Trojaner-Board - Computer mit TR/Ransom.EJ.3 infiziert

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - Computer mit TR/Ransom.EJ.3 infiziert (https://www.trojaner-board.de/112935-computer-tr-ransom-ej-3-infiziert.html)

Computer mit TR/Ransom.EJ.3 infiziert

Hallo,

der Computer meines Vaters wurde von TR/Ransom.EJ.3 befallen. Er zeigte die dafür üblichen Symptome: Der Bildschirminhalt wird abgedunkelt und ein Fenster öffnet sich, dass zu einer Zahlung von 50 Euro aufruft.

Ich habe mit defogger Emulator-Treiber deaktiviert und den Computer neugestartet.

Code:

defogger_disable by jpshortstuff (23.02.10.1)

Log created at 11:05 on 02/04/2012 (***)
 

Checking for autostart values...

HKCU\~\Run values retrieved.

HKLM\~\Run values retrieved.
 

Checking for services/drivers...

Unable to read sptd.sys

SPTD -> Disabled (Service running -> reboot required)
 
 

-=E.O.F=-

Hier die Logdateien von DDS:

DDS.txt
[CODE].DDS Logfile:

Code:

DDS (Ver_2011-08-26.01) - NTFSx86 

Internet Explorer: 9.0.8112.16421  BrowserJavaVersion: 10.3.1

Run by *** at 11:12:15 on 2012-04-02

Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1252.49.1031.18.2046.991 [GMT 2:00]

.

AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}

SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

============== Running Processes ===============

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Program Files\Avira\AntiVir Desktop\avguard.exe

C:\Program Files\Avira\AntiVir Desktop\avshadow.exe

C:\Windows\system32\nvvsvc.exe

C:\Windows\system32\svchost.exe -k rpcss

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k GPSvcGroup

C:\Windows\system32\SLsvc.exe

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\nvvsvc.exe

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\System32\spoolsv.exe

C:\Program Files\Avira\AntiVir Desktop\sched.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Windows\system32\svchost.exe -k bthsvcs

C:\Program Files\Fujitsu Siemens Computers\FSCLounge\FSCWBaseUpdaterService\2\FSCWBaseUpdaterService.exe

C:\Windows\system32\svchost.exe -k HsfXAudioService

c:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe

C:\Windows\system32\lxbscoms.exe

C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe

C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe

C:\Windows\system32\IoctlSvc.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Program Files\CyberLink\Shared Files\RichVideo.exe

C:\Windows\system32\svchost.exe -k imgsvc

C:\firststeps\OnlineDiagnostic\TestManager\TestHandler.exe

C:\Windows\system32\taskeng.exe

C:\Windows\system32\DRIVERS\xaudio.exe

C:\Windows\Explorer.EXE

C:\Windows\system32\Dwm.exe

C:\Windows\system32\taskeng.exe

C:\Windows\system32\iashost.exe

C:\Windows\RtHDVCpl.exe

C:\Program Files\Power Manager\PM.exe

C:\Program Files\HomeCinema\Power2Go\CLMLSvc.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

C:\Windows\ehome\ehtray.exe

C:\Program Files\DSL-Manager\DslMgr.exe

C:\Windows\system32\wbem\unsecapp.exe

C:\Program Files\DSL-Manager\DslMgrSvc.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\ehome\ehmsas.exe

C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Windows\Explorer.exe

C:\Program Files\Windows Media Player\wmpnscfg.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Windows\system32\Macromed\Flash\FlashUtil32_11_2_202_228_ActiveX.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\servicing\TrustedInstaller.exe

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe

C:\Windows\system32\conime.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = about:blank

mURLSearchHooks: SearchElf 1.2 Toolbar: {f4e6547e-325b-403c-a3bb-ad29ed37a92f} - c:\program files\searchelf_1.2\prxtbSea0.dll

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: Conduit Engine : {30f9b915-b755-4826-820b-08fba6bd249d} - c:\program files\conduitengine\prxConduitEngine.dll

BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\oracle\javafx 2.0 runtime\bin\jp2ssv.dll

BHO: SearchElf 1.2 Toolbar: {f4e6547e-325b-403c-a3bb-ad29ed37a92f} - c:\program files\searchelf_1.2\prxtbSea0.dll

TB: SearchElf 1.2 Toolbar: {f4e6547e-325b-403c-a3bb-ad29ed37a92f} - c:\program files\searchelf_1.2\prxtbSea0.dll

TB: Conduit Engine : {30f9b915-b755-4826-820b-08fba6bd249d} - c:\program files\conduitengine\prxConduitEngine.dll

TB: {EBF2BA02-9094-4C5A-858B-BB198F3D8DE2} - No File

uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe

uRun: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "c:\program files\common files\ahead\lib\NMBgMonitor.exe"

mRun: [RtHDVCpl] RtHDVCpl.exe

mRun: [PowerManager] c:\program files\power manager\PM.exe

mRun: [CLMLServer] "c:\program files\homecinema\power2go\CLMLSvc.exe"

mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

mRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe"

mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime

mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"

mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"

mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min

StartupFolder: c:\users\***\appdata\roaming\micros~1\windows\startm~1\programs\startup\dsl-ma~1.lnk - c:\program files\dsl-manager\DslMgr.exe

mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)

mPolicies-system: EnableUIADesktopToggle = 0 (0x0)

DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} - hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab

DPF: {CAFEEFAC-0017-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

TCP: DhcpNameServer = 192.168.0.1

TCP: Interfaces\{8660B1CA-198A-4D32-A3BD-4630E08FAD64} : DhcpNameServer = 192.168.0.1

TCP: Interfaces\{AD197E5A-BCDB-411A-84B2-A2144B7340F9} : DhcpNameServer = 192.168.0.1

.

============= SERVICES / DRIVERS ===============

.

R1 avkmgr;avkmgr;c:\windows\system32\drivers\avkmgr.sys [2012-4-2 36000]

R1 DslMNLwf;DSL-Manager NDIS LightWeight Filter;c:\windows\system32\drivers\dslmnlwf.sys [2009-7-17 16448]

R2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\common files\adobe\arm\1.0\armsvc.exe [2012-1-3 63928]

R2 AntiVirSchedulerService;Avira Planer;c:\program files\avira\antivir desktop\sched.exe [2012-4-2 86224]

R2 AntiVirService;Avira Echtzeit Scanner;c:\program files\avira\antivir desktop\avguard.exe [2012-4-2 110032]

R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2012-4-2 74640]

R2 FontCache;Windows-Dienst für Schriftartencache;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-5-17 21504]

R2 FSCLBaseUpdaterService;FSCLBaseUpdaterService;c:\program files\fujitsu siemens computers\fsclounge\fscwbaseupdaterservice\2\FSCWBaseUpdaterService.exe [2007-6-4 65536]

R2 HsfXAudioService;HsfXAudioService;c:\windows\system32\svchost.exe -k HsfXAudioService [2008-5-17 21504]

R3 smscirrx;SMSC CIR Receive;c:\windows\system32\drivers\smscirrx.sys [2008-1-17 40448]

R3 TDslMgrService;DSL-Manager;c:\program files\dsl-manager\DslMgrSvc.exe [2009-7-17 307200]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\macromed\flash\FlashPlayerUpdateService.exe [2012-4-2 253600]

S3 dsltestSp5;dsltestSp5 NDIS Protocol Driver;c:\windows\system32\drivers\DslTestSp5.sys [2009-7-17 26816]

S3 TridVid;Video Grabber;c:\windows\system32\drivers\tridvid.sys [2008-12-23 168704]

S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]

S3 WSDPrintDevice;WSD-Druckunterstützung durch UMB;c:\windows\system32\drivers\WSDPrint.sys [2008-5-17 16896]

S3 WSDScan;WSD-Scanunterstützung durch UMB;c:\windows\system32\drivers\WSDScan.sys [2009-10-18 19968]

.

=============== Created Last 30 ================

.

2012-04-02 09:09:44        418464        ----a-w-        c:\windows\system32\FlashPlayerApp.exe

2012-04-02 08:23:09        20464        ----a-w-        c:\windows\system32\drivers\mbam.sys

2012-04-02 07:23:45        --------        d-----w-        c:\program files\Microsoft WSE

2012-04-02 07:22:34        --------        d-----w-        c:\program files\Netzmanager

2012-04-02 07:21:46        --------        d-----w-        c:\users\***\appdata\local\PackageAware

2012-04-02 06:53:14        --------        d-----w-        c:\users\***\appdata\roaming\Avira

2012-04-02 06:50:57        36000        ----a-w-        c:\windows\system32\drivers\avkmgr.sys

2012-04-02 06:50:56        74640        ----a-w-        c:\windows\system32\drivers\avgntflt.sys

2012-04-02 06:50:55        --------        d-----w-        c:\programdata\Avira

2012-04-02 06:50:55        --------        d-----w-        c:\program files\Avira

2012-04-01 19:21:42        --------        d-----w-        c:\program files\iPod

2012-04-01 19:21:39        --------        d-----w-        c:\program files\iTunes

2012-04-01 18:10:56        2044416        ----a-w-        c:\windows\system32\win32k.sys

2012-04-01 18:10:47        613376        ----a-w-        c:\windows\system32\rdpencom.dll

2012-04-01 18:10:47        180736        ----a-w-        c:\windows\system32\drivers\rdpwd.sys

2012-04-01 18:10:45        2409784        ----a-w-        c:\program files\windows mail\OESpamFilter.dat

2012-04-01 18:10:43        683008        ----a-w-        c:\windows\system32\d2d1.dll

2012-04-01 18:10:43        219648        ----a-w-        c:\windows\system32\d3d10_1core.dll

2012-04-01 18:10:43        160768        ----a-w-        c:\windows\system32\d3d10_1.dll

2012-04-01 18:10:43        1172480        ----a-w-        c:\windows\system32\d3d10warp.dll

2012-04-01 18:10:43        1068544        ----a-w-        c:\windows\system32\DWrite.dll

2012-04-01 14:44:09        --------        d-----w-        c:\users\***\appdata\roaming\Malwarebytes

2012-04-01 14:43:59        --------        d-----w-        c:\programdata\Malwarebytes

2012-04-01 14:43:57        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware

2012-03-31 19:53:02        --------        d-----w-        c:\program files\common files\Java(1)

2012-03-25 16:34:01        --------        d-----w-        c:\programdata\Avira(91)

.

==================== Find3M  ====================

.

2012-04-02 09:09:44        70304        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl

2012-01-10 11:57:14        637848        ----a-w-        c:\windows\system32\npdeployJava1.dll

2012-01-10 11:57:10        567696        ----a-w-        c:\windows\system32\deployJava1.dll

.

============= FINISH: 11:14:35,54 ===============

--- --- ---

Attach.txt

Code:

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2011-08-26.01)

.

Microsoft® Windows Vista™ Home Premium 

Boot Device: \Device\HarddiskVolume2

Install Date: 09.02.2008 12:27:00

System Uptime: 02.04.2012 11:06:53 (0 hours ago)

.

Motherboard: FUJITSU SIEMENS |  | XTB71___

Processor: AMD Turion(tm) 64 X2 Mobile Technology TL-56 | Socket A | 1800/133mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 148 GiB total, 82,608 GiB free.

D: is FIXED (NTFS) - 73 GiB total, 33,266 GiB free.

E: is CDROM ()

.

==== Disabled Device Manager Items =============

.

==== System Restore Points ===================

.

.

==== Installed Programs ======================

.

Adobe Flash Player 11 ActiveX

Adobe Reader X (10.1.2) - Deutsch

Adobe Shockwave Player 11.5

AeroFly Professional Deluxe (inkl. Add-On 1)

ALPS Touch Pad Driver

Apple Application Support

Apple Mobile Device Support

Apple Software Update

ArcSoft PhotoBase 3

ArcSoft PhotoStudio 5

Audacity 1.3.12 (Unicode)

Avira Free Antivirus

Bison WebCam

Bonjour

CanoScan Toolbox Ver4.1

ChargerMonitor V1.0

Compatibility Pack für 2007 Office System

COMPUTER BILD Windows Wiki 2010

Conduit Engine 

Corel Graphics Suite 11

CorelDRAW Graphics Suite 11

CP2101 USB to UART Bridge Controller Driver Installation

CyberLink PhotoNow!

