nicht geschafft habe, diese wieder auszublenden und einfach löschen, wie das teilweise im Internet steht, will ich jetzt nicht.

die Transparenz verwirrt jedoch ein bisschen.

Schonmal was von versteckten Dateien gehört die man ein und ausblenden lassen kann

http://www.trojaner-board.de/59624-a...-sichtbar.html

Ich habs mit Google jetzt rausgefunden, ist nicht ganz einfach, dass jeweils von Spanisch auf Deutsch zu übersetzen, gerade bei solchen Begriffen

Aber wieso sind auf der Festplatte die Dateien jetzt plötzlich standardmässig versteckt, wieso hat dies dann geändert und sie wurden angezeigt und woher kommen diese ganzen Ordner, die mir sonst nicht angezeigt werden?
Soll heissen, wieso wird entweder alles oder gar nichts versteckt? Ich muss mir wohl mal ne deutsche Lizenz für das Ding zulegen.
Aber virusmässig läuft da demfall nichts, wenn weder Malware noch Antivir was findet?

Manche Ordner sind standardmäßig immer versteckt, weil die das Versteckt- oder Systemattribut haben! Wenn andere Objekte versteckt, hat irgendwas oder irgendwer diese Attribute gesetzt!

Lass dir zuerst mal alle Dateien anzeigen => http://www.trojaner-board.de/59624-a...-sichtbar.html
Danach sollte auch alle Ordner wieder angezeigt werden - halbtransparent, da sie noch die Atrribute "versteckt" und "system" tragen

Starte anschließend die Eingabeaufforderung über Start, Alle Programme, Zubehör

Musst in der Eingabeauforderung jeweils für jeden versteckten Ordner diesen Befehl ausführen:

attrib -s -h "x:\ordner" /s /d
         

x: => Muss angepasst werden, den passenden Buchstaben verwenden
"ordner" muss dann der jew. richtige Ordnername sein

Vgl. diesen Strang => http://www.trojaner-board.de/102950-...traeger-2.html

Ok, das mach ich alles noch.
Aber ich hab die Platte jetzt bei einem Kumpel angeschlossen und bei ihm kommt eine Trojanermeldung (AVG).
Hab nochmal das Malwarebytes nur über die Externe laufen gelassen und kommt immer noch keine Meldung.
Ich installier mir gerade das AVG und mal schauen, was dann kommt, editier das dann rein.

Ich installier mir gerade das AVG und mal schauen, was dann kommt, editier das dann rein.

Nein bitte nicht! Du hast doch schon AntiVir drauf und man sollte nicht sowas wie AVG und AntiVir mischen!

Nimm lieber erstmal den OnlineScanner ESET


ESET Online Scanner

• Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
• Lade und starte Eset Online Scanner
• Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
• Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
• Klicke auf Starten.
• Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
• Klicke am Ende des Suchlaufs auf Fertig stellen.
• Schließe das Fenster von ESET.
• Explorer öffnen.
• C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
• Logfile hier posten.
• Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
• Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Da siehts dann anders aus:

ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=0ea655aa3bbf6f4bb09477e65fd4f683
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-04-27 06:11:49
# local_time=2012-04-27 02:11:49 (-0400, Hora est. Sudamérica Pacífico)
# country="Switzerland"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1797 16775165 100 94 0 71122719 0 0
# compatibility_mode=5893 16776573 100 94 0 87084689 0 0
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# scanned=152867
# found=9
# cleaned=0
# scan_time=14012
D:\$RECYCLE.BIN.lnk	Win32/Dorkbot.D worm (unable to clean)	00000000000000000000000000000000	I
D:\.fseventsd.lnk	Win32/Dorkbot.D worm (unable to clean)	00000000000000000000000000000000	I
D:\.Trashes.lnk	Win32/Dorkbot.D worm (unable to clean)	00000000000000000000000000000000	I
D:\CVJECE.lnk	Win32/Dorkbot.D worm (unable to clean)	00000000000000000000000000000000	I
D:\Kimbal.lnk	Win32/Dorkbot.D worm (unable to clean)	00000000000000000000000000000000	I
D:\Seagate.lnk	Win32/Dorkbot.D worm (unable to clean)	00000000000000000000000000000000	I
D:\System Volume Information.lnk	Win32/Dorkbot.D worm (unable to clean)	00000000000000000000000000000000	I
D:\ucure.lnk	Win32/Dorkbot.D worm (unable to clean)	00000000000000000000000000000000	I
D:\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx	a variant of Win32/Conficker.X worm (unable to clean)	00000000000000000000000000000000	I
         

:|

e: hab den AVG Scanner dann übrigens nicht installiert.

Hätte da mal zwei Fragen bevor es weiter geht

1.) Geht der normale Modus uneingeschränkt?
2.) Vermisst du irgendwas im Startmenü? Sind da leere Ordner unter alle Programme oder ist alles vorhanden?

1.) Ja
2.) Ne, kein leerer Ordner da und wäre mir jetzt nicht bewusst, dass irgendwas fehlt

Mach bitte ein neues OTL-Log. Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

 hier steht das Log
         

CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

• Starte bitte die OTL.exe.
  Vista und Win7 User mit Rechtsklick "als Administrator starten"
• Setze oben mittig den Haken bei Scanne alle Benutzer
• Kopiere nun den kompletten Inhalt aus der untenstehenden Codebox in die Textbox von OTL - wenn OTL auf deutsch ist wird sie mit beschriftet

netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT
         

• Schliesse bitte nun alle Programme. (Wichtig)
• Klicke nun bitte auf den Quick Scan Button.
• Klick auf .
• Kopiere nun den Inhalt aus OTL.txt hier in Deinen Thread

Ich kenn mich damit nicht aus, aber ist das jetzt nicht nur über C:\ gelaufen?

