Also zuallererst hatte ich eine Polizeimeldung am Bildschirm bei der man von mir 100€ verlangte ich rief die Polizei an und erkundigte mich was es damit auf sich habe.
Doch diese ging durch ein und ausschalten wieder "weg".
Ein Freund empfahl mir Anti Malware zu Installieren und zu Scannen wo der Virus bzw Trojaner dann in Quarantäne gesteckt wurde, er meinte einfach auf entfernen klicken.
Das tat ich dann auch und es war ruhe dachte ich jedenfalls. (Ich muss sagen ich hatte noch nie Kontakt mit Viren oder so)

bis jetzt ca 1 Monat dannach

Beim Surfen kam plötzlich ein weißer Bildschirm wo stand "Die Webseite kann nicht angezeigt werden".
Erst dachte ich es wäre ein Fehler in der Internetverbindung und versuchte am zweiten Bildschirm wieder zum Desktop zurück zu kehren das funktionierte jedoch nicht.
Darum rief ich den Task Manager auf der lies sich auch aufrufen aber nur für 1 oder 2 Sekunden bis er wieder verschwand.

Jetzt riet mir ein Freund mit F8 im gesicherten Modus hochzufahren
Doch auch das in jeder angebotenen Version funktionierte nicht
Es kam immer ein Blue Screen mit der Warnung das der Computer nicht hochgefahren würde um die Dateien vor Schädigung zu schützen da Viren auf der Festplatte sind.

Jetzt haben wir die Festplatte abgesteckt eine neue eingebaut und ein neues Betriebssystem installiert um die andere als Slave zu scannen.

Es wurde jedoch nichts gefunden.


Jetzt hat Stinger bei einem Scan wieder etwas auf der neuen festplatte entdeckt nachdem ich meine Daten gesichert hatte.

und zwar den Generic-FRAX!EF3DA767ACD3 trojan
in Windows\Setup\scripts\Addons\WinRAR.sfx.exe\WINRAR.EXE

und es konnte nicht entfernt werden

bitte wie bekomme ich den bzw die Trojaner wieder weg ? und wie bereinige ich meine Daten denn ich denke von daher kommt er jetzt.

Der vorige war vermutlich vom Surfen oder diesen Mails von denen ich einige erhalten hatte.

Die Daten selber sind nicht umbenannt oder so wie es bei dem Verschlüsselungstrojaner zu sein scheint ich habe sie ganz normal "auslesen" können von der anderen Festplatte. (Wobei ich dazu sagen muss sogar trotz meines Passwords.

Es wäre geplant gewesen diese dann entweder zu bereinigen oder zu formatieren wobei mir vermutlich Passwörter und Kennwörter verloren gehen aber die kann man ja leicht wieder erneuern.

Bitte um schnelle Antwort denn wenn der Computer zu macht wie beim ersten bzw zweiten mal habe ich keine Möglichkeiten mehr ins Internet zu kommen Danke

Ach ja ich hatte ein Windows XP auf der einen Festplatte
und jetzt Windows 7 auf der zweiten

Das erste Ergebnis


Malwarebytes Anti-Malware (Test) 1.62.0.1300
www.malwarebytes.org

Datenbank Version: v2012.07.31.11

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Sonja :: SONJA-PC [Administrator]

Schutz: Aktiviert

01.08.2012 20:05:19
mbam-log-2012-08-01 (20-05-19).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|F:\|G:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 383331
Laufzeit: 53 Minute(n), 52 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)

die zweite Festplatte also F ist die mit dem alten System.....

OTL Logfile:

OTL logfile created on: 01.08.2012 21:18:52 - Run 2
OTL by OldTimer - Version 3.2.55.0     Folder = C:\Users\Sonja\Downloads
64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000c07 | Country: Österreich | Language: DEA | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 1,18 Gb Available Physical Memory | 59,26% Memory free
4,00 Gb Paging File | 2,91 Gb Available in Paging File | 72,80% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 76,59 Gb Total Space | 7,13 Gb Free Space | 9,32% Space Free | Partition Type: NTFS
Drive E: | 8,37 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
Drive F: | 149,04 Gb Total Space | 79,22 Gb Free Space | 53,15% Space Free | Partition Type: NTFS
 