CyberLink Power2Go

CyberLink PowerDirector

CyberLink PowerProducer

DHTML Editing Component

DivX-Setup

dm-Fotowelt

DruckShop Weihnachten

DSL-Manager

EPSON SX430 Series Printer Uninstall

EZ Vinyl/Tape Converter 4.1 by MixMeister

FFmpeg for Audacity on Windows

FirstSteps Diagnostics

FSCLounge

Future Pinball

Game Booster

glasklar Komplettpaket DVD1

Hardcopy (C:\Program Files\Hardcopy)

HDAUDIO Soft Data Fax Modem with SmartCP

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)

InterVideo WinDVD 8

iTunes

Java Auto Updater

Java(TM) 7 Update 3

JavaFX 2.0.3

klickTel OEM 2007

LAME v3.98.3 for Audacity

Lexmark 810 Series

LibreOffice 3.4

MA-VIN

Malwarebytes Anti-Malware Version 1.60.1.1000

Microsoft .NET Framework 1.1

Microsoft .NET Framework 1.1 German Language Pack

Microsoft .NET Framework 1.1 Security Update (KB2656353)

Microsoft .NET Framework 1.1 Security Update (KB979906)

Microsoft .NET Framework 3.5 Language Pack SP1 - deu

Microsoft .NET Framework 3.5 SP1

Microsoft .NET Framework 4 Client Profile

Microsoft .NET Framework 4 Client Profile DEU Language Pack

Microsoft Application Error Reporting

Microsoft Office PowerPoint Viewer 2007 (German)

Microsoft Silverlight

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219

Microsoft Visual J# .NET Redistributable Package 1.1

Microsoft Word 2002

Microsoft Works

Microsoft WSE 3.0 Runtime

MSXML 4.0 SP2 (KB941833)

MSXML 4.0 SP2 (KB954430)

MSXML 4.0 SP2 (KB973688)

neox Sudoku Trainer 1.0

Nero 7 Essentials

neroxml

NVIDIA Display Control Panel

NVIDIA Drivers

NVIDIA ForceWare Network Access Manager

NVIDIA PhysX

Paint.NET v3.20

PhotoScape

Power Manager 2.1.7

PowerDV

QuickTime

Realtek High Definition Audio Driver

SearchElf 1.2 Toolbar

Security Update for CAPICOM (KB931906)

Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)

Security Update for Microsoft .NET Framework 4 Client Profile DEU Language Pack (KB2478663)

Security Update for Microsoft .NET Framework 4 Client Profile DEU Language Pack (KB2518870)

Silicon Laboratories CP210x USB to UART Bridge (Driver Removal)

Silicon Laboratories CP210x VCP Drivers for Windows 2000/XP/2003 Server/Vista

System Requirements Lab

T-Online 6.0

T-Online WLAN-Access Finder

Ulead COOL 360 1.0

Ulead Photo Explorer 8.0 SE Basic

Ulead Photo Express 5 SE

Universallexikon 2008

Update for Microsoft .NET Framework 3.5 SP1 (KB963707)

Update for Microsoft .NET Framework 4 Client Profile (KB2468871)

Update for Microsoft .NET Framework 4 Client Profile (KB2533523)

Update for Microsoft .NET Framework 4 Client Profile (KB2600217)

VC80CRTRedist - 8.0.50727.4053

vispa

VLC media player 1.0.5

WinSysClean 2008

XMedia Recode 2.2.1.6

XnView 1.74

.

==== End Of File ===========================

Dann noch ein Scan mit Gmer (Tut mir leid, dass der Internet Explorer geöffnet war!):

Code:

GMER 1.0.15.14966 - hxxp://www.gmer.net

Rootkit scan 2012-04-02 11:54:00

Windows 6.0.6002 Service Pack 2
 
 

---- System - GMER 1.0.15 ----
 

SSDT            8A1EE7D6                                                                                             ZwCreateSection

SSDT            8A1EE7E0                                                                                             ZwRequestWaitReplyPort

SSDT            8A1EE7DB                                                                                             ZwSetContextThread

SSDT            8A1EE7E5                                                                                             ZwSetSecurityObject

SSDT            8A1EE7EA                                                                                             ZwSystemDebugControl

SSDT            8A1EE777                                                                                             ZwTerminateProcess
 

---- Kernel code sections - GMER 1.0.15 ----
 

.text           ntkrnlpa.exe!KeSetEvent + 215                                                                        820AC998 4 Bytes  [D6, E7, 1E, 8A]

.text           ntkrnlpa.exe!KeSetEvent + 539                                                                        820ACCBC 4 Bytes  [E0, E7, 1E, 8A]

.text           ntkrnlpa.exe!KeSetEvent + 56D                                                                        820ACCF0 4 Bytes  [DB, E7, 1E, 8A]

.text           ntkrnlpa.exe!KeSetEvent + 5D1                                                                        820ACD54 4 Bytes  [E5, E7, 1E, 8A]

.text           ntkrnlpa.exe!KeSetEvent + 619                                                                        820ACD9C 4 Bytes  JMP 628A1EE7 

.text           ...                                                                                                  

?               C:\Users\***\AppData\Local\Temp\mbr.sys                                                         Das System kann die angegebene Datei nicht finden. !
 

---- User code sections - GMER 1.0.15 ----
 

.text           C:\Program Files\Internet Explorer\iexplore.exe[832] USER32.dll!EnableWindow                         75E0CD8B 5 Bytes  JMP 68B19A14 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[832] USER32.dll!DialogBoxParamW                      75E310B0 5 Bytes  JMP 68A7170B C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[832] USER32.dll!DialogBoxIndirectParamW              75E32EF5 5 Bytes  JMP 68C66336 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[832] USER32.dll!DialogBoxParamA                      75E48152 5 Bytes  JMP 68C662D1 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[832] USER32.dll!DialogBoxIndirectParamA              75E4847D 5 Bytes  JMP 68C6639B C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[832] USER32.dll!MessageBoxIndirectA                  75E5D4D9 5 Bytes  JMP 68C66258 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[832] USER32.dll!MessageBoxIndirectW                  75E5D5D3 5 Bytes  JMP 68C661DF C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[832] USER32.dll!MessageBoxExA                        75E5D639 5 Bytes  JMP 68C6617B C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[832] USER32.dll!MessageBoxExW                        75E5D65D 5 Bytes  JMP 68C66117 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[2872] kernel32.dll!CreateThread                      75B6CB2E 5 Bytes  JMP 68AD7303 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[2872] USER32.dll!CreateDialogParamW                  75E072A2 5 Bytes  JMP 68C666A0 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[2872] USER32.dll!GetAsyncKeyState                    75E0863C 5 Bytes  JMP 68ABDD8D C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[2872] USER32.dll!SetWindowsHookExW                   75E087AD 5 Bytes  JMP 68B12194 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[2872] USER32.dll!CallNextHookEx                      75E08E3B 5 Bytes  JMP 68B37BAF C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[2872] USER32.dll!UnhookWindowsHookEx                 75E098DB 5 Bytes  JMP 68B5EB00 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[2872] USER32.dll!EnableWindow                        75E0CD8B 5 Bytes  JMP 68B19A14 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[2872] USER32.dll!DefWindowProcA                      75E0DB88 7 Bytes  JMP 68AD952D C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[2872] USER32.dll!CreateWindowExA                     75E0DC2A 5 Bytes  JMP 68AE3363 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[2872] USER32.dll!CreateWindowExW                     75E11305 5 Bytes  JMP 68B3FF87 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[2872] USER32.dll!GetKeyState                         75E18CB1 5 Bytes  JMP 68ABDC67 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[2872] USER32.dll!DefWindowProcW                      75E203B4 7 Bytes  JMP 68B37C12 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[2872] USER32.dll!IsDialogMessageW                    75E20745 5 Bytes  JMP 68C66E05 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[2872] USER32.dll!CreateDialogParamA                  75E217AA 5 Bytes  JMP 68C66668 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[2872] USER32.dll!IsDialogMessage                     75E21847 2 Bytes  JMP 68C66DDD C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[2872] USER32.dll!IsDialogMessage + 3                 75E2184A 2 Bytes  [E4, F2] {IN AL, 0xf2}

.text           C:\Program Files\Internet Explorer\iexplore.exe[2872] USER32.dll!CreateDialogIndirectParamA          75E226F1 5 Bytes  JMP 68C666D8 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[2872] USER32.dll!CreateDialogIndirectParamW          75E29A62 5 Bytes  JMP 68C66710 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[2872] USER32.dll!SetKeyboardState                    75E30987 5 Bytes  JMP 68C676D1 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[2872] USER32.dll!DialogBoxParamW                     75E310B0 5 Bytes  JMP 68A7170B C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[2872] USER32.dll!DialogBoxIndirectParamW             75E32EF5 5 Bytes  JMP 68C66336 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[2872] USER32.dll!SendInput                           75E32F75 5 Bytes  JMP 68C67679 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[2872] USER32.dll!EndDialog                           75E3326E 5 Bytes  JMP 68C670B4 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[2872] USER32.dll!SetCursorPos                        75E46FB2 5 Bytes  JMP 68C67752 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[2872] USER32.dll!DialogBoxParamA                     75E48152 5 Bytes  JMP 68C662D1 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[2872] USER32.dll!DialogBoxIndirectParamA             75E4847D 5 Bytes  JMP 68C6639B C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[2872] USER32.dll!MessageBoxIndirectA                 75E5D4D9 5 Bytes  JMP 68C66258 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[2872] USER32.dll!MessageBoxIndirectW                 75E5D5D3 5 Bytes  JMP 68C661DF C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[2872] USER32.dll!MessageBoxExA                       75E5D639 5 Bytes  JMP 68C6617B C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[2872] USER32.dll!MessageBoxExW                       75E5D65D 5 Bytes  JMP 68C66117 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[2872] USER32.dll!keybd_event                         75E5D972 5 Bytes  JMP 68C67636 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[2872] SHELL32.dll!SHRestricted + D95                 761A89A8 4 Bytes  [CF, 01, C2, 66]

.text           C:\Program Files\Internet Explorer\iexplore.exe[2872] SHELL32.dll!SHRestricted + D9D                 761A89B0 8 Bytes  [E0, 61, C1, 66, 79, F7, C1, ...]