OTL.txt:

OTL logfile created on: 28/04/2012 10:00:34 - Run 1
OTL by OldTimer - Version 3.2.41.0     Folder = C:\Users\Nino\Desktop\Problembehebung
 Starter Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000c0a | Country: Suiza | Language: DES | Date Format: dd.MM.yyyy
 
1013,09 Mb Total Physical Memory | 288,80 Mb Available Physical Memory | 28,51% Memory free
1,99 Gb Paging File | 0,96 Gb Available in Paging File | 48,22% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 135,95 Gb Total Space | 86,59 Gb Free Space | 63,70% Space Free | Partition Type: NTFS
Drive D: | 232,88 Gb Total Space | 110,02 Gb Free Space | 47,24% Space Free | Partition Type: NTFS
 
Computer Name: NINO-PC | User Name: Nino | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Nino\Desktop\Problembehebung\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation)
PRC - C:\Program Files\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation)
PRC - C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Windows\System32\conhost.exe (Microsoft Corporation)
PRC - C:\ProgramData\Banda Ancha Movil\OnlineUpdate\ouc.exe ()
PRC - C:\Program Files\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH)
PRC - C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)
PRC - C:\ProgramData\DatacardService\HWDeviceService.exe ()
PRC - C:\ProgramData\DatacardService\DCSHelper.exe (Huawei Technologies Co., Ltd.)
PRC - C:\Program Files\Acer\Acer VCM\AcerVCM.exe (Acer Incorporated)
PRC - C:\Program Files\Launch Manager\LManager.exe (Dritek System Inc.)
PRC - C:\Program Files\Launch Manager\dsiwmis.exe (Dritek System Inc.)
PRC - C:\Program Files\Launch Manager\LMworker.exe (Dritek System Inc.)
PRC - C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe (Acer Incorporated)
PRC - C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe (Acer Incorporated)
PRC - C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe (Acer Incorporated)
PRC - C:\Program Files\Symantec\Norton Online Backup\NOBuAgent.exe (Symantec Corporation)
PRC - C:\Program Files\EgisTec MyWinLocker\x86\mwlDaemon.exe (Egis Technology Inc.)
PRC - C:\Program Files\EgisTec IPS\PmmUpdate.exe (Egis Technology Inc.)
PRC - C:\Program Files\EgisTec IPS\EgisUpdate.exe (Egis Technology Inc.)
PRC - C:\Program Files\Acer\Acer VCM\RS_Service.exe (Acer Incorporated)
PRC - C:\Program Files\Acer\Acer Updater\UpdaterService.exe (Acer Group)
PRC - C:\Program Files\Acer\Registration\GREGsvc.exe (Acer Incorporated)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Program Files\Adobe\Reader 9.0\Reader\ViewerPS.dll ()
MOD - C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll ()
MOD - C:\Program Files\Launch Manager\CdDirIo.dll ()
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (MozillaMaintenance) -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (Steam Client Service) -- C:\Program Files\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (sftvsa) -- C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation)
SRV - (sftlist) -- C:\Program Files\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation)
SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (Banda Ancha Movil. RunOuc) -- C:\Program Files\Banda Ancha Movil\UpdateDog\ouc.exe ()
SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (HWDeviceService.exe) -- C:\ProgramData\DatacardService\HWDeviceService.exe ()
SRV - (DsiWMIService) -- C:\Program Files\Launch Manager\dsiwmis.exe (Dritek System Inc.)
SRV - (ePowerSvc) -- C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe (Acer Incorporated)
SRV - (NOBU) -- C:\Program Files\Symantec\Norton Online Backup\NOBuAgent.exe (Symantec Corporation)
SRV - (MWLService) -- C:\Program Files\EgisTec MyWinLocker\x86\MWLService.exe (Egis Technology Inc.)
SRV - (RS_Service) -- C:\Program Files\Acer\Acer VCM\RS_Service.exe (Acer Incorporated)
SRV - (Updater Service) -- C:\Program Files\Acer\Acer Updater\UpdaterService.exe (Acer Group)
SRV - (GREGService) -- C:\Program Files\Acer\Registration\GREGsvc.exe (Acer Incorporated)
SRV - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (Sftvol) -- C:\Windows\System32\drivers\Sftvollh.sys (Microsoft Corporation)
DRV - (Sftredir) -- C:\Windows\System32\drivers\Sftredirlh.sys (Microsoft Corporation)
DRV - (Sftplay) -- C:\Windows\System32\drivers\Sftplaylh.sys (Microsoft Corporation)
DRV - (Sftfs) -- C:\Windows\System32\drivers\Sftfslh.sys (Microsoft Corporation)
DRV - (Netaapl) -- C:\Windows\System32\drivers\netaapl.sys (Apple Inc.)
DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH)
DRV - (ew_hwusbdev) -- C:\Windows\System32\drivers\ew_hwusbdev.sys (Huawei Technologies Co., Ltd.)
DRV - (huawei_enumerator) -- C:\Windows\System32\drivers\ew_jubusenum.sys (Huawei Technologies Co., Ltd.)
DRV - (ewusbnet) -- C:\Windows\System32\drivers\ewusbnet.sys (Huawei Technologies Co., Ltd.)
DRV - (hwdatacard) -- C:\Windows\System32\drivers\ewusbmdm.sys (Huawei Technologies Co., Ltd.)
DRV - (TsUsbFlt) -- C:\Windows\System32\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV - (WinUsb) -- C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)
DRV - (L1C) -- C:\Windows\System32\drivers\L1C62x86.sys (Atheros Communications, Inc.)
DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (EUCR) -- C:\Windows\System32\drivers\EUCR6SK.sys (ENE Technology Inc.)
DRV - (Serial) -- C:\Windows\System32\drivers\serial.sys (Brother Industries Ltd.)
DRV - (mwlPSDVDisk) -- C:\Windows\System32\drivers\mwlPSDVDisk.sys (Egis Technology Inc.)
DRV - (mwlPSDNServ) -- C:\Windows\System32\drivers\mwlPSDNserv.sys (Egis Technology Inc.)
DRV - (mwlPSDFilter) -- C:\Windows\System32\drivers\mwlPSDFilter.sys (Egis Technology Inc.)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer.msn.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
IE - HKLM\..\SearchScopes,DefaultScope = {1645A33F-0A96-4315-904E-29E188E7720E}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=AARTDF&pc=MAAR&src=IE-SearchBox
IE - HKLM\..\SearchScopes\{1645A33F-0A96-4315-904E-29E188E7720E}: "URL" = hxxp://startsear.ch/?q={searchTerms}
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-554268580-2193171868-296834247-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer.msn.com
IE - HKU\S-1-5-21-554268580-2193171868-296834247-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
IE - HKU\S-1-5-21-554268580-2193171868-296834247-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-554268580-2193171868-296834247-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-554268580-2193171868-296834247-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultengine: "hxxp://startsear.ch/?q="
FF - prefs.js..browser.search.defaultenginename: "hxxp://startsear.ch/?q="
FF - prefs.js..browser.search.order.1: "hxxp://startsear.ch/?q="
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://startsear.ch"
FF - prefs.js..keyword.URL: "hxxp://startsear.ch/?q="
FF - prefs.js..network.proxy.backup.ftp: ""
FF - prefs.js..network.proxy.backup.ftp_port: 0
FF - prefs.js..network.proxy.backup.socks: ""
FF - prefs.js..network.proxy.backup.socks_port: 0
FF - prefs.js..network.proxy.backup.ssl: "83.137.26.25"
FF - prefs.js..network.proxy.backup.ssl_port: 0
FF - prefs.js..network.proxy.ftp: "81.63.140.37"
FF - prefs.js..network.proxy.ftp_port: 3128
FF - prefs.js..network.proxy.http: "81.63.140.37"
FF - prefs.js..network.proxy.http_port: 3128
FF - prefs.js..network.proxy.share_proxy_settings: true
FF - prefs.js..network.proxy.socks: "81.63.140.37"
FF - prefs.js..network.proxy.socks_port: 3128
FF - prefs.js..network.proxy.ssl: "81.63.140.37"
FF - prefs.js..network.proxy.ssl_port: 3128
FF - prefs.js..network.proxy.type: 4
FF - user.js - File not found
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_2_202_233.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@veetle.com/veetleCorePlugin,version=0.9.18: C:\Program Files\Veetle\plugins\npVeetle.dll (Veetle Inc)
FF - HKLM\Software\MozillaPlugins\@veetle.com/veetlePlayerPlugin,version=0.9.18: C:\Program Files\Veetle\Player\npvlc.dll (Veetle Inc)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/04/26 10:22:49 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
 