Computer Name: SONJA-PC | User Name: Sonja | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.08.01 21:08:47 | 000,597,504 | ---- | M] (OldTimer Tools) -- C:\Users\Sonja\Downloads\OTL (1).exe
PRC - [2012.07.03 13:46:44 | 000,655,944 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2012.07.03 13:46:44 | 000,462,920 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
 
 
========== Modules (No Company Name) ==========
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - [2012.01.02 07:54:45 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)
SRV:64bit: - [2009.07.13 20:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend)
SRV - [2012.07.31 23:33:36 | 000,008,192 | ---- | M] () [Auto | Stopped] -- C:\Windows\SysWOW64\srvany.exe -- (KMService)
SRV - [2012.07.31 03:36:42 | 000,253,600 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012.07.03 13:46:44 | 000,655,944 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2011.06.27 10:02:00 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009.06.10 16:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2012.07.03 13:46:44 | 000,024,904 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)
DRV:64bit: - [2012.03.01 01:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2012.01.02 12:08:50 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2012.01.02 12:08:50 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2012.01.02 07:32:06 | 000,088,960 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Synth3dVsc.sys -- (Synth3dVsc)
DRV:64bit: - [2010.11.20 22:24:43 | 000,020,992 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
DRV:64bit: - [2010.11.20 22:24:33 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.11.20 22:23:48 | 000,117,248 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\tsusbhub.sys -- (tsusbhub)
DRV:64bit: - [2010.11.20 22:23:48 | 000,071,168 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\dmvsc.sys -- (dmvsc)
DRV:64bit: - [2010.11.20 22:23:48 | 000,034,816 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\terminpt.sys -- (terminpt)
DRV:64bit: - [2010.11.20 22:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.20 22:23:47 | 000,031,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD)
DRV:64bit: - [2009.07.13 20:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.13 20:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.13 20:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.06.10 15:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 15:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 15:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 15:34:21 | 000,034,304 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\l260x64.sys -- (Atc002)
DRV:64bit: - [2009.06.10 15:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2007.08.08 12:10:24 | 000,112,512 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ewusbmdm.sys -- (hwdatacard)
DRV:64bit: - [2005.03.29 01:30:38 | 000,008,192 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ASACPI.sys -- (MTsensor)
DRV - [2009.07.13 20:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://google.at/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://at.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-AT
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = DA 02 EB 27 BF 6E CD 01  [binary data]
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
========== FireFox ==========
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_2_202_160.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre7\bin\new_plugin\npjp2.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\Program Files\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_160.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre7\bin\new_plugin\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\Program Files (x86)\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\Program Files (x86)\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.450: C:\Program Files (x86)\Real Alternative\browser\plugins\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.448: C:\Program Files (x86)\Real Alternative\browser\plugins\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=:  File not found
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Sonja\AppData\Local\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Sonja\AppData\Local\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
 
 
 
========== Chrome  ==========
 
CHR - homepage: 
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}
CHR - homepage: 
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\Sonja\AppData\Local\Google\Chrome\Application\20.0.1132.57\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\Sonja\AppData\Local\Google\Chrome\Application\20.0.1132.57\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Sonja\AppData\Local\Google\Chrome\Application\20.0.1132.57\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_160.dll
CHR - plugin: Java(TM) Platform SE 7 U2 (Enabled) = C:\Program Files (x86)\Java\jre7\bin\new_plugin\npjp2.dll
CHR - plugin: RealPlayer(tm) G2 LiveConnect-Enabled Plug-In (32-bit)  (Enabled) = C:\Program Files (x86)\Real Alternative\browser\plugins\nppl3260.dll
CHR - plugin: RealPlayer Version Plugin (Enabled) = C:\Program Files (x86)\Real Alternative\browser\plugins\nprpjplug.dll
CHR - plugin: Google Update (Enabled) = C:\Users\Sonja\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll
CHR - Extension: YouTube = C:\Users\Sonja\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Google-Suche = C:\Users\Sonja\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: Google Mail = C:\Users\Sonja\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\
 