.text           C:\Program Files\Internet Explorer\iexplore.exe[2872] ole32.dll!OleLoadFromStream                    76F51E80 5 Bytes  JMP 68C66B0F C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[3656] kernel32.dll!CreateThread                      75B6CB2E 5 Bytes  JMP 68AD7303 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[3656] USER32.dll!CreateDialogParamW                  75E072A2 5 Bytes  JMP 68C666A0 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[3656] USER32.dll!GetAsyncKeyState                    75E0863C 5 Bytes  JMP 68ABDD8D C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[3656] USER32.dll!SetWindowsHookExW                   75E087AD 5 Bytes  JMP 68B12194 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[3656] USER32.dll!CallNextHookEx                      75E08E3B 5 Bytes  JMP 68B37BAF C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[3656] USER32.dll!UnhookWindowsHookEx                 75E098DB 5 Bytes  JMP 68B5EB00 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[3656] USER32.dll!EnableWindow                        75E0CD8B 5 Bytes  JMP 68B19A14 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[3656] USER32.dll!DefWindowProcA                      75E0DB88 7 Bytes  JMP 68AD952D C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[3656] USER32.dll!CreateWindowExA                     75E0DC2A 5 Bytes  JMP 68AE3363 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[3656] USER32.dll!CreateWindowExW                     75E11305 5 Bytes  JMP 68B3FF87 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[3656] USER32.dll!GetKeyState                         75E18CB1 5 Bytes  JMP 68ABDC67 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[3656] USER32.dll!DefWindowProcW                      75E203B4 7 Bytes  JMP 68B37C12 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[3656] USER32.dll!IsDialogMessageW                    75E20745 5 Bytes  JMP 68C66E05 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[3656] USER32.dll!CreateDialogParamA                  75E217AA 5 Bytes  JMP 68C66668 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[3656] USER32.dll!IsDialogMessage                     75E21847 2 Bytes  JMP 68C66DDD C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[3656] USER32.dll!IsDialogMessage + 3                 75E2184A 2 Bytes  [E4, F2] {IN AL, 0xf2}

.text           C:\Program Files\Internet Explorer\iexplore.exe[3656] USER32.dll!CreateDialogIndirectParamA          75E226F1 5 Bytes  JMP 68C666D8 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[3656] USER32.dll!CreateDialogIndirectParamW          75E29A62 5 Bytes  JMP 68C66710 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[3656] USER32.dll!SetKeyboardState                    75E30987 5 Bytes  JMP 68C676D1 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[3656] USER32.dll!DialogBoxParamW                     75E310B0 5 Bytes  JMP 68A7170B C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[3656] USER32.dll!DialogBoxIndirectParamW             75E32EF5 5 Bytes  JMP 68C66336 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[3656] USER32.dll!SendInput                           75E32F75 5 Bytes  JMP 68C67679 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[3656] USER32.dll!EndDialog                           75E3326E 5 Bytes  JMP 68C670B4 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[3656] USER32.dll!SetCursorPos                        75E46FB2 5 Bytes  JMP 68C67752 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[3656] USER32.dll!DialogBoxParamA                     75E48152 5 Bytes  JMP 68C662D1 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[3656] USER32.dll!DialogBoxIndirectParamA             75E4847D 5 Bytes  JMP 68C6639B C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[3656] USER32.dll!MessageBoxIndirectA                 75E5D4D9 5 Bytes  JMP 68C66258 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[3656] USER32.dll!MessageBoxIndirectW                 75E5D5D3 5 Bytes  JMP 68C661DF C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[3656] USER32.dll!MessageBoxExA                       75E5D639 5 Bytes  JMP 68C6617B C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[3656] USER32.dll!MessageBoxExW                       75E5D65D 5 Bytes  JMP 68C66117 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[3656] USER32.dll!keybd_event                         75E5D972 5 Bytes  JMP 68C67636 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[3656] SHELL32.dll!SHRestricted + D95                 761A89A8 4 Bytes  [CF, 01, C2, 66]

.text           C:\Program Files\Internet Explorer\iexplore.exe[3656] SHELL32.dll!SHRestricted + D9D                 761A89B0 8 Bytes  [E0, 61, C1, 66, 79, F7, C1, ...]

.text           C:\Program Files\Internet Explorer\iexplore.exe[3656] ole32.dll!OleLoadFromStream                    76F51E80 5 Bytes  JMP 68C66B0F C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
 

---- Devices - GMER 1.0.15 ----
 

Device          \Driver\BTHUSB \Device\00000074                                                                      bthport.sys (Bluetooth-Bustreiber/Microsoft Corporation)

Device          \Driver\BTHUSB \Device\00000076                                                                      bthport.sys (Bluetooth-Bustreiber/Microsoft Corporation)
 

AttachedDevice  \FileSystem\fastfat \Fat                                                                             fltmgr.sys (Microsoft Dateisystem-Filter-Manager/Microsoft Corporation)
 

---- Registry - GMER 1.0.15 ----
 

Reg             HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\001060d01269                          

Reg             HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\001060d0161a                          

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04                     

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0                  0

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew               0x4B 0x7A 0xA4 0xC6 ...

Reg             HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\001060d01269                              

Reg             HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\001060d0161a                              

Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04                         

Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0                      0

Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew                   0x4B 0x7A 0xA4 0xC6 ...
 

---- Files - GMER 1.0.15 ----
 

File            C:\Windows\System32\config\systemprofile\AppData\Roaming\Apple Computer\Logs\asl.084709_02Apr12.log  (size mismatch) 5154/0 bytes

File            C:\Windows\System32\config\systemprofile\AppData\Roaming\Apple Computer\Logs\asl.110817_02Apr12.log  (size mismatch) 4720/0 bytes

File            C:\Windows\System32\config\systemprofile\AppData\Roaming\Apple Computer\Logs\asl.211932_01Apr12.log  (size mismatch) 5154/0 bytes

File            C:\Windows\System32\LogFiles\IN1204.log                                                              (size mismatch) 1280/1148 bytes

File            C:\Windows\System32\LogFiles\Scm\SCM.EVM                                                             (size mismatch) 360448/0 bytes

File            C:\Windows\System32\LogFiles\WUDF\WUDFTrace.etl                                                      (size mismatch) 16384/0 bytes

File            C:\Windows\System32\spool\SpoolerETW.etl                                                             (size mismatch) 4096/0 bytes

File            C:\Windows\System32\wfp\wfpdiag.etl                                                                  (size mismatch) 65536/0 bytes

File            C:\Windows\System32\WDI\LogFiles\WdiContextLog.etl.002                                               (size mismatch) 344064/311296 bytes
 

---- EOF - GMER 1.0.15 ----

Beschreibung zu TR/Ransom.EJ.3: hxxp://www.avira.com/de/support-threats-summary/tid/7288/threat/TR.Ransom.EJ.3

Vielen Dank im Vorraus!

Funktioniert noch der abgesicherte Modus mit Netzwerktreibern? Mit Internetverbindung?

Abgesicherter Modus zur Bereinigung

Windows mit F8-Taste beim Start in den abgesicherten Modus bringen.
Starte den Rechner in den abgesicherten Modus mit Netzwerktreibern:

Ja, der abgesicherte Modus mit Netzwerktreibern funktioniert.

na wenn der Modus geht wirst du erstmal routinemäßig einen Vollscan mit malwarebytes machen und Log posten. =>ALLE lokalen Datenträger (außer CD/DVD) überprüfen lassen!
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss! Außerdem müssen alle Funde entfernt werden.

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:

hier steht das Log

Noch kurz eine Ergänzung: Zuvor wurde eine Systemwiederherstellung ausgeführt, weshalb ich mir nicht sicher bin, ob der Computer noch infiziert ist.

Vor den Prüfungen im abgesicherten Modus wurde bereits mit Avira und MBAM gescannt.

Avira:

Code:



Avira Free Antivirus

Erstellungsdatum der Reportdatei: Montag, 2. April 2012  13:00
 

Es wird nach 3574017 Virenstämmen gesucht.
 

Das Programm läuft als uneingeschränkte Vollversion.

Online-Dienste stehen zur Verfügung.
 

Lizenznehmer   : Avira AntiVir Personal - Free Antivirus

Seriennummer   : 0000149996-ADJIE-0000001

Plattform      : Windows Vista

Windowsversion : (Service Pack 2)  [6.0.6002]

Boot Modus     : Normal gebootet

Benutzername   : ***

Computername   : ALLE-PC
 

Versionsinformationen:

BUILD.DAT      : 12.0.0.898     41963 Bytes  31.01.2012 13:51:00

AVSCAN.EXE     : 12.1.0.20     492496 Bytes  31.01.2012 06:55:52

AVSCAN.DLL     : 12.1.0.18      65744 Bytes  31.01.2012 06:56:29

LUKE.DLL       : 12.1.0.19      68304 Bytes  31.01.2012 06:56:01

AVSCPLR.DLL    : 12.1.0.22     100048 Bytes  31.01.2012 06:55:52

AVREG.DLL      : 12.1.0.31     228104 Bytes  02.04.2012 10:50:16

VBASE000.VDF   : 7.10.0.0    19875328 Bytes  06.11.2009 09:49:21

VBASE001.VDF   : 7.11.0.0    13342208 Bytes  14.12.2010 06:56:15

VBASE002.VDF   : 7.11.19.170 14374912 Bytes  20.12.2011 06:56:21

VBASE003.VDF   : 7.11.21.238  4472832 Bytes  01.02.2012 06:53:24

VBASE004.VDF   : 7.11.26.44   4329472 Bytes  28.03.2012 06:53:50

VBASE005.VDF   : 7.11.26.45      2048 Bytes  28.03.2012 06:53:50

VBASE006.VDF   : 7.11.26.46      2048 Bytes  28.03.2012 06:53:50

VBASE007.VDF   : 7.11.26.47      2048 Bytes  28.03.2012 06:53:50

VBASE008.VDF   : 7.11.26.48      2048 Bytes  28.03.2012 06:53:50

VBASE009.VDF   : 7.11.26.49      2048 Bytes  28.03.2012 06:53:51

VBASE010.VDF   : 7.11.26.50      2048 Bytes  28.03.2012 06:53:51

VBASE011.VDF   : 7.11.26.51      2048 Bytes  28.03.2012 06:53:51

VBASE012.VDF   : 7.11.26.52      2048 Bytes  28.03.2012 06:53:51

VBASE013.VDF   : 7.11.26.53      2048 Bytes  28.03.2012 06:53:51

VBASE014.VDF   : 7.11.26.107   221696 Bytes  30.03.2012 06:53:53

VBASE015.VDF   : 7.11.26.108     2048 Bytes  30.03.2012 06:53:53

VBASE016.VDF   : 7.11.26.109     2048 Bytes  30.03.2012 06:53:53

VBASE017.VDF   : 7.11.26.110     2048 Bytes  30.03.2012 06:53:53

VBASE018.VDF   : 7.11.26.111     2048 Bytes  30.03.2012 06:53:53

VBASE019.VDF   : 7.11.26.112     2048 Bytes  30.03.2012 06:53:53

VBASE020.VDF   : 7.11.26.113     2048 Bytes  30.03.2012 06:53:53

VBASE021.VDF   : 7.11.26.114     2048 Bytes  30.03.2012 06:53:53

VBASE022.VDF   : 7.11.26.115     2048 Bytes  30.03.2012 06:53:53

VBASE023.VDF   : 7.11.26.116     2048 Bytes  30.03.2012 06:53:53

VBASE024.VDF   : 7.11.26.117     2048 Bytes  30.03.2012 06:53:54

VBASE025.VDF   : 7.11.26.118     2048 Bytes  30.03.2012 06:53:54

VBASE026.VDF   : 7.11.26.119     2048 Bytes  30.03.2012 06:53:54

VBASE027.VDF   : 7.11.26.120     2048 Bytes  30.03.2012 06:53:54

VBASE028.VDF   : 7.11.26.121     2048 Bytes  30.03.2012 06:53:54

VBASE029.VDF   : 7.11.26.122     2048 Bytes  30.03.2012 06:53:54

VBASE030.VDF   : 7.11.26.123     2048 Bytes  30.03.2012 06:53:54

VBASE031.VDF   : 7.11.26.152   218624 Bytes  02.04.2012 10:50:16

Engineversion  : 8.2.10.34 

AEVDF.DLL      : 8.1.2.2       106868 Bytes  31.01.2012 06:55:38

AESCRIPT.DLL   : 8.1.4.15      442747 Bytes  02.04.2012 06:54:15

AESCN.DLL      : 8.1.8.2       131444 Bytes  02.04.2012 06:54:14

AESBX.DLL      : 8.2.5.5       606579 Bytes  02.04.2012 06:54:16

AERDL.DLL      : 8.1.9.15      639348 Bytes  31.01.2012 06:55:37

AEPACK.DLL     : 8.2.16.9      807287 Bytes  02.04.2012 06:54:14

AEOFFICE.DLL   : 8.1.2.25      201084 Bytes  31.01.2012 06:55:36

AEHEUR.DLL     : 8.1.4.10     4551031 Bytes  02.04.2012 06:54:11

AEHELP.DLL     : 8.1.19.0      254327 Bytes  02.04.2012 06:53:59

AEGEN.DLL      : 8.1.5.23      409973 Bytes  02.04.2012 06:53:59

AEEXP.DLL      : 8.1.0.27       82293 Bytes  02.04.2012 06:54:16

AEEMU.DLL      : 8.1.3.0       393589 Bytes  31.01.2012 06:55:34

AECORE.DLL     : 8.1.25.6      201078 Bytes  02.04.2012 06:53:58

AEBB.DLL       : 8.1.1.0        53618 Bytes  31.01.2012 06:55:33

AVWINLL.DLL    : 12.1.0.17      27344 Bytes  31.01.2012 06:55:54

AVPREF.DLL     : 12.1.0.17      51920 Bytes  31.01.2012 06:55:51

AVREP.DLL      : 12.1.0.17     179408 Bytes  31.01.2012 06:55:51

AVARKT.DLL     : 12.1.0.23     209360 Bytes  31.01.2012 06:55:46

AVEVTLOG.DLL   : 12.1.0.17     169168 Bytes  31.01.2012 06:55:47

SQLITE3.DLL    : 3.7.0.0       398288 Bytes  31.01.2012 06:56:07

AVSMTP.DLL     : 12.1.0.17      62928 Bytes  31.01.2012 06:55:52

NETNT.DLL      : 12.1.0.17      17104 Bytes  31.01.2012 06:56:02

RCIMAGE.DLL    : 12.1.0.17    4447952 Bytes  31.01.2012 06:56:32

RCTEXT.DLL     : 12.1.0.16      98512 Bytes  31.01.2012 06:56:32
 

Konfiguration für den aktuellen Suchlauf:

Job Name..............................: Lokale Laufwerke

Konfigurationsdatei...................: C:\Program Files\Avira\AntiVir Desktop\alldrives.avp

Protokollierung.......................: standard

Primäre Aktion........................: reparieren

Sekundäre Aktion......................: löschen

Durchsuche Masterbootsektoren.........: ein

Durchsuche Bootsektoren...............: ein

Bootsektoren..........................: C:, D:, E:, 

Durchsuche aktive Programme...........: ein

Durchsuche Registrierung..............: ein

Suche nach Rootkits...................: ein

Integritätsprüfung von Systemdateien..: ein

Optimierter Suchlauf..................: ein

Datei Suchmodus.......................: Alle Dateien

Durchsuche Archive....................: ein

Rekursionstiefe einschränken..........: aus

Archiv Smart Extensions...............: ein

Abweichende Archivtypen...............: +BSD Mailbox, +Netscape/Mozilla Mailbox, +Eudora Mailbox, +Squid cache, +Pegasus Mailbox, +MS Outlook Mailbox, +ISO 9660, +Windows Imaging File (WIM), 

Makrovirenheuristik...................: ein

Dateiheuristik........................: vollständig

Abweichende Gefahrenkategorien........: +JOKE,+PFS,+SPR,
 

Beginn des Suchlaufs: Montag, 2. April 2012  13:00
 

Der Suchlauf über die Masterbootsektoren wird begonnen:

Masterbootsektor HD0

    [INFO]      Es wurde kein Virus gefunden!
 

Der Suchlauf über die Bootsektoren wird begonnen:

Bootsektor 'C:\'

    [INFO]      Es wurde kein Virus gefunden!

Bootsektor 'D:\'

    [INFO]      Es wurde kein Virus gefunden!
 

Der Suchlauf nach versteckten Objekten wird begonnen.
 

Der Suchlauf über gestartete Prozesse wird begonnen:

Durchsuche Prozess 'TrustedInstaller.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'vssvc.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'avscan.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'iPodService.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'NMIndexingService.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'wmpnetwk.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'wmpnscfg.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'DslMgrSvc.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'ehmsas.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'wmiprvse.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'unsecapp.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'DslMgr.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'ehtray.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'avgnt.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'iTunesHelper.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'jusched.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'CLMLSvc.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'PM.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'RtHDVCpl.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'Explorer.EXE' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'Dwm.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'iashost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'taskeng.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'taskeng.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'xaudio.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'TestHandler.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'RichVideo.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'IoctlSvc.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'SMSvcHost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'mdm.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'lxbscoms.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'iviRegMgr.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'FSCWBaseUpdaterService.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'mDNSResponder.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'AppleMobileDeviceService.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'armsvc.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'sched.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'spoolsv.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'nvvsvc.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'SLsvc.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'nvvsvc.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'avshadow.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'avguard.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'winlogon.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'lsm.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'lsass.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'services.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'csrss.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'wininit.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'csrss.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'smss.exe' - '1' Modul(e) wurden durchsucht
 

Untersuchung der Systemdateien wird begonnen:

Signiert -> 'C:\Windows\system32\svchost.exe'

Signiert -> 'C:\Windows\system32\winlogon.exe'

Signiert -> 'C:\Windows\explorer.exe'

Signiert -> 'C:\Windows\system32\smss.exe'

Signiert -> 'C:\Windows\system32\wininet.DLL'

Signiert -> 'C:\Windows\system32\wsock32.DLL'

Signiert -> 'C:\Windows\system32\ws2_32.DLL'

Signiert -> 'C:\Windows\system32\services.exe'

Signiert -> 'C:\Windows\system32\lsass.exe'

Signiert -> 'C:\Windows\system32\csrss.exe'

Signiert -> 'C:\Windows\system32\drivers\kbdclass.sys'

Signiert -> 'C:\Windows\system32\spoolsv.exe'

Signiert -> 'C:\Windows\system32\alg.exe'

Signiert -> 'C:\Windows\system32\wuauclt.exe'

Signiert -> 'C:\Windows\system32\advapi32.DLL'

Signiert -> 'C:\Windows\system32\user32.DLL'

Signiert -> 'C:\Windows\system32\gdi32.DLL'

Signiert -> 'C:\Windows\system32\kernel32.DLL'

Signiert -> 'C:\Windows\system32\ntdll.DLL'

Signiert -> 'C:\Windows\system32\ntoskrnl.exe'

Signiert -> 'C:\Windows\system32\ctfmon.exe'

Die Systemdateien wurden durchsucht ('21' Dateien)
 

Der Suchlauf auf Verweise zu ausführbaren Dateien (Registry) wird begonnen:

Die Registry wurde durchsucht ( '1391' Dateien ).
 
 

Der Suchlauf über die ausgewählten Dateien wird begonnen:
 

Beginne mit der Suche in 'C:\' <SYSTEM>

Beginne mit der Suche in 'D:\' <DATA>

Beginne mit der Suche in 'E:\'

Der zu durchsuchende Pfad E:\ konnte nicht geöffnet werden!

Systemfehler [21]: Das Gerät ist nicht bereit.
 
 

Ende des Suchlaufs: Montag, 2. April 2012  14:48

Benötigte Zeit:  1:47:22 Stunde(n)
 

Der Suchlauf wurde vollständig durchgeführt.
 

  31136 Verzeichnisse wurden überprüft

 710028 Dateien wurden geprüft

      0 Viren bzw. unerwünschte Programme wurden gefunden

      0 Dateien wurden als verdächtig eingestuft

      0 Dateien wurden gelöscht

      0 Viren bzw. unerwünschte Programme wurden repariert

      0 Dateien wurden in die Quarantäne verschoben

      0 Dateien wurden umbenannt

      0 Dateien konnten nicht durchsucht werden

 710028 Dateien ohne Befall

  24763 Archive wurden durchsucht

      0 Warnungen

      0 Hinweise

 114892 Objekte wurden beim Rootkitscan durchsucht

      0 Versteckte Objekte wurden gefunden

MBAM:

Code:

Malwarebytes Anti-Malware 1.60.1.1000

www.malwarebytes.org
 

Datenbank Version: v2012.04.02.03
 

Windows Vista Service Pack 2 x86 NTFS

Internet Explorer 9.0.8112.16421

*** :: ALLE-PC [Administrator]
 

02.04.2012 14:55:17

mbam-log-2012-04-02 (14-55-17).txt
 

Art des Suchlaufs: Vollständiger Suchlauf

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 424431

Laufzeit: 3 Stunde(n), 1 Minute(n), 47 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 0

(Keine bösartigen Objekte gefunden)
 

(Ende)

Dann wurde im abgesicherten Modus gescannt:

MBAM:

Code:

Malwarebytes Anti-Malware 1.60.1.1000

www.malwarebytes.org
 

Datenbank Version: v2012.04.03.05
 

Windows Vista Service Pack 2 x86 NTFS (Abgesichertenmodus/Netzwerkfähig)

Internet Explorer 9.0.8112.16421

*** :: ALLE-PC [Administrator]
 

03.04.2012 11:06:06

mbam-log-2012-04-03 (11-06-06).txt
 

Art des Suchlaufs: Vollständiger Suchlauf

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 436211

Laufzeit: 1 Stunde(n), 31 Minute(n), 12 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 0

(Keine bösartigen Objekte gefunden)
 

(Ende)

ESET:

Code:

ESETSmartInstaller@High as CAB hook log:

OnlineScanner.ocx - registred OK

# version=7

# iexplore.exe=9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)

# OnlineScanner.ocx=1.0.0.6583

# api_version=3.0.2

# EOSSerial=008ae93639df714692026094f4b4ebb2

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2012-04-03 02:28:01

# local_time=2012-04-03 04:28:01 (+0100, Mitteleuropäische Sommerzeit)

# country="Germany"

# lang=1033

# osver=6.0.6002 NT Service Pack 2

# compatibility_mode=1792 16777215 100 0 100600 100600 0 0

# compatibility_mode=5892 16776574 100 100 6559636 170982783 0 0

# compatibility_mode=8192 67108863 100 0 214 214 0 0

# scanned=216311

# found=1

# cleaned=0

# scan_time=12123

C:\Program Files\vispa\vispa.exe        probably a variant of Win32/Agent.BGLQJOV trojan (unable to clean)        00000000000000000000000000000000        I

Zitat:

C:\Program Files\vispa\vispa.exe

Kennst du das, was soll das sein?

Ja, ist zwar nicht mein Computer, aber mein Vater hat es installiert.

Zitat:

Zitat von COMPUTER BILD

Mit dem kostenlosen Systemtool „Vispa“ verwalten Sie eine Vielzahl verborgener Einstellungen von Windows Vista. Eine Baumansicht listet verschiedene Registry-Einträge auf, mit denen Sie überflüssige Verknüpfungen löschen, unnötige Dienste deaktivieren oder das Übermitteln persönlicher Daten abschalten können.

Dann ist das ein Fehlalarm.

Hätte da mal zwei Fragen bevor es weiter geht

1.) Geht der normale Modus wieder uneingeschränkt?
2.) Vermisst du irgendwas im Startmenü? Sind da leere Ordner unter alle Programme oder ist alles vorhanden?

Ja, der normale Modus funktioniert und ich vermisse nichts im Startmenü. Es ist alles vorhanden.

CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

Starte bitte die OTL.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Setze oben mittig den Haken bei Scanne alle Benutzer
Kopiere nun den kompletten Inhalt aus der untenstehenden Codebox in die http://billy-oneal.com/Canned%20Spee.../customFix.png Textbox von OTL - wenn OTL auf deutsch ist wird sie mit http://larusso.trojaner-board.de/Images/otlfix.jpg beschriftet

Code:

netsvcs

msconfig

safebootminimal

safebootnetwork

activex

drivers32

%ALLUSERSPROFILE%\Application Data\*.

%ALLUSERSPROFILE%\Application Data\*.exe /s

%APPDATA%\*.