[2011/04/15 04:20:27 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Nino\AppData\Roaming\mozilla\Extensions
[2012/04/26 10:29:33 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Nino\AppData\Roaming\mozilla\Firefox\Profiles\bh7r0qcs.default\extensions
[2012/03/31 16:12:00 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\Nino\AppData\Roaming\mozilla\Firefox\Profiles\bh7r0qcs.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2012/04/26 00:12:24 | 000,001,018 | ---- | M] () -- C:\Users\Nino\AppData\Roaming\Mozilla\Firefox\Profiles\bh7r0qcs.default\searchplugins\facebook.xml
[2011/06/03 17:22:17 | 000,003,467 | ---- | M] () -- C:\Users\Nino\AppData\Roaming\Mozilla\Firefox\Profiles\bh7r0qcs.default\searchplugins\harptabs.xml
[2011/06/02 17:11:10 | 000,001,740 | ---- | M] () -- C:\Users\Nino\AppData\Roaming\Mozilla\Firefox\Profiles\bh7r0qcs.default\searchplugins\leo-deu-spa.xml
[2011/05/18 09:06:52 | 000,000,632 | ---- | M] () -- C:\Users\Nino\AppData\Roaming\Mozilla\Firefox\Profiles\bh7r0qcs.default\searchplugins\startsear.xml
[2011/06/01 15:28:53 | 000,001,597 | ---- | M] () -- C:\Users\Nino\AppData\Roaming\Mozilla\Firefox\Profiles\bh7r0qcs.default\searchplugins\the-pirate-bay.xml
[2011/06/01 15:06:05 | 000,002,024 | ---- | M] () -- C:\Users\Nino\AppData\Roaming\Mozilla\Firefox\Profiles\bh7r0qcs.default\searchplugins\transfermarktde.xml
[2011/06/07 15:04:57 | 000,001,330 | ---- | M] () -- C:\Users\Nino\AppData\Roaming\Mozilla\Firefox\Profiles\bh7r0qcs.default\searchplugins\wikipedia-en.xml
[2011/11/09 17:58:34 | 000,001,997 | ---- | M] () -- C:\Users\Nino\AppData\Roaming\Mozilla\Firefox\Profiles\bh7r0qcs.default\searchplugins\wolframalpha.xml
[2011/06/01 15:29:10 | 000,002,057 | ---- | M] () -- C:\Users\Nino\AppData\Roaming\Mozilla\Firefox\Profiles\bh7r0qcs.default\searchplugins\youtube-videosuche.xml
[2012/04/16 10:14:10 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2011/06/10 20:15:02 | 000,000,000 | ---D | M] (vShare Add-On) -- C:\Program Files\Mozilla Firefox\extensions\{dd05fd3d-18df-4ce4-ae53-e795339c5f01}
() (No name found) -- C:\USERS\NINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BH7R0QCS.DEFAULT\EXTENSIONS\{455D905A-D37C-4643-A9E2-F6FEFAA0424A}.XPI
() (No name found) -- C:\USERS\NINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BH7R0QCS.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
() (No name found) -- C:\USERS\NINO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BH7R0QCS.DEFAULT\EXTENSIONS\{F8A55C97-3DB6-4961-A81D-0DE0080E53CB}.XPI
[2012/04/26 10:22:48 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012/04/15 19:40:22 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012/04/26 23:35:32 | 000,003,659 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\avg-secure-search.xml
[2012/04/15 19:40:22 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012/04/15 19:40:22 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2012/04/15 19:40:22 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2012/04/15 19:40:22 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012/04/15 19:40:22 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2009/06/10 17:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (Windows 7 Starter Helper) - {D381FF29-7CFB-4D4E-B92A-C4EDDC696614} - C:\Program Files\Oceanis\SystemSetting\StarterHelper.dll (Oceanis)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4 - HKLM..\Run: [Acer ePower Management] C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe (Acer Incorporated)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [EgisTecPMMUpdate] C:\Program Files\EgisTec IPS\PmmUpdate.exe (Egis Technology Inc.)
O4 - HKLM..\Run: [EgisUpdate] C:\Program Files\EgisTec IPS\EgisUpdate.exe (Egis Technology Inc.)
O4 - HKLM..\Run: [FILSHtray] C:\Program Files\FILSHtray\FILSHtray.exe (FILSH Media GmbH)
O4 - HKLM..\Run: [LManager] C:\Program Files\Launch Manager\LManager.exe (Dritek System Inc.)
O4 - HKLM..\Run: [mwlDaemon] C:\Program Files\EgisTec MyWinLocker\x86\mwlDaemon.exe (Egis Technology Inc.)
O4 - HKLM..\Run: [Norton Online Backup] C:\Program Files\Symantec\Norton Online Backup\NOBuClient.exe (Symantec Corporation)
O4 - HKLM..\Run: [SuiteTray] C:\Program Files\EgisTec MyWinLockerSuite\x86\SuiteTray.exe (Egis Technology Inc.)
O4 - HKU\S-1-5-21-554268580-2193171868-296834247-1000..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background File not found
O4 - HKU\S-1-5-21-554268580-2193171868-296834247-1000..\Run: [Steam] C:\Program Files\Steam\Steam.exe (Valve Corporation)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Nino\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O9 - Extra Button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe (PokerStars)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{0DBFD4F9-63FE-4A8B-843D-CB900932C2A0}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{328B426D-7B3A-469C-8DC1-C6E9B42C0B5A}: NameServer = 200.63.56.3 200.63.56.4
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Acer\Acer VCM\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKU\S-1-5-21-554268580-2193171868-296834247-1000 Winlogon: Shell - (C:\Program Files\Oceanis\SystemSetting\WallPaperAgent.exe) - C:\Program Files\Oceanis\SystemSetting\WallPaperAgent.exe (Oceanis)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 17:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - Unable to obtain root file information for disk D:\
O33 - MountPoints2\{46241447-977b-11e0-8d4a-1c7508c78a28}\Shell - "" = AutoRun
O33 - MountPoints2\{46241447-977b-11e0-8d4a-1c7508c78a28}\Shell\AutoRun\command - "" = D:\AutoRun.exe
O33 - MountPoints2\{4624146d-977b-11e0-8d4a-1c7508c78a28}\Shell - "" = AutoRun
O33 - MountPoints2\{4624146d-977b-11e0-8d4a-1c7508c78a28}\Shell\AutoRun\command - "" = D:\AutoRun.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG2012\avgrsx.exe /sync /restart)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
 