O1 HOSTS File: ([2009.06.10 16:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\MICROS~1\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)
O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\MICROS~3\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\MICROS~3\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [TrojanScanner] C:\Program Files (x86)\Trojan Remover\Trjscan.exe (Simply Super Software)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoInternetOpenWith = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: MemCheckboxinRunDlg = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveTrack = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoControlPanel = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: SynchronousMachineGroupPolicy = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: SynchronousUserGroupPolicy = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: verbosestatus = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLowDiskSpaceChecks = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveSearch = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveTrack = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoInternetOpenWith = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8:64bit: - Extra context menu item: An OneNote s&enden - res://C:\Program Files (x86)\MICROS~3\Office14\ONBttnIE.dll/105 File not found
O8:64bit: - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\Program Files (x86)\MICROS~3\Office14\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: An OneNote s&enden - res://C:\Program Files (x86)\MICROS~3\Office14\ONBttnIE.dll/105 File not found
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\Program Files (x86)\MICROS~3\Office14\EXCEL.EXE/3000 File not found
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_02-windows-i586.cab (Java Plug-in 10.2.0)
O16:64bit: - DPF: {CAFEEFAC-0017-0000-0002-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_02-windows-i586.cab (Java Plug-in 1.7.0_02)
O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_02-windows-i586.cab (Java Plug-in 1.7.0_02)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_02-windows-i586.cab (Java Plug-in 10.2.0)
O16 - DPF: {CAFEEFAC-0017-0000-0002-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_02-windows-i586.cab (Java Plug-in 1.7.0_02)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_02-windows-i586.cab (Java Plug-in 1.7.0_02)
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O28:64bit: - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\MICROS~1\Office14\GROOVEEX.DLL (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files (x86)\MICROS~3\Office14\GROOVEEX.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008.02.14 14:27:52 | 000,106,496 | R--- | M] (Huawei Technologies Co., Ltd.) - E:\AutoRun.exe -- [ CDFS ]
O32 - AutoRun File - [2006.07.10 13:15:18 | 000,000,046 | R--- | M] () - E:\AUTORUN.INF -- [ CDFS ]
O32 - AutoRun File - [2008.01.14 12:18:35 | 000,000,000 | ---- | M] () - F:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{1434f2ef-daeb-11e1-a25b-001d607596b2}\Shell - "" = AutoRun
O33 - MountPoints2\{1434f2ef-daeb-11e1-a25b-001d607596b2}\Shell\AutoRun\command - "" = E:\AutoRun.exe -- [2008.02.14 14:27:52 | 000,106,496 | R--- | M] (Huawei Technologies Co., Ltd.)
O33 - MountPoints2\{1434f2f9-daeb-11e1-a25b-001d607596b2}\Shell - "" = AutoRun
O33 - MountPoints2\{1434f2f9-daeb-11e1-a25b-001d607596b2}\Shell\AutoRun\command - "" = E:\AutoRun.exe -- [2008.02.14 14:27:52 | 000,106,496 | R--- | M] (Huawei Technologies Co., Ltd.)
O33 - MountPoints2\{1434f2fe-daeb-11e1-a25b-001d607596b2}\Shell - "" = AutoRun
O33 - MountPoints2\{1434f2fe-daeb-11e1-a25b-001d607596b2}\Shell\AutoRun\command - "" = E:\AutoRun.exe -- [2008.02.14 14:27:52 | 000,106,496 | R--- | M] (Huawei Technologies Co., Ltd.)
O33 - MountPoints2\{1434f305-daeb-11e1-a25b-001d607596b2}\Shell - "" = AutoRun