%APPDATA%\*.exe /s

%SYSTEMDRIVE%\*.exe

/md5start

wininit.exe

userinit.exe

eventlog.dll

scecli.dll

netlogon.dll

cngaudit.dll

ws2ifsl.sys

sceclt.dll

ntelogon.dll

winlogon.exe

logevent.dll

user32.DLL

iaStor.sys

nvstor.sys

atapi.sys

IdeChnDr.sys

viasraid.sys

AGP440.sys

vaxscsi.sys

nvatabus.sys

viamraid.sys

nvata.sys

nvgts.sys

iastorv.sys

ViPrt.sys

eNetHook.dll

ahcix86.sys

KR10N.sys

nvstor32.sys

ahcix86s.sys

/md5stop

%systemroot%\system32\drivers\*.sys /lockedfiles

%systemroot%\System32\config\*.sav

%systemroot%\*. /mp /s

%systemroot%\system32\*.dll /lockedfiles

CREATERESTOREPOINT

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Klick auf http://billy-oneal.com/Canned%20Spee.../OTL/btnOK.png.
Kopiere nun den Inhalt aus OTL.txt hier in Deinen Thread

Code:

OTL logfile created on: 04.04.2012 17:13:20 - Run 1

OTL by OldTimer - Version 3.2.39.2     Folder = C:\Users\***\Desktop

Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

2,00 Gb Total Physical Memory | 1,31 Gb Available Physical Memory | 65,56% Memory free

4,23 Gb Paging File | 3,40 Gb Available in Paging File | 80,52% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 148,10 Gb Total Space | 81,61 Gb Free Space | 55,11% Space Free | Partition Type: NTFS

Drive D: | 73,07 Gb Total Space | 33,24 Gb Free Space | 45,49% Space Free | Partition Type: NTFS

 

Computer Name: ALLE-PC | User Name: *** | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2012.04.04 17:10:11 | 000,593,920 | ---- | M] (OldTimer Tools) -- C:\Users\***\Desktop\OTL.exe

PRC - [2012.04.02 11:09:44 | 000,353,440 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\Macromed\Flash\FlashUtil32_11_2_202_228_ActiveX.exe

PRC - [2012.01.31 08:56:34 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avshadow.exe

PRC - [2012.01.31 08:56:05 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe

PRC - [2012.01.31 08:55:48 | 000,258,512 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

PRC - [2012.01.31 08:55:48 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe

PRC - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe

PRC - [2009.04.10 23:27:38 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe

PRC - [2008.10.23 17:45:14 | 000,307,200 | ---- | M] (T-Systems Enterprise Services GmbH) -- C:\Program Files\DSL-Manager\DslMgrSvc.exe

PRC - [2008.07.18 20:52:16 | 000,104,936 | ---- | M] (CyberLink) -- C:\Program Files\HomeCinema\Power2Go\CLMLSvc.exe

PRC - [2008.01.18 23:33:12 | 000,017,408 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iashost.exe

PRC - [2007.11.26 14:51:00 | 001,085,440 | ---- | M] (T-Systems Enterprise Services GmbH) -- C:\Program Files\DSL-Manager\DslMgr.exe

PRC - [2007.06.04 16:20:38 | 000,065,536 | ---- | M] () -- C:\Program Files\Fujitsu Siemens Computers\FSCLounge\FSCWBaseUpdaterService\2\FSCWBaseUpdaterService.exe

PRC - [2007.03.16 00:49:34 | 000,537,520 | ---- | M] ( ) -- C:\Windows\System32\lxbscoms.exe

PRC - [2007.03.13 16:01:40 | 000,029,696 | ---- | M] () -- C:\Program Files\Power Manager\PM.exe

PRC - [2007.01.18 14:46:56 | 004,349,952 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe

PRC - [2007.01.04 20:48:52 | 000,112,152 | R--- | M] (InterVideo) -- c:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe

PRC - [2006.12.08 11:52:04 | 000,204,800 | ---- | M] (Fujitsu Siemens Computers) -- C:\FirstSteps\OnlineDiagnostic\TestManager\TestHandler.exe

 

 
 ========== Modules (No Company Name) ==========

 

MOD - [2011.11.02 00:26:32 | 000,087,912 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll

MOD - [2011.11.02 00:26:12 | 001,242,472 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll

MOD - [2008.07.18 20:52:08 | 000,649,704 | ---- | M] () -- C:\Program Files\HomeCinema\Power2Go\CLMediaLibrary.dll

MOD - [2008.06.09 10:55:08 | 000,013,096 | ---- | M] () -- C:\Program Files\HomeCinema\Power2Go\CLMLSvcPS.dll

MOD - [2007.03.13 16:01:40 | 000,029,696 | ---- | M] () -- C:\Program Files\Power Manager\PM.exe

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV - File not found [Auto | Stopped] -- c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe /h ccCommon -- (CLTNetCnService)

SRV - [2012.04.02 11:09:45 | 000,253,600 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)

SRV - [2012.01.31 08:56:05 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)

SRV - [2012.01.31 08:55:48 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)

SRV - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)

SRV - [2008.11.04 03:37:58 | 000,410,624 | ---- | M] (Conexant Systems, Inc.) [Auto | Running] -- C:\Windows\System32\XAudio32.dll -- (HsfXAudioService)

SRV - [2008.10.23 17:45:14 | 000,307,200 | ---- | M] (T-Systems Enterprise Services GmbH) [On_Demand | Running] -- C:\Program Files\DSL-Manager\DslMgrSvc.exe -- (TDslMgrService)

SRV - [2008.01.18 23:38:26 | 000,272,952 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)

SRV - [2007.06.04 16:20:38 | 000,065,536 | ---- | M] () [Auto | Running] -- C:\Program Files\Fujitsu Siemens Computers\FSCLounge\FSCWBaseUpdaterService\2\FSCWBaseUpdaterService.exe -- (FSCLBaseUpdaterService)

SRV - [2007.03.16 00:49:34 | 000,537,520 | ---- | M] ( ) [Auto | Running] -- C:\Windows\System32\lxbscoms.exe -- (lxbs_device)

SRV - [2007.01.04 20:48:52 | 000,112,152 | R--- | M] (InterVideo) [Auto | Running] -- c:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe -- (IviRegMgr)

SRV - [2006.12.08 11:52:04 | 000,204,800 | ---- | M] (Fujitsu Siemens Computers) [Auto | Running] -- C:\FirstSteps\OnlineDiagnostic\TestManager\TestHandler.exe -- (TestHandler)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\system32\12C5.tmp -- (MEMSWEEP2)

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp)

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\STK02HW2.sys -- (DCamUSBSTK02H)

DRV - File not found [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\blbdrive.sys -- (blbdrive)

DRV - [2012.01.31 08:56:33 | 000,137,416 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)

DRV - [2012.01.31 08:56:33 | 000,074,640 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)

DRV - [2011.09.16 16:08:07 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr)

DRV - [2010.06.02 18:54:46 | 000,717,296 | ---- | M] (Duplex Secure Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\sptd.sys -- (sptd)

DRV - [2009.12.11 08:17:14 | 011,515,848 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)

DRV - [2009.10.08 16:55:33 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)

DRV - [2009.09.05 14:25:36 | 001,183,744 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr)

DRV - [2009.04.10 22:06:28 | 000,019,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\WSDScan.sys -- (WSDScan)

DRV - [2009.04.03 10:18:44 | 000,049,904 | R--- | M] (Avanquest Software) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\BVRPMPR5.SYS -- (BVRPMPR5)

DRV - [2008.11.04 03:32:20 | 000,008,704 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\XAudio32.sys -- (XAudio)

DRV - [2008.10.09 15:42:42 | 000,017,408 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\KMWDFILTER.sys -- (KMWDFILTER)

DRV - [2008.09.02 16:03:54 | 000,168,704 | ---- | M] (10moons Technologies Co.,Ltd) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\tridvid.sys -- (TridVid)

DRV - [2008.01.29 12:55:00 | 001,042,464 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvmfdx32.sys -- (NVENETFD)

DRV - [2008.01.18 22:15:00 | 000,016,896 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\WSDPrint.sys -- (WSDPrintDevice)

DRV - [2007.09.12 17:24:00 | 000,026,816 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\DslTestSp5.sys -- (dsltestSp5)

DRV - [2007.09.07 01:00:00 | 000,783,272 | ---- | M] (Bison Electronics. Inc. ) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\BisonCam.sys -- (Cam5603D)

DRV - [2007.08.09 19:12:30 | 000,110,624 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\nvstor32.sys -- (nvstor32)

DRV - [2007.08.01 14:49:00 | 000,016,448 | ---- | M] (T-Systems Enterprise Services GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\dslmnlwf.sys -- (DslMNLwf)

DRV - [2007.07.02 17:37:10 | 000,131,616 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\nvrd32.sys -- (nvrd32)

DRV - [2007.06.13 23:47:12 | 000,048,256 | ---- | M] (JMicron Technology Corp.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\jraid.sys -- (JRAID)

DRV - [2007.02.02 09:51:14 | 000,040,448 | ---- | M] (SMSC) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\smscirrx.sys -- (smscirrx)

DRV - [2007.01.04 12:15:08 | 000,009,336 | ---- | M] (hxxp://www.internals.com) [Kernel | System | Running] -- C:\Windows\System32\WinIo.sys -- (WINIO)

DRV - [2006.11.06 15:27:36 | 000,100,400 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\slabser.sys -- (slabser)

DRV - [2006.11.06 15:27:36 | 000,066,672 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\slabbus.sys -- (slabbus) CP210x USB Composite Device driver (WDM)

DRV - [2006.10.30 15:35:20 | 000,140,800 | ---- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Apfiltr.sys -- (ApfiltrService)

DRV - [2006.09.15 08:44:18 | 000,011,520 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvsmu.sys -- (nvsmu)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE - HKLM\..\URLSearchHook: {f4e6547e-325b-403c-a3bb-ad29ed37a92f} - C:\Program Files\SearchElf_1.2\prxtbSea0.dll (Conduit Ltd.)

IE - HKLM\..\SearchScopes,DefaultScope = {afdbddaa-5d3f-42ee-b79c-185a7020515b}

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2769726

 

 

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

 

 

IE - HKU\S-1-5-21-2954311596-1565164629-2574654167-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank

IE - HKU\S-1-5-21-2954311596-1565164629-2574654167-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp

IE - HKU\S-1-5-21-2954311596-1565164629-2574654167-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de

IE - HKU\S-1-5-21-2954311596-1565164629-2574654167-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = E0 5C D0 C2 74 D3 CC 01  [binary data]

IE - HKU\S-1-5-21-2954311596-1565164629-2574654167-1001\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKU\S-1-5-21-2954311596-1565164629-2574654167-1001\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC

IE - HKU\S-1-5-21-2954311596-1565164629-2574654167-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

 
 ========== FireFox ==========

 

FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()

FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)

FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0:  File not found

FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.3.1: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.3.1: C:\Program Files\Oracle\JavaFX 2.0 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=1.0.5: C:\Program Files\VideoLAN\VLC\npvlc.dll (the VideoLAN Team)

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

 

 

 

O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1       localhost

O1 - Hosts: ::1             localhost

O2 - BHO: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)

O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Oracle\JavaFX 2.0 Runtime\bin\jp2ssv.dll (Oracle Corporation)

O2 - BHO: (SearchElf 1.2 Toolbar) - {f4e6547e-325b-403c-a3bb-ad29ed37a92f} - C:\Program Files\SearchElf_1.2\prxtbSea0.dll (Conduit Ltd.)

O3 - HKLM\..\Toolbar: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)

O3 - HKLM\..\Toolbar: (SearchElf 1.2 Toolbar) - {f4e6547e-325b-403c-a3bb-ad29ed37a92f} - C:\Program Files\SearchElf_1.2\prxtbSea0.dll (Conduit Ltd.)

O3 - HKU\S-1-5-21-2954311596-1565164629-2574654167-1001\..\Toolbar\WebBrowser: (no name) - {EBF2BA02-9094-4C5A-858B-BB198F3D8DE2} - No CLSID value found.

O3 - HKU\S-1-5-21-2954311596-1565164629-2574654167-1001\..\Toolbar\WebBrowser: (SearchElf 1.2 Toolbar) - {F4E6547E-325B-403C-A3BB-AD29ED37A92F} - C:\Program Files\SearchElf_1.2\prxtbSea0.dll (Conduit Ltd.)