SafeBootMin: AppMgmt - Service
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: MCODS - Reg Error: Value error.
SafeBootMin: NTDS -  File not found
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vmms - Service
SafeBootMin: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet: AppMgmt - Service
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: MCODS - Reg Error: Value error.
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: NTDS -  File not found
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vmms - Service
SafeBootNet: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CE4BC71D-A88B-4943-BB3D-AF9C0E7D4387} - .NET Framework
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012/04/27 12:05:18 | 000,000,000 | ---D | C] -- C:\Users\Nino\Desktop\Reise 2011
[2012/04/27 10:11:01 | 000,000,000 | ---D | C] -- C:\Program Files\ESET
[2012/04/26 23:03:22 | 000,000,000 | -H-D | C] -- C:\ProgramData\Common Files
[2012/04/26 23:01:11 | 000,000,000 | ---D | C] -- C:\ProgramData\AVG2012
[2012/04/26 22:59:32 | 000,000,000 | ---D | C] -- C:\Program Files\AVG
[2012/04/26 22:53:20 | 000,000,000 | ---D | C] -- C:\ProgramData\MFAData
[2012/04/26 14:39:57 | 000,000,000 | ---D | C] -- C:\Users\Nino\Desktop\DCIM
[2012/04/26 14:24:37 | 000,000,000 | ---D | C] -- C:\Users\Nino\Desktop\Musica Schwenkes
[2012/04/26 10:23:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Mozilla
[2012/04/26 10:22:59 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Maintenance Service
[2012/04/25 12:36:48 | 000,000,000 | ---D | C] -- C:\Users\Nino\Desktop\Problembehebung
[2012/04/23 16:26:01 | 000,000,000 | ---D | C] -- C:\Users\Nino\AppData\Roaming\Malwarebytes
[2012/04/23 16:24:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012/04/23 16:24:52 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012/04/23 16:24:47 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2012/04/23 16:24:46 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012/04/23 11:25:40 | 000,000,000 | ---D | C] -- C:\Users\Nino\Desktop\Facebook 2
[2012/04/20 17:30:19 | 000,000,000 | ---D | C] -- C:\Users\Nino\Desktop\Velotour
[2012/04/16 11:02:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2012/04/16 11:00:31 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[2012/04/16 10:52:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
[2012/04/16 10:51:45 | 000,000,000 | ---D | C] -- C:\Program Files\QuickTime
[2012/04/09 23:39:21 | 000,000,000 | ---D | C] -- C:\Program Files\Oceanis
[2012/04/08 03:47:16 | 000,000,000 | ---D | C] -- C:\Users\Nino\Desktop\Alter Aila Genesis
[2012/04/08 03:43:35 | 000,000,000 | ---D | C] -- C:\Users\Nino\Documents\OpenTTD
[2012/04/07 22:16:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenTTD
[2012/04/07 22:15:49 | 000,000,000 | ---D | C] -- C:\Program Files\OpenTTD
[2012/04/01 13:21:58 | 000,000,000 | ---D | C] -- C:\Users\Nino\Desktop\Rusko
[11 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012/04/28 10:03:01 | 000,000,838 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/04/28 09:54:59 | 000,009,696 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/04/28 09:54:59 | 000,009,696 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/04/28 09:46:55 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012/04/28 09:46:51 | 796,729,344 | -HS- | M] () -- C:\hiberfil.sys
[2012/04/27 12:14:50 | 000,003,351 | ---- | M] () -- C:\Users\Nino\.recently-used.xbel
[2012/04/24 17:31:18 | 000,000,000 | ---- | M] () -- C:\Users\Nino\defogger_reenable
[2012/04/21 13:50:44 | 000,693,898 | ---- | M] () -- C:\Windows\System32\perfh00A.dat
[2012/04/21 13:50:44 | 000,616,452 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012/04/21 13:50:44 | 000,137,248 | ---- | M] () -- C:\Windows\System32\perfc00A.dat
[2012/04/21 13:50:44 | 000,106,574 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012/04/20 23:06:34 | 003,697,153 | ---- | M] () -- C:\Users\Nino\Desktop\Nek - Laura non c'e ( ALLE Verhörer!! ).mp3
[2012/04/16 11:05:25 | 000,677,003 | ---- | M] () -- C:\Users\Nino\Desktop\bildschirm.xcf