O33 - MountPoints2\{1434f305-daeb-11e1-a25b-001d607596b2}\Shell\AutoRun\command - "" = E:\AutoRun.exe -- [2008.02.14 14:27:52 | 000,106,496 | R--- | M] (Huawei Technologies Co., Ltd.)
O33 - MountPoints2\{d5db540f-daeb-11e1-87b8-001d607596b2}\Shell - "" = AutoRun
O33 - MountPoints2\{d5db540f-daeb-11e1-87b8-001d607596b2}\Shell\AutoRun\command - "" = E:\AutoRun.exe -- [2008.02.14 14:27:52 | 000,106,496 | R--- | M] (Huawei Technologies Co., Ltd.)
O33 - MountPoints2\{d5db541f-daeb-11e1-87b8-001d607596b2}\Shell - "" = AutoRun
O33 - MountPoints2\{d5db541f-daeb-11e1-87b8-001d607596b2}\Shell\AutoRun\command - "" = E:\AutoRun.exe -- [2008.02.14 14:27:52 | 000,106,496 | R--- | M] (Huawei Technologies Co., Ltd.)
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.08.01 19:11:51 | 000,000,000 | ---D | C] -- C:\ProgramData\TEMP
[2012.08.01 19:08:50 | 000,000,000 | ---D | C] -- C:\Users\Sonja\Documents\Simply Super Software
[2012.08.01 19:08:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Trojan Remover
[2012.08.01 19:08:42 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Trojan Remover
[2012.08.01 19:08:42 | 000,000,000 | ---D | C] -- C:\Users\Sonja\AppData\Roaming\Simply Super Software
[2012.08.01 19:08:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Simply Super Software
[2012.08.01 03:10:04 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2012.08.01 00:45:01 | 000,000,000 | R--D | C] -- C:\Users\Sonja\Desktop\Gesicherte Dateien
[2012.08.01 00:20:53 | 000,016,200 | ---- | C] (McAfee, Inc.) -- C:\Windows\stinger.sys
[2012.08.01 00:20:00 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\stinger
[2012.08.01 00:02:25 | 000,000,000 | ---D | C] -- C:\Users\Sonja\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Perception
[2012.08.01 00:02:25 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Perception
[2012.07.31 23:27:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SharePoint
[2012.07.31 23:27:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
[2012.07.31 23:25:08 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Synchronization Services
[2012.07.31 23:25:06 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\DESIGNER
[2012.07.31 23:24:34 | 000,000,000 | ---D | C] -- C:\Windows\PCHEALTH
[2012.07.31 23:24:34 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Sync Framework
[2012.07.31 23:24:34 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft SQL Server Compact Edition
[2012.07.31 23:21:08 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Visual Studio 8
[2012.07.31 23:20:22 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Office
[2012.07.31 23:19:56 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Analysis Services
[2012.07.31 23:18:54 | 000,000,000 | ---D | C] -- C:\Users\Sonja\AppData\Local\Microsoft Help
[2012.07.31 23:18:23 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Office
[2012.07.31 23:18:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft Help
[2012.07.31 23:17:36 | 000,000,000 | RH-D | C] -- C:\MSOCache
[2012.07.31 13:35:36 | 000,000,000 | ---D | C] -- C:\Users\Sonja\AppData\Local\Microsoft Games
[2012.07.31 05:58:16 | 000,000,000 | ---D | C] -- C:\Windows\Panther
[2012.07.31 03:50:47 | 000,112,512 | ---- | C] (Huawei Technologies Co., Ltd.) -- C:\Windows\SysNative\drivers\ewusbmdm.sys
[2012.07.31 03:50:47 | 000,029,696 | ---- | C] (Huawei Tech. Co., Ltd.) -- C:\Windows\SysNative\drivers\ewdcsc.sys
[2012.07.31 03:50:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mobile Connect
[2012.07.31 03:50:22 | 000,000,000 | -H-D | C] -- C:\Program Files (x86)\InstallShield Installation Information
[2012.07.31 03:50:22 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Huawei technologies
[2012.07.31 03:49:45 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\InstallShield
[2012.07.31 03:48:21 | 000,000,000 | R--D | C] -- C:\Users\Sonja\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
[2012.07.31 03:48:21 | 000,000,000 | R--D | C] -- C:\Users\Sonja\Searches