O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)

O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)

O4 - HKLM..\Run: [CLMLServer] C:\Program Files\HomeCinema\Power2Go\CLMLSvc.exe (CyberLink)

O4 - HKLM..\Run: [PowerManager] C:\Program Files\Power Manager\PM.exe ()

O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)

O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)

O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)

O4 - HKU\S-1-5-21-2954311596-1565164629-2574654167-1001..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe (Nero AG)

O4 - Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DSL-Manager.lnk = C:\Program Files\DSL-Manager\DslMgr.exe (T-Systems Enterprise Services GmbH)

O4 - Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DSL-Manager.lnk = C:\Program Files\DSL-Manager\DslMgr.exe (T-Systems Enterprise Services GmbH)

O4 - Startup: C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DSL-Manager.lnk = C:\Program Files\DSL-Manager\DslMgr.exe (T-Systems Enterprise Services GmbH)

O4 - Startup: C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DSL-Manager.lnk = C:\Program Files\DSL-Manager\DslMgr.exe (T-Systems Enterprise Services GmbH)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)

O13 - gopher Prefix: missing

O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)

O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab (System Requirements Lab Class)

O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 10.3.1)

O16 - DPF: {CAFEEFAC-0017-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 1.7.0_03)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 1.7.0_03)

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{8660B1CA-198A-4D32-A3BD-4630E08FAD64}: DhcpNameServer = 192.168.0.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{AD197E5A-BCDB-411A-84B2-A2144B7340F9}: DhcpNameServer = 192.168.0.1

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)

O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img29.jpg

O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img29.jpg

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

O33 - MountPoints2\{7c2dfa00-fb52-11dc-9606-00140b4345ce}\Shell - "" = AutoRun

O33 - MountPoints2\{7c2dfa00-fb52-11dc-9606-00140b4345ce}\Shell\AutoRun\command - "" = H:\LaunchU3.exe -a

O34 - HKLM BootExecute: (autocheck autochk *)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 

NetSvcs: FastUserSwitchingCompatibility -  File not found

NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)

NetSvcs: Nla -  File not found

NetSvcs: Ntmssvc -  File not found

NetSvcs: NWCWorkstation -  File not found

NetSvcs: Nwsapagent -  File not found

NetSvcs: SRService -  File not found

NetSvcs: WmdmPmSp -  File not found

NetSvcs: LogonHours -  File not found

NetSvcs: PCAudit -  File not found

NetSvcs: helpsvc -  File not found

NetSvcs: uploadmgr -  File not found

 

MsConfig - StartUpReg: Windows Defender - hkey= - key= -  File not found

MsConfig - State: "bootini" - 2

MsConfig - State: "startup" - 2

 

SafeBootMin: AppMgmt - Service

SafeBootMin: Base - Driver Group

SafeBootMin: Boot Bus Extender - Driver Group

SafeBootMin: Boot file system - Driver Group

SafeBootMin: File system - Driver Group

SafeBootMin: Filter - Driver Group

SafeBootMin: HelpSvc - Service

SafeBootMin: NTDS -  File not found

SafeBootMin: PCI Configuration - Driver Group

SafeBootMin: PNP Filter - Driver Group

SafeBootMin: Primary disk - Driver Group

SafeBootMin: sacsvr - Service

SafeBootMin: SCSI Class - Driver Group

SafeBootMin: System Bus Extender - Driver Group

SafeBootMin: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)

SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

SafeBootNet: AppMgmt - Service

SafeBootNet: Base - Driver Group

SafeBootNet: Boot Bus Extender - Driver Group

SafeBootNet: Boot file system - Driver Group

SafeBootNet: File system - Driver Group

SafeBootNet: Filter - Driver Group

SafeBootNet: HelpSvc - Service

SafeBootNet: Messenger - Service

SafeBootNet: NDIS Wrapper - Driver Group

SafeBootNet: NetBIOSGroup - Driver Group

SafeBootNet: NetDDEGroup - Driver Group

SafeBootNet: Network - Driver Group

SafeBootNet: NetworkProvider - Driver Group

SafeBootNet: NTDS -  File not found

SafeBootNet: PCI Configuration - Driver Group

SafeBootNet: PNP Filter - Driver Group

SafeBootNet: PNP_TDI - Driver Group

SafeBootNet: Primary disk - Driver Group

SafeBootNet: rdsessmgr - Service

SafeBootNet: sacsvr - Service

SafeBootNet: SCSI Class - Driver Group

SafeBootNet: Streams Drivers - Driver Group

SafeBootNet: System Bus Extender - Driver Group

SafeBootNet: TDI - Driver Group

SafeBootNet: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)

SafeBootNet: WudfPf - Driver

SafeBootNet: WudfUsbccidDriver - Driver

SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net

SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient

SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService

SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans

SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers

SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

ActiveX: {0213C6AF-5562-4D09-884C-2ADCFC8C2F35} - Microsoft .NET Framework 1.1 Security Update (KB2656353)

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)

ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - 

ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0

ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework

ActiveX: {2A3320D6-C805-4280-B423-B665BDE33D8F} - Microsoft .NET Framework 1.1 Security Update (KB979906)

ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework

ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)

ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - 

ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Webordner

ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings

ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install

ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework

ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1

ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player

ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX: {E78BFA60-5393-4C38-82AB-E8019E464EB4} - .NET Framework

ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP

ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig

ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

 

Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: msacm.l3codecp - C:\Windows\System32\l3codecp.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)

Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)

Drivers32: vidc.DIVX - C:\Windows\System32\DivX.dll (DivX, Inc.)

Drivers32: vidc.i420 - C:\Windows\System32\i420vfw.dll (www.helixcommunity.org)

Drivers32: vidc.yv12 - C:\Windows\System32\DivX.dll (DivX, Inc.)

 

CREATERESTOREPOINT

Restore point Set: OTL Restore Point

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2012.04.04 17:10:10 | 000,593,920 | ---- | C] (OldTimer Tools) -- C:\Users\***\Desktop\OTL.exe

[2012.04.03 12:44:01 | 000,000,000 | ---D | C] -- C:\Program Files\ESET

[2012.04.02 11:02:24 | 000,000,000 | ---D | C] -- C:\Users\***\Desktop\scan

[2012.04.02 10:23:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2012.04.02 10:23:09 | 000,020,464 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys

[2012.04.02 09:27:44 | 000,000,000 | -HSD | C] -- C:\Config.Msi

[2012.04.02 09:23:45 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft WSE

[2012.04.02 09:21:46 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\PackageAware

[2012.04.02 08:53:14 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Avira

[2012.04.02 08:51:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira

[2012.04.02 08:50:58 | 000,028,520 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\ssmdrv.sys

[2012.04.02 08:50:57 | 000,036,000 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avkmgr.sys

[2012.04.02 08:50:56 | 000,137,416 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avipbb.sys

[2012.04.02 08:50:56 | 000,074,640 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avgntflt.sys

[2012.04.02 08:50:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira

[2012.04.02 08:50:55 | 000,000,000 | ---D | C] -- C:\Program Files\Avira

[2012.04.01 21:22:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes

[2012.04.01 21:21:42 | 000,000,000 | ---D | C] -- C:\Program Files\iPod

[2012.04.01 21:21:39 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes

[2012.04.01 20:34:42 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java

[2012.04.01 16:44:09 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Malwarebytes

[2012.04.01 16:43:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2012.04.01 16:43:57 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware

[2012.03.31 21:53:02 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java(1)

[2012.03.31 16:59:46 | 000,000,000 | ---D | C] -- C:\Windows\Temp

[2012.03.25 18:34:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira(91)

 
 ========== Files - Modified Within 30 Days ==========

 

[2012.04.04 17:10:11 | 000,593,920 | ---- | M] (OldTimer Tools) -- C:\Users\***\Desktop\OTL.exe

[2012.04.04 17:08:09 | 000,139,818 | ---- | M] () -- C:\ProgramData\nvModes.dat

[2012.04.04 17:08:08 | 000,139,818 | ---- | M] () -- C:\ProgramData\nvModes.001

[2012.04.04 17:02:54 | 000,638,748 | ---- | M] () -- C:\Windows\System32\perfh007.dat

[2012.04.04 17:02:54 | 000,604,324 | ---- | M] () -- C:\Windows\System32\perfh009.dat

[2012.04.04 17:02:54 | 000,130,668 | ---- | M] () -- C:\Windows\System32\perfc007.dat

[2012.04.04 17:02:54 | 000,107,760 | ---- | M] () -- C:\Windows\System32\perfc009.dat

[2012.04.04 16:58:43 | 000,003,168 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0

[2012.04.04 16:58:43 | 000,003,168 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0

[2012.04.04 16:58:31 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job

[2012.04.04 16:57:59 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2012.04.04 16:57:53 | 2144,370,688 | -HS- | M] () -- C:\hiberfil.sys

[2012.04.04 15:48:09 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat

[2012.04.04 15:48:05 | 000,000,757 | ---- | M] () -- C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DSL-Manager.lnk

[2012.04.03 18:01:04 | 000,001,356 | ---- | M] () -- C:\Users\***\AppData\Local\d3d9caps.dat

[2012.04.02 11:05:32 | 000,000,020 | ---- | M] () -- C:\Users\***\defogger_reenable

[2012.04.02 08:51:13 | 000,001,813 | ---- | M] () -- C:\Users\Public\Desktop\Avira Control Center.lnk

[2012.04.01 21:22:25 | 000,001,630 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk

[2012.04.01 20:20:11 | 000,434,368 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT

 
 ========== Files Created - No Company Name ==========

 

[2012.04.04 15:34:40 | 2144,370,688 | -HS- | C] () -- C:\hiberfil.sys

[2012.04.02 11:09:45 | 000,000,884 | ---- | C] () -- C:\Windows\tasks\Adobe Flash Player Updater.job

[2012.04.02 11:05:09 | 000,000,020 | ---- | C] () -- C:\Users\***\defogger_reenable

[2012.04.02 08:51:13 | 000,001,813 | ---- | C] () -- C:\Users\Public\Desktop\Avira Control Center.lnk

[2012.04.01 21:22:25 | 000,001,630 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk

[2010.12.30 12:39:49 | 000,000,215 | ---- | C] () -- C:\Windows\gkv501me.INI

[2010.12.30 12:39:49 | 000,000,202 | ---- | C] () -- C:\Windows\gkv501di.INI

[2010.12.30 12:39:49 | 000,000,200 | ---- | C] () -- C:\Windows\gkv501ti.INI

[2010.12.30 12:39:49 | 000,000,131 | ---- | C] () -- C:\Windows\gkstart1.INI

[2010.12.30 12:39:30 | 000,375,296 | ---- | C] () -- C:\Windows\System32\tx32.dll

[2010.12.30 12:39:26 | 000,000,202 | ---- | C] () -- C:\Windows\System32\IC32.INI

 
 ========== LOP Check ==========

 

[2011.02.27 15:58:35 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\T-Online

[2011.04.27 11:05:17 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Audacity

[2008.02.24 19:13:23 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Canon

[2008.02.14 18:31:37 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\InterVideo

[2008.03.01 18:45:18 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\klickTel

[2011.10.09 15:42:14 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\OpenOffice.org

[2011.04.25 19:45:30 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\PhotoScape

[2008.02.28 17:14:43 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\T-Online

[2008.02.14 20:00:56 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Template

[2009.12.26 23:59:51 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\TuneUp Software

[2008.05.18 21:29:10 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\XnView

[2008.05.01 11:35:09 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\InterVideo

[2012.01.18 16:51:10 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\LibreOffice

[2012.01.18 15:34:55 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\OpenOffice.org

[2008.02.10 13:39:30 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\PeerNetworking

[2008.03.21 18:47:36 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\T-Online

[2009.12.25 19:32:45 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\TuneUp Software

[2012.04.04 15:48:10 | 000,032,514 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

 
 ========== Purity Check ==========

 

 