[2012/04/16 11:02:29 | 000,001,717 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk
[2012/04/16 10:45:03 | 004,873,185 | ---- | M] () -- C:\Users\Nino\Desktop\Joan Osborne - One of Us.mp3
[2012/04/14 23:47:39 | 000,684,566 | ---- | M] () -- C:\Users\Nino\Desktop\darth vader & luke.jpeg
[2012/04/14 21:34:54 | 000,086,855 | ---- | M] () -- C:\Users\Nino\Desktop\winnie the poo.jpg
[2012/04/14 18:41:12 | 000,001,948 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader 9.lnk
[2012/04/11 11:32:48 | 000,234,334 | ---- | M] () -- C:\Users\Nino\Desktop\colocolo mit drupi.jpg
[2012/04/10 12:21:21 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_Kernel_netaapl_01009.Wdf
[2012/04/07 22:16:32 | 000,000,913 | ---- | M] () -- C:\Users\Public\Desktop\OpenTTD.lnk
[2012/04/04 15:56:40 | 000,022,344 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2012/04/02 16:17:54 | 000,017,408 | ---- | M] () -- C:\Users\Nino\AppData\Local\WebpageIcons.db
[11 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012/04/27 12:14:50 | 000,003,351 | ---- | C] () -- C:\Users\Nino\.recently-used.xbel
[2012/04/24 17:31:18 | 000,000,000 | ---- | C] () -- C:\Users\Nino\defogger_reenable
[2012/04/24 08:59:47 | 000,000,838 | ---- | C] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/04/16 11:05:25 | 000,677,003 | ---- | C] () -- C:\Users\Nino\Desktop\bildschirm.xcf
[2012/04/16 11:02:29 | 000,001,717 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk
[2012/04/16 10:41:58 | 004,873,185 | ---- | C] () -- C:\Users\Nino\Desktop\Joan Osborne - One of Us.mp3
[2012/04/15 16:59:02 | 003,697,153 | ---- | C] () -- C:\Users\Nino\Desktop\Nek - Laura non c'e ( ALLE Verhörer!! ).mp3
[2012/04/14 23:47:32 | 000,684,566 | ---- | C] () -- C:\Users\Nino\Desktop\darth vader & luke.jpeg
[2012/04/14 21:34:39 | 000,086,855 | ---- | C] () -- C:\Users\Nino\Desktop\winnie the poo.jpg
[2012/04/14 18:41:12 | 000,001,948 | ---- | C] () -- C:\Users\Public\Desktop\Adobe Reader 9.lnk
[2012/04/11 11:30:16 | 000,234,334 | ---- | C] () -- C:\Users\Nino\Desktop\colocolo mit drupi.jpg
[2012/04/10 12:21:21 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_Kernel_netaapl_01009.Wdf
[2012/04/09 23:39:28 | 000,001,968 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Oceanis Change Background W7.lnk
[2012/04/07 22:16:32 | 000,000,913 | ---- | C] () -- C:\Users\Public\Desktop\OpenTTD.lnk
[2012/03/26 23:07:46 | 000,000,017 | ---- | C] () -- C:\Windows\System32\shortcut_ex.dat
[2011/10/19 15:45:32 | 000,017,408 | ---- | C] () -- C:\Users\Nino\AppData\Local\WebpageIcons.db
[2011/04/10 22:38:09 | 000,004,096 | ---- | C] () -- C:\Windows\d3dx.dat
[2011/04/10 22:37:48 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat
[2011/02/14 14:44:08 | 000,693,898 | ---- | C] () -- C:\Windows\System32\perfh00A.dat
[2011/02/14 14:44:08 | 000,341,432 | ---- | C] () -- C:\Windows\System32\perfi00A.dat
[2011/02/14 14:44:08 | 000,137,248 | ---- | C] () -- C:\Windows\System32\perfc00A.dat
[2011/02/14 14:44:08 | 000,041,390 | ---- | C] () -- C:\Windows\System32\perfd00A.dat
[2011/01/11 13:10:29 | 000,131,984 | ---- | C] () -- C:\ProgramData\FullRemove.exe
[2011/01/11 13:00:47 | 000,247,560 | ---- | C] () -- C:\Windows\System32\drivers\RTConvEQ.dat
[2011/01/11 13:00:47 | 000,039,672 | ---- | C] () -- C:\Windows\System32\drivers\RtPCEE3.DAT
[2011/01/11 13:00:47 | 000,016,406 | ---- | C] () -- C:\Windows\System32\drivers\RtPCEE4.DAT
[2011/01/11 13:00:47 | 000,001,448 | ---- | C] () -- C:\Windows\System32\drivers\RtHdatEx.dat
[2011/01/11 13:00:47 | 000,000,520 | ---- | C] () -- C:\Windows\System32\drivers\RTEQEX3.dat
[2011/01/11 13:00:47 | 000,000,520 | ---- | C] () -- C:\Windows\System32\drivers\RTEQEX2.dat
[2011/01/11 13:00:47 | 000,000,520 | ---- | C] () -- C:\Windows\System32\drivers\RTEQEX1.dat
[2011/01/11 13:00:47 | 000,000,520 | ---- | C] () -- C:\Windows\System32\drivers\RTEQEX0.dat
[2011/01/11 13:00:47 | 000,000,176 | ---- | C] () -- C:\Windows\System32\drivers\RTHDAEQ1.dat
[2011/01/11 13:00:47 | 000,000,032 | ---- | C] () -- C:\Windows\System32\drivers\rtkhdaud.dat
[2011/01/11 12:09:54 | 000,361,808 | ---- | C] () -- C:\Windows\EMCRI_E.dll
 