[2012.07.31 03:48:21 | 000,000,000 | R--D | C] -- C:\Users\Sonja\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
[2012.07.31 03:48:20 | 000,000,000 | -H-D | C] -- C:\Users\Sonja\Application Data\Microsoft\Internet Explorer\Quick Launch\User Pinned
[2012.07.31 03:47:56 | 000,000,000 | ---D | C] -- C:\Users\Sonja\AppData\Roaming\Identities
[2012.07.31 03:47:27 | 000,000,000 | R--D | C] -- C:\Users\Sonja\Contacts
[2012.07.31 03:46:25 | 000,000,000 | -HSD | C] -- C:\Users\Sonja\AppData\Local\Temporary Internet Files
[2012.07.31 03:46:25 | 000,000,000 | -HSD | C] -- C:\Users\Sonja\Templates
[2012.07.31 03:46:25 | 000,000,000 | -HSD | C] -- C:\Users\Sonja\Start Menu
[2012.07.31 03:46:25 | 000,000,000 | -HSD | C] -- C:\Users\Sonja\SendTo
[2012.07.31 03:46:25 | 000,000,000 | -HSD | C] -- C:\Users\Sonja\Recent
[2012.07.31 03:46:25 | 000,000,000 | -HSD | C] -- C:\Users\Sonja\PrintHood
[2012.07.31 03:46:25 | 000,000,000 | -HSD | C] -- C:\Users\Sonja\NetHood
[2012.07.31 03:46:25 | 000,000,000 | -HSD | C] -- C:\Users\Sonja\Documents\My Videos
[2012.07.31 03:46:25 | 000,000,000 | -HSD | C] -- C:\Users\Sonja\Documents\My Pictures
[2012.07.31 03:46:25 | 000,000,000 | -HSD | C] -- C:\Users\Sonja\Documents\My Music
[2012.07.31 03:46:25 | 000,000,000 | -HSD | C] -- C:\Users\Sonja\My Documents
[2012.07.31 03:46:25 | 000,000,000 | -HSD | C] -- C:\Users\Sonja\Local Settings
[2012.07.31 03:46:25 | 000,000,000 | -HSD | C] -- C:\Users\Sonja\AppData\Local\History
[2012.07.31 03:46:25 | 000,000,000 | -HSD | C] -- C:\Users\Sonja\Cookies
[2012.07.31 03:46:25 | 000,000,000 | -HSD | C] -- C:\Users\Sonja\Application Data
[2012.07.31 03:46:25 | 000,000,000 | -HSD | C] -- C:\Users\Sonja\AppData\Local\Application Data
[2012.07.31 03:46:23 | 000,000,000 | --SD | C] -- C:\Users\Sonja\AppData\Roaming\Microsoft
[2012.07.31 03:46:23 | 000,000,000 | R--D | C] -- C:\Users\Sonja\Videos
[2012.07.31 03:46:23 | 000,000,000 | R--D | C] -- C:\Users\Sonja\Saved Games
[2012.07.31 03:46:23 | 000,000,000 | R--D | C] -- C:\Users\Sonja\Pictures
[2012.07.31 03:46:23 | 000,000,000 | R--D | C] -- C:\Users\Sonja\Music
[2012.07.31 03:46:23 | 000,000,000 | R--D | C] -- C:\Users\Sonja\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
[2012.07.31 03:46:23 | 000,000,000 | R--D | C] -- C:\Users\Sonja\Links
[2012.07.31 03:46:23 | 000,000,000 | R--D | C] -- C:\Users\Sonja\Favorites
[2012.07.31 03:46:23 | 000,000,000 | R--D | C] -- C:\Users\Sonja\Downloads
[2012.07.31 03:46:23 | 000,000,000 | R--D | C] -- C:\Users\Sonja\Documents
[2012.07.31 03:46:23 | 000,000,000 | R--D | C] -- C:\Users\Sonja\Desktop
[2012.07.31 03:46:23 | 000,000,000 | R--D | C] -- C:\Users\Sonja\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
[2012.07.31 03:46:23 | 000,000,000 | -H-D | C] -- C:\Users\Sonja\AppData
[2012.07.31 03:46:23 | 000,000,000 | ---D | C] -- C:\Users\Sonja\AppData\Local\Temp
[2012.07.31 03:46:23 | 000,000,000 | ---D | C] -- C:\Users\Sonja\AppData\Local\Microsoft
[2012.07.31 03:46:23 | 000,000,000 | ---D | C] -- C:\Users\Sonja\AppData\Roaming\Media Center Programs
[2012.07.31 03:41:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR DeLuXe
[2012.07.31 03:41:25 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\WinRAR
[2012.07.31 03:36:50 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Real Alternative
[2012.07.31 03:36:48 | 000,278,528 | ---- | C] (Real Networks, Inc) -- C:\Windows\SysWow64\pncrt.dll
[2012.07.31 03:36:48 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Real Alternative
[2012.07.31 03:36:32 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\Macromed
[2012.07.31 03:36:26 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\Wat
[2012.07.31 03:36:25 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\Wat
[2012.07.31 03:34:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games for Windows Marketplace
[2012.07.31 03:34:30 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\xlive
[2012.07.31 03:34:30 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Games for Windows - LIVE