 
 ========== Custom Scans ==========

 
 < %ALLUSERSPROFILE%\Application Data\*. >

 
 < %ALLUSERSPROFILE%\Application Data\*.exe /s >

 
 < %APPDATA%\*. >

[2012.01.15 15:09:21 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Adobe

[2009.10.19 13:52:12 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Ahead

[2012.01.15 22:26:38 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Apple Computer

[2012.04.02 08:53:14 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Avira

[2009.10.19 14:12:31 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Help

[2008.02.10 11:32:39 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Identities

[2008.05.01 11:35:09 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\InterVideo

[2012.01.18 16:51:10 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\LibreOffice

[2008.03.21 19:27:58 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Macromedia

[2012.04.01 16:44:09 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Malwarebytes

[2006.11.02 14:37:34 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Media Center Programs

[2012.04.02 09:23:47 | 000,000,000 | --SD | M] -- C:\Users\***\AppData\Roaming\Microsoft

[2012.01.18 15:34:55 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\OpenOffice.org

[2011.02.08 23:25:37 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\OpenOffice.org2

[2008.02.10 13:39:30 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\PeerNetworking

[2008.03.21 18:47:36 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\T-Online

[2009.12.25 19:32:45 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\TuneUp Software

 
 < %APPDATA%\*.exe /s >

[2012.04.02 09:23:47 | 000,010,134 | R--- | M] () -- C:\Users\***\AppData\Roaming\Microsoft\Installer\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}\ARPPRODUCTICON.exe

 
 < %SYSTEMDRIVE%\*.exe >

 
 < MD5 for: AGP440.SYS  >

[2008.01.18 23:42:26 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_51b95d75\AGP440.sys

[2008.01.18 23:42:26 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys

[2008.01.18 23:42:26 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys

[2008.01.18 23:42:26 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_bbfe6647bbd2a4c6\AGP440.sys

[2007.11.03 01:26:51 | 000,056,504 | ---- | M] (Microsoft Corporation) MD5=198636E76971EBC96404547EC0FD5E75 -- C:\Windows\System32\drivers\AGP440.sys

[2007.11.03 01:26:51 | 000,056,504 | ---- | M] (Microsoft Corporation) MD5=198636E76971EBC96404547EC0FD5E75 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_cb7c81c7\AGP440.sys

[2007.11.03 01:26:51 | 000,056,504 | ---- | M] (Microsoft Corporation) MD5=198636E76971EBC96404547EC0FD5E75 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6000.20598_none_b85cfa98dae9b436\AGP440.sys

[2006.11.02 11:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys

 
 < MD5 for: ATAPI.SYS  >

[2007.11.03 01:53:24 | 000,021,688 | ---- | M] (Microsoft Corporation) MD5=0B77F93AB73798F97E8E0A0AA4CCBEEF -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_44b6b0d0\atapi.sys

[2007.11.03 01:53:24 | 000,021,688 | ---- | M] (Microsoft Corporation) MD5=0B77F93AB73798F97E8E0A0AA4CCBEEF -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20694_none_db7e36353dc64123\atapi.sys

[2009.04.10 23:32:28 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\drivers\atapi.sys

[2009.04.10 23:32:28 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_b12d8e84\atapi.sys

[2009.04.10 23:32:28 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys

[2008.01.17 18:54:38 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=224505155EC3E36D7A1F36E446F04C2A -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_ecc53ff9\atapi.sys

[2008.01.17 18:54:38 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=224505155EC3E36D7A1F36E446F04C2A -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16584_none_daff695624a08568\atapi.sys

[2008.01.18 23:41:32 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys

[2008.01.18 23:41:32 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys

[2006.11.02 11:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys

[2008.01.17 18:54:38 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=BFD3DF48C9ED81934FE21E8E3CFC2496 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_27cad3e5\atapi.sys

[2008.01.17 18:54:38 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=BFD3DF48C9ED81934FE21E8E3CFC2496 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20707_none_dbe288453d7a8ed6\atapi.sys

 
 < MD5 for: CNGAUDIT.DLL  >

[2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll

[2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll

 
 < MD5 for: EVENTLOG.DLL  >

[2007.01.12 23:30:08 | 000,007,216 | ---- | M] () MD5=C2A279A458A06DE2C83D842AA042B5A8 -- C:\Program Files\HomeCinema\PowerDirector\EventLog.dll

 
 < MD5 for: IASTOR.SYS  >

[2007.07.12 16:35:02 | 000,305,176 | ---- | M] (Intel Corporation) MD5=2358C53F30CB9DCD1D3843C4E2F299B2 -- C:\Windows\System32\drivers\iaStor.sys

[2007.07.12 16:35:02 | 000,305,176 | ---- | M] (Intel Corporation) MD5=2358C53F30CB9DCD1D3843C4E2F299B2 -- C:\Windows\System32\DriverStore\FileRepository\iastor.inf_ec8a8d1b\iaStor.sys

 
 < MD5 for: IASTORV.SYS  >

[2008.01.18 23:42:52 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_c9df7691\iaStorV.sys

[2008.01.18 23:42:52 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys

[2006.11.02 11:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\drivers\iaStorV.sys

[2006.11.02 11:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys

 
 < MD5 for: NETLOGON.DLL  >

[2006.11.02 11:46:11 | 000,559,616 | ---- | M] (Microsoft Corporation) MD5=889A2C9F2AACCD8F64EF50AC0B3D553B -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6000.16386_none_fb80f5473b0ed783\netlogon.dll

[2009.04.10 23:28:24 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\System32\netlogon.dll

[2009.04.10 23:28:24 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_ffa3304f351bb3a3\netlogon.dll

[2008.01.18 23:35:38 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll

 
 < MD5 for: NVSTOR.SYS  >

[2006.11.02 11:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\drivers\nvstor.sys

[2006.11.02 11:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys

[2008.01.18 23:42:10 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys

[2008.01.18 23:42:10 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys

 
 < MD5 for: NVSTOR32.SYS  >

[2007.01.27 17:21:04 | 000,101,160 | ---- | M] (NVIDIA Corporation) MD5=4A9A6368BEF61C9608FE7CC21B1F8886 -- C:\DRIVER\SATA\NFORCE\nvstor32.sys

[2007.01.27 17:21:04 | 000,101,160 | ---- | M] (NVIDIA Corporation) MD5=4A9A6368BEF61C9608FE7CC21B1F8886 -- C:\Windows\System32\DriverStore\FileRepository\nvstor32.inf_54ba863a\nvstor32.sys

[2007.07.02 17:37:08 | 000,110,112 | ---- | M] (NVIDIA Corporation) MD5=703E3A7093B0FAC0EEBADBB8E931ECAF -- C:\Windows\System32\DriverStore\FileRepository\nvrd32.inf_bbf77119\nvstor32.sys

[2007.08.09 19:12:30 | 000,110,624 | ---- | M] (NVIDIA Corporation) MD5=DC5F166422BEEBF195E3E4BB8AB4EE22 -- C:\Windows\System32\drivers\nvstor32.sys

[2007.08.09 19:12:30 | 000,110,624 | ---- | M] (NVIDIA Corporation) MD5=DC5F166422BEEBF195E3E4BB8AB4EE22 -- C:\Windows\System32\DriverStore\FileRepository\nvstor32.inf_99d8b088\nvstor32.sys

 
 < MD5 for: SCECLI.DLL  >

[2008.01.18 23:36:20 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll

[2006.11.02 11:46:12 | 000,176,640 | ---- | M] (Microsoft Corporation) MD5=80E2839D05CA5970A86D7BE2A08BFF61 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6000.16386_none_35d7205fdc305e3e\scecli.dll

[2009.04.10 23:28:26 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\System32\scecli.dll

[2009.04.10 23:28:26 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e\scecli.dll

 
 < MD5 for: USER32.DLL  >

[2007.11.03 01:17:10 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=3322B167C8F76319C991B851514DFAC9 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.20587_none_cb8c4940898e24a6\user32.dll

[2008.01.18 23:36:48 | 000,627,200 | ---- | M] (Microsoft Corporation) MD5=B974D9F06DC7D1908E825DC201681269 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_cd386c416d5c7f32\user32.dll

[2006.11.02 11:46:13 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=E698A5437B89A285ACA3FF022356810A -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.16386_none_cb01aa4570716e5e\user32.dll

[2009.04.10 23:28:26 | 000,627,712 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\user32.dll

[2009.04.10 23:28:26 | 000,627,712 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6002.18005_none_cf23e54d6a7e4a7e\user32.dll

 
 < MD5 for: USERINIT.EXE  >

[2008.01.18 23:33:34 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe

[2008.01.18 23:33:34 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe

[2006.11.02 11:45:50 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=22027835939F86C3E47AD8E3FBDE3D11 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6000.16386_none_d9f1f819d4c4e737\userinit.exe

 
 < MD5 for: VIAMRAID.SYS  >

[2006.11.08 15:23:52 | 000,102,912 | ---- | M] (VIA Technologies inc,.ltd) MD5=7DC3E1DC6E4F8BE381C31BFEA578412A -- C:\Windows\System32\drivers\viamraid.sys

[2006.11.08 15:23:52 | 000,102,912 | ---- | M] (VIA Technologies inc,.ltd) MD5=7DC3E1DC6E4F8BE381C31BFEA578412A -- C:\Windows\System32\DriverStore\FileRepository\viamraid.inf_74a36694\viamraid.sys

 
 < MD5 for: WININIT.EXE  >

[2008.01.18 23:33:38 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\System32\wininit.exe

[2008.01.18 23:33:38 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6001.18000_none_30f2b8cf0450a6a2\wininit.exe

[2007.11.03 01:17:50 | 000,095,744 | ---- | M] (Microsoft Corporation) MD5=39D959CD9F3BC44F78DB3C6588AAC3FE -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6000.20593_none_2f37c4ba208e02ab\wininit.exe

[2006.11.02 11:45:57 | 000,095,744 | ---- | M] (Microsoft Corporation) MD5=D4385B03E8CCCEE6F0EE249F827C1F3E -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6000.16386_none_2ebbf6d3076595ce\wininit.exe

 
 < MD5 for: WINLOGON.EXE  >

[2012.01.13 14:53:20 | 000,182,856 | ---- | M] () MD5=63EEC8A8B221AB79045E776E5F592868 -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe

[2009.04.10 23:28:14 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\System32\winlogon.exe

[2009.04.10 23:28:14 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe

[2006.11.02 11:45:57 | 000,308,224 | ---- | M] (Microsoft Corporation) MD5=9F75392B9128A91ABAFB044EA350BAAD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6000.16386_none_6d8c3f1ad8066b21\winlogon.exe

[2007.11.03 01:17:50 | 000,308,224 | ---- | M] (Microsoft Corporation) MD5=A3FEA6ED9FD3CF07219A632E4A716226 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6000.20593_none_6e080d01f12ed7fe\winlogon.exe

[2008.01.18 23:33:38 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe

 
 < MD5 for: WS2IFSL.SYS  >

[2006.11.02 10:58:26 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=84620AECDCFD2A7A14E6263927D8C0ED -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6000.16386_none_4d4fded8cae2956d\ws2ifsl.sys

[2008.01.18 21:56:50 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\System32\drivers\ws2ifsl.sys

[2008.01.18 21:56:50 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6001.18000_none_4f86a0d4c7cda641\ws2ifsl.sys

 
 < %systemroot%\system32\drivers\*.sys /lockedfiles >

 
 < %systemroot%\System32\config\*.sav >

[2008.01.18 03:38:11 | 008,011,776 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV

[2008.01.18 03:38:07 | 000,102,400 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV

[2008.01.18 03:38:12 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV

[2008.01.18 03:38:27 | 016,478,208 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV

[2008.01.18 03:38:29 | 006,029,312 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV

 
 < %systemroot%\*. /mp /s >

 
 < %systemroot%\system32\*.dll /lockedfiles >

 
 <           >
 

< End of report >

Zitat:

FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)

Sagmal gehörst du auch zur der Fraktion, die sich Serien und Kinofilme über dubiose Portale anschaut?
Wenn ja: in Zukunft Finger weg, diese illegalen Portale verbreiten Malware und wenn du in Zukunft malwarefrei sein wilst, musst du auf legale Alternativen ausweichen und auf solche riskanten Streamingseiten verzichten!
Gerade solche Streamingseiten sind für die aktuelle Welle der Erpresserschädlinge verantwortlich, die Windows blockieren und 50 oder 100 EUR erpressen wollen!!