========== LOP Check ==========
 
[2012/04/26 00:12:25 | 000,000,000 | ---D | M] -- C:\Users\Nino\AppData\Roaming\BitTorrent
[2011/06/10 14:44:23 | 000,000,000 | ---D | M] -- C:\Users\Nino\AppData\Roaming\DVDVideoSoftIEHelpers
[2012/04/25 18:27:06 | 000,000,000 | ---D | M] -- C:\Users\Nino\AppData\Roaming\gtk-2.0
[2012/04/26 14:31:50 | 000,000,000 | ---D | M] -- C:\Users\Nino\AppData\Roaming\Mp3tag
[2012/02/27 13:23:33 | 000,000,000 | ---D | M] -- C:\Users\Nino\AppData\Roaming\OpenOffice.org
[2012/04/27 20:59:17 | 000,000,000 | ---D | M] -- C:\Users\Nino\AppData\Roaming\SoftGrid Client
[2011/07/12 05:47:39 | 000,000,000 | ---D | M] -- C:\Users\Nino\AppData\Roaming\Sync App Settings
[2012/03/23 11:01:22 | 000,000,000 | ---D | M] -- C:\Users\Nino\AppData\Roaming\Tibia
[2011/04/11 16:00:41 | 000,000,000 | ---D | M] -- C:\Users\Nino\AppData\Roaming\TP
[2012/04/04 12:03:27 | 000,032,546 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2011/04/11 15:55:40 | 000,000,000 | ---D | M] -- C:\Users\Nino\AppData\Roaming\Adobe
[2012/03/09 17:04:57 | 000,000,000 | ---D | M] -- C:\Users\Nino\AppData\Roaming\Apple Computer
[2011/05/23 22:56:52 | 000,000,000 | ---D | M] -- C:\Users\Nino\AppData\Roaming\Avira
[2012/04/26 00:12:25 | 000,000,000 | ---D | M] -- C:\Users\Nino\AppData\Roaming\BitTorrent
[2011/06/10 14:44:23 | 000,000,000 | ---D | M] -- C:\Users\Nino\AppData\Roaming\DVDVideoSoftIEHelpers
[2012/04/25 18:27:06 | 000,000,000 | ---D | M] -- C:\Users\Nino\AppData\Roaming\gtk-2.0
[2011/04/14 03:57:47 | 000,000,000 | ---D | M] -- C:\Users\Nino\AppData\Roaming\Identities
[2011/04/14 03:58:43 | 000,000,000 | ---D | M] -- C:\Users\Nino\AppData\Roaming\Macromedia
[2012/04/23 16:26:01 | 000,000,000 | ---D | M] -- C:\Users\Nino\AppData\Roaming\Malwarebytes
[2012/04/08 04:41:09 | 000,000,000 | --SD | M] -- C:\Users\Nino\AppData\Roaming\Microsoft
[2011/04/15 04:20:27 | 000,000,000 | ---D | M] -- C:\Users\Nino\AppData\Roaming\Mozilla
[2012/04/26 14:31:50 | 000,000,000 | ---D | M] -- C:\Users\Nino\AppData\Roaming\Mp3tag
[2012/02/27 13:23:33 | 000,000,000 | ---D | M] -- C:\Users\Nino\AppData\Roaming\OpenOffice.org
[2012/04/21 23:37:20 | 000,000,000 | ---D | M] -- C:\Users\Nino\AppData\Roaming\Skype
[2012/04/27 20:59:17 | 000,000,000 | ---D | M] -- C:\Users\Nino\AppData\Roaming\SoftGrid Client
[2011/07/12 05:47:39 | 000,000,000 | ---D | M] -- C:\Users\Nino\AppData\Roaming\Sync App Settings
[2012/03/23 11:01:22 | 000,000,000 | ---D | M] -- C:\Users\Nino\AppData\Roaming\Tibia
[2011/04/11 16:00:41 | 000,000,000 | ---D | M] -- C:\Users\Nino\AppData\Roaming\TP
[2011/06/03 13:42:41 | 000,000,000 | ---D | M] -- C:\Users\Nino\AppData\Roaming\vlc
[2011/04/18 10:00:53 | 000,000,000 | ---D | M] -- C:\Users\Nino\AppData\Roaming\WinRAR
 