[2012.07.31 03:33:17 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft XNA
[2012.07.31 03:32:49 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\OpenAL
[2012.07.31 03:32:18 | 001,502,208 | ---- | C] (The OpenSSL Project, hxxp://www.openssl.org/) -- C:\Windows\SysNative\libeay32.dll
[2012.07.31 03:32:18 | 001,099,776 | ---- | C] (The OpenSSL Project, hxxp://www.openssl.org/) -- C:\Windows\SysWow64\libeay32.dll
[2012.07.31 03:32:18 | 000,466,520 | ---- | C] (Creative Labs) -- C:\Windows\SysNative\wrap_oal.dll
[2012.07.31 03:32:18 | 000,445,016 | ---- | C] (Creative Labs) -- C:\Windows\SysWow64\wrap_oal.dll
[2012.07.31 03:32:18 | 000,307,200 | ---- | C] (The OpenSSL Project, hxxp://www.openssl.org/) -- C:\Windows\SysNative\ssleay32.dll
[2012.07.31 03:32:18 | 000,237,056 | ---- | C] (The OpenSSL Project, hxxp://www.openssl.org/) -- C:\Windows\SysWow64\ssleay32.dll
[2012.07.31 03:31:50 | 000,000,000 | ---D | C] -- C:\Program Files\Java
[2012.07.31 03:31:15 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Java
[2012.07.31 03:29:03 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\Macromed
[2012.07.31 03:29:03 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\Adobe
[2012.07.31 03:28:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip
[2012.07.31 03:28:53 | 000,000,000 | ---D | C] -- C:\Program Files\7-Zip
[2012.07.31 03:14:59 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft.NET
[2012.07.31 03:14:02 | 000,000,000 | -HSD | C] -- C:\Windows\Installer
[2012.07.31 03:11:45 | 000,000,000 | ---D | C] -- C:\2bd2eec5a7926d40b53d9a35
[2012.07.31 03:06:24 | 000,000,000 | -HSD | C] -- C:\Recovery
[2012.07.30 21:29:29 | 000,000,000 | ---D | C] -- C:\Windows\de-DE
[2012.07.30 21:29:23 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\XPSViewer
[2012.07.30 21:29:23 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\drivers\de-DE
[2012.07.30 21:29:23 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\de
[2012.07.30 21:29:23 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\0407
[2012.07.30 21:29:11 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\0407
[2012.07.30 21:29:10 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\drivers\de-DE
[2012.07.30 21:29:07 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\de
[2012.07.30 21:19:28 | 000,004,096 | ---- | C] (SCM Microsystems, Inc.) -- C:\Windows\SysNative\drivers\de-DE\pscr.sys.mui
[2012.07.30 21:19:07 | 000,011,776 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\de-DE\BrSerId.sys.mui
[2012.07.30 21:19:07 | 000,011,776 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\de-DE\BrSerIb.sys.mui
[2012.07.30 21:19:07 | 000,002,560 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\de-DE\BrParwdm.sys.mui
[2012.07.30 21:18:34 | 000,000,000 | ---D | C] -- C:\Users\Sonja\AppData\Roaming\WinRAR
[2012.07.30 20:58:17 | 000,000,000 | ---D | C] -- C:\Users\Sonja\AppData\Roaming\Malwarebytes
[2012.07.30 20:58:12 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.07.30 20:58:11 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012.07.30 20:58:11 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2012.07.30 20:58:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.07.30 20:56:04 | 000,000,000 | ---D | C] -- C:\Users\Sonja\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome
[2012.07.30 20:54:35 | 000,000,000 | ---D | C] -- C:\Users\Sonja\AppData\Local\Google
[2012.07.30 20:54:04 | 000,000,000 | ---D | C] -- C:\Users\Sonja\AppData\Local\Apps
[2012.07.30 20:54:03 | 000,000,000 | ---D | C] -- C:\Users\Sonja\AppData\Local\Deployment
[2012.07.30 20:52:46 | 000,000,000 | ---D | C] -- C:\Users\Sonja\AppData\Roaming\Macromedia
[2012.07.30 20:52:41 | 000,000,000 | ---D | C] -- C:\Users\Sonja\AppData\Roaming\Adobe
[2012.07.30 20:02:39 | 000,000,000 | ---D | C] -- C:\Windows\SoftwareDistribution
[2012.07.30 20:00:10 | 000,000,000 | ---D | C] -- C:\Windows\Prefetch
[2012.07.30 19:59:06 | 000,000,000 | -HSD | C] -- C:\System Volume Information
 