< %APPDATA%\*.exe /s >
 
< %SYSTEMDRIVE%\*.exe >
 
< MD5 for: AGP440.SYS  >
[2009/07/13 21:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\drivers\AGP440.sys
[2009/07/13 21:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_x86_neutral_a97a2a0d0fbc6696\AGP440.sys
[2009/07/13 21:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_b9e9435f20046eeb\AGP440.sys
[2009/07/13 21:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_bc1a57271cf2f285\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009/07/13 21:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\drivers\atapi.sys
[2009/07/13 21:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_x86_neutral_fab873f3e8a3315c\atapi.sys
[2009/07/13 21:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_dd0e7e3d82dd640d\atapi.sys
[2009/07/13 21:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_df3f92057fcbe7a7\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2009/07/13 21:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\System32\cngaudit.dll
[2009/07/13 21:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
 
< MD5 for: IASTOR.SYS  >
[2010/06/08 14:23:34 | 000,435,736 | ---- | M] (Intel Corporation) MD5=D80AA0907748D7CC8EFAB3773F32629B -- C:\Windows\System32\drivers\iaStor.sys
[2010/06/08 14:23:34 | 000,435,736 | ---- | M] (Intel Corporation) MD5=D80AA0907748D7CC8EFAB3773F32629B -- C:\Windows\System32\DriverStore\FileRepository\iaahci.inf_x86_neutral_20f8d1b2e876a71d\iaStor.sys
 
< MD5 for: IASTORV.SYS  >
[2011/03/11 01:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- C:\Windows\System32\drivers\iaStorV.sys
[2011/03/11 01:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_0bcee2057afcc090\iaStorV.sys
[2011/03/11 01:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_b0daddb9e6380745\iaStorV.sys
[2011/03/11 01:43:55 | 000,332,160 | ---- | M] (Intel Corporation) MD5=71F1A494FEDF4B33C02C4A6A28D6D9E9 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_aef580fde910b4b0\iaStorV.sys
[2011/03/11 01:28:00 | 000,332,160 | ---- | M] (Intel Corporation) MD5=778D0E6D7D9EBA0C403BADBAAD41DB20 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_b152a892ff64119f\iaStorV.sys
[2009/07/13 21:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_aee7a89be91b9000\iaStorV.sys
[2010/11/20 08:29:54 | 000,332,160 | ---- | M] (Intel Corporation) MD5=A3CAE5D281DB4CFF7CFF8233507EE5AD -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_668286aa35d55928\iaStorV.sys
[2010/11/20 08:29:54 | 000,332,160 | ---- | M] (Intel Corporation) MD5=A3CAE5D281DB4CFF7CFF8233507EE5AD -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_b118bc63e60a139a\iaStorV.sys
[2011/03/11 01:52:21 | 000,332,160 | ---- | M] (Intel Corporation) MD5=B9039A34C2F8769490DCC494E2402445 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_afae2d45020c148b\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2010/11/20 08:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\System32\netlogon.dll
[2010/11/20 08:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_ffbf212e963c0162\netlogon.dll
[2009/07/13 21:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_fd8e0d66994d7dc8\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2011/03/11 01:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- C:\Windows\System32\drivers\nvstor.sys
[2011/03/11 01:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_0276fc3b3ea60d41\nvstor.sys
[2011/03/11 01:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_3ba44e691d6eb11d\nvstor.sys
[2011/03/11 01:44:01 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4520B63899E867F354EE012D34E11536 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_39bef1ad20475e88\nvstor.sys
[2011/03/11 01:28:10 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=66D468654A58594F5F3BA63D5AD5B1AF -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_3c1c1942369abb77\nvstor.sys
[2011/03/11 01:52:25 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=8A7583A3B58D3EEB28BB26626526BC91 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_3a779df43942be63\nvstor.sys
[2010/11/20 08:30:06 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=9283C58EBAA2618F93482EB5DABCEC82 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_dd659ed032d28a14\nvstor.sys
[2010/11/20 08:30:06 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=9283C58EBAA2618F93482EB5DABCEC82 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_3be22d131d40bd72\nvstor.sys
[2009/07/13 21:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_39b1194b205239d8\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2009/07/13 21:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_37e4387f3a6f0483\scecli.dll
[2010/11/20 08:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\System32\scecli.dll
[2010/11/20 08:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_3a154c47375d881d\scecli.dll
 