========== Files - Modified Within 30 Days ==========
 
[2012.08.01 21:11:01 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.08.01 21:04:05 | 000,001,120 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-94285194-1987544409-1093328201-1000UA.job
[2012.08.01 21:04:03 | 000,001,068 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-94285194-1987544409-1093328201-1000Core.job
[2012.08.01 20:08:58 | 000,000,000 | ---- | M] () -- C:\Users\Sonja\defogger_reenable
[2012.08.01 19:08:46 | 000,001,149 | ---- | M] () -- C:\Users\Public\Desktop\Trojan Remover.lnk
[2012.08.01 04:06:23 | 000,021,248 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.08.01 04:06:23 | 000,021,248 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.08.01 04:03:16 | 001,611,160 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.08.01 04:03:16 | 000,693,972 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.08.01 04:03:16 | 000,651,450 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.08.01 04:03:16 | 000,147,096 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.08.01 04:03:16 | 000,120,382 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.08.01 03:58:57 | 000,414,968 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.08.01 03:58:47 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.08.01 03:58:24 | 1610,014,720 | -HS- | M] () -- C:\hiberfil.sys
[2012.08.01 00:27:52 | 000,016,200 | ---- | M] (McAfee, Inc.) -- C:\Windows\stinger.sys
[2012.08.01 00:02:26 | 000,001,598 | ---- | M] () -- C:\Users\Sonja\Desktop\EZ Backup IE and Outlook Express Premium.lnk
[2012.08.01 00:02:25 | 005,510,744 | ---- | M] () -- C:\Windows\rapidui.exe
[2012.07.31 23:33:36 | 000,008,192 | ---- | M] () -- C:\Windows\SysWow64\srvany.exe
[2012.07.31 03:50:26 | 000,002,239 | ---- | M] () -- C:\Users\Public\Desktop\Mobile Connect.lnk
[2012.07.31 03:39:43 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_User_WpdFs_01_09_00.Wdf
[2012.07.31 03:17:30 | 001,585,802 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2012.07.30 21:28:04 | 000,295,922 | ---- | M] () -- C:\Windows\SysNative\perfi007.dat
[2012.07.30 21:28:04 | 000,038,104 | ---- | M] () -- C:\Windows\SysNative\perfd007.dat
[2012.07.30 20:58:12 | 000,001,119 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.07.30 20:52:29 | 000,001,455 | ---- | M] () -- C:\Users\Sonja\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2012.07.30 20:04:04 | 000,116,385 | ---- | M] () -- C:\Windows\SysWow64\license.rtf
[2012.07.30 20:04:04 | 000,116,385 | ---- | M] () -- C:\Windows\SysNative\license.rtf
[2012.07.03 13:46:44 | 000,024,904 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
 