< MD5 for: USER32.DLL  >
[2009/07/13 21:16:17 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=34B7E222E81FAFA885F0C5F2CFA56861 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_cd0ec264ceb014a3\user32.dll
[2010/11/20 08:21:33 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 -- C:\Windows\System32\user32.dll
[2010/11/20 08:21:33 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_cf3fd62ccb9e983d\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2010/11/20 08:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\System32\userinit.exe
[2010/11/20 08:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2009/07/13 21:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
 
< MD5 for: WININIT.EXE  >
[2009/07/13 21:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\System32\wininit.exe
[2009/07/13 21:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2012/04/04 15:56:38 | 000,199,240 | ---- | M] () MD5=097D0E812D7A9A3101CE46CB2BE0474D -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2010/07/14 07:01:28 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_6fc699643622d177\winlogon.exe
[2010/07/14 07:01:28 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=3BABE6767C78FBF5FB8435FEED187F30 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_703394514f56f7c2\winlogon.exe
[2010/11/20 08:17:54 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\System32\winlogon.exe
[2010/11/20 08:17:54 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_71ca6b0233339500\winlogon.exe
[2009/07/13 21:14:45 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=8EC6A4AB12B8F3759E21F8E3A388F2CF -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_6f99573a36451166\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2009/07/13 19:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\System32\drivers\ws2ifsl.sys
[2009/07/13 19:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_4f5cf6f829213bb2\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
[11 C:\Windows\system32\*.tmp files -> C:\Windows\system32\*.tmp -> ]
 
<           >
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 149 bytes -> C:\ProgramData\TEMP:CDFF58FE
@Alternate Data Stream - 144 bytes -> C:\ProgramData\TEMP:5D7E5A8F
@Alternate Data Stream - 140 bytes -> C:\ProgramData\TEMP:4D066AD2
@Alternate Data Stream - 135 bytes -> C:\ProgramData\TEMP:E36F5B57
@Alternate Data Stream - 129 bytes -> C:\ProgramData\TEMP:E1F04E8D
@Alternate Data Stream - 121 bytes -> C:\ProgramData\TEMP:0B9176C0

< End of report >
         

e: Nur otl.txt merk ich grad.

Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

:OTL
IE - HKLM\..\SearchScopes\{1645A33F-0A96-4315-904E-29E188E7720E}: "URL" = http://startsear.ch/?q={searchTerms}
FF - prefs.js..browser.search.defaultengine: "http://startsear.ch/?q="
FF - prefs.js..browser.search.defaultenginename: "http://startsear.ch/?q="
FF - prefs.js..browser.search.order.1: "http://startsear.ch/?q="
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://startsear.ch"
FF - prefs.js..keyword.URL: "http://startsear.ch/?q="
FF - prefs.js..network.proxy.backup.ftp: ""
FF - prefs.js..network.proxy.backup.ftp_port: 0
FF - prefs.js..network.proxy.backup.socks: ""
FF - prefs.js..network.proxy.backup.socks_port: 0
FF - prefs.js..network.proxy.backup.ssl: "83.137.26.25"
FF - prefs.js..network.proxy.backup.ssl_port: 0
FF - prefs.js..network.proxy.ftp: "81.63.140.37"
FF - prefs.js..network.proxy.ftp_port: 3128
FF - prefs.js..network.proxy.http: "81.63.140.37"
FF - prefs.js..network.proxy.http_port: 3128
FF - prefs.js..network.proxy.share_proxy_settings: true
FF - prefs.js..network.proxy.socks: "81.63.140.37"
FF - prefs.js..network.proxy.socks_port: 3128
FF - prefs.js..network.proxy.ssl: "81.63.140.37"
FF - prefs.js..network.proxy.ssl_port: 3128
FF - prefs.js..network.proxy.type: 4
FF - user.js - File not found
[2011/05/18 09:06:52 | 000,000,632 | ---- | M] () -- C:\Users\Nino\AppData\Roaming\Mozilla\Firefox\Profiles\bh7r0qcs.default\searchplugins\startsear.xml
[2011/06/01 15:28:53 | 000,001,597 | ---- | M] () -- C:\Users\Nino\AppData\Roaming\Mozilla\Firefox\Profiles\bh7r0qcs.default\searchplugins\the-pirate-bay.xml
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 17:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - Unable to obtain root file information for disk D:\
O33 - MountPoints2\{46241447-977b-11e0-8d4a-1c7508c78a28}\Shell - "" = AutoRun
O33 - MountPoints2\{46241447-977b-11e0-8d4a-1c7508c78a28}\Shell\AutoRun\command - "" = D:\AutoRun.exe
O33 - MountPoints2\{4624146d-977b-11e0-8d4a-1c7508c78a28}\Shell - "" = AutoRun
O33 - MountPoints2\{4624146d-977b-11e0-8d4a-1c7508c78a28}\Shell\AutoRun\command - "" = D:\AutoRun.exe
@Alternate Data Stream - 149 bytes -> C:\ProgramData\TEMP:CDFF58FE
@Alternate Data Stream - 144 bytes -> C:\ProgramData\TEMP:5D7E5A8F
@Alternate Data Stream - 140 bytes -> C:\ProgramData\TEMP:4D066AD2
@Alternate Data Stream - 135 bytes -> C:\ProgramData\TEMP:E36F5B57
@Alternate Data Stream - 129 bytes -> C:\ProgramData\TEMP:E1F04E8D
@Alternate Data Stream - 121 bytes -> C:\ProgramData\TEMP:0B9176C0
:Files
:Files
D:\*.lnk
D:\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665
:Commands
[purity]
[emptytemp]
[emptyflash]
[resethosts]
         

Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!