========== Files Created - No Company Name ==========
 
[2012.08.01 20:08:58 | 000,000,000 | ---- | C] () -- C:\Users\Sonja\defogger_reenable
[2012.08.01 19:08:46 | 000,001,149 | ---- | C] () -- C:\Users\Public\Desktop\Trojan Remover.lnk
[2012.08.01 19:08:44 | 000,075,264 | ---- | C] () -- C:\Windows\SysWow64\unacev2.dll
[2012.08.01 19:08:43 | 000,153,088 | ---- | C] () -- C:\Windows\SysWow64\UNRAR3.dll
[2012.08.01 00:02:26 | 000,001,598 | ---- | C] () -- C:\Users\Sonja\Desktop\EZ Backup IE and Outlook Express Premium.lnk
[2012.08.01 00:02:26 | 000,001,560 | ---- | C] () -- C:\Users\Sonja\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\EZ Backup IE and Outlook Express Premium.lnk
[2012.08.01 00:02:25 | 005,510,744 | ---- | C] () -- C:\Windows\rapidui.exe
[2012.07.31 23:34:43 | 000,008,192 | ---- | C] () -- C:\Windows\SysWow64\srvany.exe
[2012.07.31 03:50:26 | 000,002,239 | ---- | C] () -- C:\Users\Public\Desktop\Mobile Connect.lnk
[2012.07.31 03:48:39 | 000,001,421 | ---- | C] () -- C:\Users\Sonja\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk
[2012.07.31 03:48:24 | 000,001,461 | ---- | C] () -- C:\Users\Sonja\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
[2012.07.31 03:46:24 | 000,000,290 | ---- | C] () -- C:\Users\Sonja\Application Data\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk
[2012.07.31 03:46:24 | 000,000,272 | ---- | C] () -- C:\Users\Sonja\Application Data\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk
[2012.07.31 03:40:55 | 000,175,616 | ---- | C] () -- C:\Windows\SysWow64\unrar.dll
[2012.07.31 03:39:43 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_User_WpdFs_01_09_00.Wdf
[2012.07.31 03:36:37 | 000,000,830 | ---- | C] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.07.31 03:35:57 | 000,001,354 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live ID.lnk
[2012.07.31 03:32:18 | 000,271,264 | ---- | C] () -- C:\Windows\SysWow64\vbrun100.dll
[2012.07.31 03:32:18 | 000,210,944 | ---- | C] () -- C:\Windows\SysWow64\msvcrt10.dll
[2012.07.31 03:28:24 | 001,585,802 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2012.07.31 03:07:39 | 000,204,103 | ---- | C] () -- C:\Windows\SysNative\winrm.vbs
[2012.07.31 03:07:38 | 000,204,103 | ---- | C] () -- C:\Windows\SysWow64\winrm.vbs
[2012.07.31 03:07:37 | 000,002,092 | ---- | C] () -- C:\Windows\SysNative\psmodulediscoveryprovider.mof
[2012.07.30 21:30:47 | 000,295,922 | ---- | C] () -- C:\Windows\SysNative\perfi007.dat
[2012.07.30 21:30:46 | 000,693,972 | ---- | C] () -- C:\Windows\SysNative\perfh007.dat
[2012.07.30 21:30:46 | 000,147,096 | ---- | C] () -- C:\Windows\SysNative\perfc007.dat
[2012.07.30 21:30:46 | 000,038,104 | ---- | C] () -- C:\Windows\SysNative\perfd007.dat
[2012.07.30 20:58:12 | 000,001,119 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.07.30 20:54:36 | 000,001,120 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-94285194-1987544409-1093328201-1000UA.job
[2012.07.30 20:54:36 | 000,001,068 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-94285194-1987544409-1093328201-1000Core.job
[2012.07.30 20:52:29 | 000,001,455 | ---- | C] () -- C:\Users\Sonja\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2012.07.30 20:03:22 | 000,001,345 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk
[2012.07.30 20:03:11 | 000,001,326 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk
[2012.07.30 19:59:06 | 1610,014,720 | -HS- | C] () -- C:\hiberfil.sys
[2012.01.02 08:18:40 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll
[2011.04.09 18:55:28 | 000,179,261 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat
 
========== LOP Check ==========
 
[2012.08.01 19:08:42 | 000,000,000 | ---D | M] -- C:\Users\Sonja\AppData\Roaming\Simply Super Software
[2009.07.14 00:08:49 | 000,003,118 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 

< End of report >
         

--- --- ---

Ich habe den Scan jetzt mal wiederholt da mir aufgefallen die zweite festplatte wurde nicht gescannt aber da ändert sich nichts dran was mache ich falsch???

Der Combuter hat sich berreits verlangsamt BITTE um rasche Hilfe ich habe keinen 2ten Computer oder Laptop mit dem ich mal nebenbei ins Internet kann Danke

Wie gesagt wenn mein Computer abschaltet ist es vorbei
DANKE

Danke für die tolle Reaktion! => http://www.trojaner-board.de/121221-...n-support.html

Solche undankbaren Spinner wie dich brauchen wir hier bestimmt nicht und dieser Strang wandert in die Tonne!
Ich wollte dir eben noch helfen hab dann aber deine Reaktion gelesen => EPIC FAIL