Hab keine Ahnung, woher das kommt. Aber ich bin auf jeden Fall nicht auf solchen Seiten unterwegs. Filme und Serien sollte man im Kino, Fernsehen oder auf DVD/BluRay sehen und legal kaufen.

Na, dann deinstallier DivX wenn es sonst nicht mehr gebraucht wird. Mach dann wie o.g. ein neues OTL-Log.

So, DivX wurde deinstalliert. Btw: Firefox ist hier gar nicht installiert.
Hier das neue Log:

Code:

OTL logfile created on: 05.04.2012 08:54:13 - Run 2

OTL by OldTimer - Version 3.2.39.2     Folder = C:\Users\***\Desktop\scan

Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

2,00 Gb Total Physical Memory | 1,19 Gb Available Physical Memory | 59,46% Memory free

4,23 Gb Paging File | 3,23 Gb Available in Paging File | 76,40% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 148,10 Gb Total Space | 86,01 Gb Free Space | 58,08% Space Free | Partition Type: NTFS

Drive D: | 73,07 Gb Total Space | 33,25 Gb Free Space | 45,50% Space Free | Partition Type: NTFS

 

Computer Name: ALLE-PC | User Name: *** | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2012.04.04 17:10:11 | 000,593,920 | ---- | M] (OldTimer Tools) -- C:\Users\***\Desktop\scan\OTL.exe

PRC - [2012.01.31 08:56:34 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avshadow.exe

PRC - [2012.01.31 08:56:05 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe

PRC - [2012.01.31 08:55:48 | 000,258,512 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

PRC - [2012.01.31 08:55:48 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe

PRC - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe

PRC - [2009.04.10 23:28:16 | 000,117,248 | ---- | M] () -- \\?\C:\Windows\System32\wbem\WMIADAP.EXE

PRC - [2009.04.10 23:27:38 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe

PRC - [2008.10.23 17:45:14 | 000,307,200 | ---- | M] (T-Systems Enterprise Services GmbH) -- C:\Program Files\DSL-Manager\DslMgrSvc.exe

PRC - [2008.07.18 20:52:16 | 000,104,936 | ---- | M] (CyberLink) -- C:\Program Files\HomeCinema\Power2Go\CLMLSvc.exe

PRC - [2008.01.18 23:33:12 | 000,017,408 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iashost.exe

PRC - [2007.11.26 14:51:00 | 001,085,440 | ---- | M] (T-Systems Enterprise Services GmbH) -- C:\Program Files\DSL-Manager\DslMgr.exe

PRC - [2007.06.04 16:20:38 | 000,065,536 | ---- | M] () -- C:\Program Files\Fujitsu Siemens Computers\FSCLounge\FSCWBaseUpdaterService\2\FSCWBaseUpdaterService.exe

PRC - [2007.03.16 00:49:34 | 000,537,520 | ---- | M] ( ) -- C:\Windows\System32\lxbscoms.exe

PRC - [2007.03.13 16:01:40 | 000,029,696 | ---- | M] () -- C:\Program Files\Power Manager\PM.exe

PRC - [2007.01.18 14:46:56 | 004,349,952 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe

PRC - [2007.01.04 20:48:52 | 000,112,152 | R--- | M] (InterVideo) -- c:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe

PRC - [2006.12.08 11:52:04 | 000,204,800 | ---- | M] (Fujitsu Siemens Computers) -- C:\FirstSteps\OnlineDiagnostic\TestManager\TestHandler.exe

 

 
 ========== Modules (No Company Name) ==========

 

MOD - [2011.11.02 00:26:32 | 000,087,912 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll

MOD - [2011.11.02 00:26:12 | 001,242,472 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll

MOD - [2008.07.18 20:52:08 | 000,649,704 | ---- | M] () -- C:\Program Files\HomeCinema\Power2Go\CLMediaLibrary.dll

MOD - [2008.06.09 10:55:08 | 000,013,096 | ---- | M] () -- C:\Program Files\HomeCinema\Power2Go\CLMLSvcPS.dll

MOD - [2007.03.13 16:01:40 | 000,029,696 | ---- | M] () -- C:\Program Files\Power Manager\PM.exe

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV - File not found [Auto | Stopped] -- c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe /h ccCommon -- (CLTNetCnService)

SRV - [2012.04.02 11:09:45 | 000,253,600 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)

SRV - [2012.01.31 08:56:05 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)

SRV - [2012.01.31 08:55:48 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)

SRV - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)

SRV - [2008.11.04 03:37:58 | 000,410,624 | ---- | M] (Conexant Systems, Inc.) [Auto | Running] -- C:\Windows\System32\XAudio32.dll -- (HsfXAudioService)

SRV - [2008.10.23 17:45:14 | 000,307,200 | ---- | M] (T-Systems Enterprise Services GmbH) [On_Demand | Running] -- C:\Program Files\DSL-Manager\DslMgrSvc.exe -- (TDslMgrService)

SRV - [2008.01.18 23:38:26 | 000,272,952 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)

SRV - [2007.06.04 16:20:38 | 000,065,536 | ---- | M] () [Auto | Running] -- C:\Program Files\Fujitsu Siemens Computers\FSCLounge\FSCWBaseUpdaterService\2\FSCWBaseUpdaterService.exe -- (FSCLBaseUpdaterService)

SRV - [2007.03.16 00:49:34 | 000,537,520 | ---- | M] ( ) [Auto | Running] -- C:\Windows\System32\lxbscoms.exe -- (lxbs_device)

SRV - [2007.01.04 20:48:52 | 000,112,152 | R--- | M] (InterVideo) [Auto | Running] -- c:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe -- (IviRegMgr)

SRV - [2006.12.08 11:52:04 | 000,204,800 | ---- | M] (Fujitsu Siemens Computers) [Auto | Running] -- C:\FirstSteps\OnlineDiagnostic\TestManager\TestHandler.exe -- (TestHandler)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\system32\12C5.tmp -- (MEMSWEEP2)

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp)

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\STK02HW2.sys -- (DCamUSBSTK02H)

DRV - File not found [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\blbdrive.sys -- (blbdrive)

DRV - [2012.01.31 08:56:33 | 000,137,416 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)

DRV - [2012.01.31 08:56:33 | 000,074,640 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)

DRV - [2011.09.16 16:08:07 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr)

DRV - [2010.06.02 18:54:46 | 000,717,296 | ---- | M] (Duplex Secure Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\sptd.sys -- (sptd)

DRV - [2009.12.11 08:17:14 | 011,515,848 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)

DRV - [2009.10.08 16:55:33 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)

DRV - [2009.09.05 14:25:36 | 001,183,744 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr)

DRV - [2009.04.10 22:06:28 | 000,019,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\WSDScan.sys -- (WSDScan)

DRV - [2009.04.03 10:18:44 | 000,049,904 | R--- | M] (Avanquest Software) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\BVRPMPR5.SYS -- (BVRPMPR5)

DRV - [2008.11.04 03:32:20 | 000,008,704 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\XAudio32.sys -- (XAudio)

DRV - [2008.10.09 15:42:42 | 000,017,408 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\KMWDFILTER.sys -- (KMWDFILTER)

DRV - [2008.09.02 16:03:54 | 000,168,704 | ---- | M] (10moons Technologies Co.,Ltd) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\tridvid.sys -- (TridVid)

DRV - [2008.01.29 12:55:00 | 001,042,464 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvmfdx32.sys -- (NVENETFD)

DRV - [2008.01.18 22:15:00 | 000,016,896 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\WSDPrint.sys -- (WSDPrintDevice)

DRV - [2007.09.12 17:24:00 | 000,026,816 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\DslTestSp5.sys -- (dsltestSp5)

DRV - [2007.09.07 01:00:00 | 000,783,272 | ---- | M] (Bison Electronics. Inc. ) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\BisonCam.sys -- (Cam5603D)

DRV - [2007.08.09 19:12:30 | 000,110,624 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\nvstor32.sys -- (nvstor32)

DRV - [2007.08.01 14:49:00 | 000,016,448 | ---- | M] (T-Systems Enterprise Services GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\dslmnlwf.sys -- (DslMNLwf)

DRV - [2007.07.02 17:37:10 | 000,131,616 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\nvrd32.sys -- (nvrd32)

DRV - [2007.06.13 23:47:12 | 000,048,256 | ---- | M] (JMicron Technology Corp.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\jraid.sys -- (JRAID)

DRV - [2007.02.02 09:51:14 | 000,040,448 | ---- | M] (SMSC) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\smscirrx.sys -- (smscirrx)

DRV - [2007.01.04 12:15:08 | 000,009,336 | ---- | M] (hxxp://www.internals.com) [Kernel | System | Running] -- C:\Windows\System32\WinIo.sys -- (WINIO)

DRV - [2006.11.06 15:27:36 | 000,100,400 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\slabser.sys -- (slabser)

DRV - [2006.11.06 15:27:36 | 000,066,672 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\slabbus.sys -- (slabbus) CP210x USB Composite Device driver (WDM)

DRV - [2006.10.30 15:35:20 | 000,140,800 | ---- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Apfiltr.sys -- (ApfiltrService)

DRV - [2006.09.15 08:44:18 | 000,011,520 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvsmu.sys -- (nvsmu)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE - HKLM\..\URLSearchHook: {f4e6547e-325b-403c-a3bb-ad29ed37a92f} - C:\Program Files\SearchElf_1.2\prxtbSea0.dll (Conduit Ltd.)

IE - HKLM\..\SearchScopes,DefaultScope = {afdbddaa-5d3f-42ee-b79c-185a7020515b}

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2769726

 

 

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

 

 

IE - HKU\S-1-5-21-2954311596-1565164629-2574654167-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank

IE - HKU\S-1-5-21-2954311596-1565164629-2574654167-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp

IE - HKU\S-1-5-21-2954311596-1565164629-2574654167-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de

IE - HKU\S-1-5-21-2954311596-1565164629-2574654167-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = E0 5C D0 C2 74 D3 CC 01  [binary data]

IE - HKU\S-1-5-21-2954311596-1565164629-2574654167-1001\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKU\S-1-5-21-2954311596-1565164629-2574654167-1001\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC

IE - HKU\S-1-5-21-2954311596-1565164629-2574654167-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

 
 ========== FireFox ==========

 

FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()

FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0:  File not found

FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.3.1: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.3.1: C:\Program Files\Oracle\JavaFX 2.0 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=1.0.5: C:\Program Files\VideoLAN\VLC\npvlc.dll (the VideoLAN Team)

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

 

 

 

O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1       localhost

O1 - Hosts: ::1             localhost

O2 - BHO: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)

O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Oracle\JavaFX 2.0 Runtime\bin\jp2ssv.dll (Oracle Corporation)

O2 - BHO: (SearchElf 1.2 Toolbar) - {f4e6547e-325b-403c-a3bb-ad29ed37a92f} - C:\Program Files\SearchElf_1.2\prxtbSea0.dll (Conduit Ltd.)

O3 - HKLM\..\Toolbar: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)

O3 - HKLM\..\Toolbar: (SearchElf 1.2 Toolbar) - {f4e6547e-325b-403c-a3bb-ad29ed37a92f} - C:\Program Files\SearchElf_1.2\prxtbSea0.dll (Conduit Ltd.)

O3 - HKU\S-1-5-21-2954311596-1565164629-2574654167-1001\..\Toolbar\WebBrowser: (no name) - {EBF2BA02-9094-4C5A-858B-BB198F3D8DE2} - No CLSID value found.

O3 - HKU\S-1-5-21-2954311596-1565164629-2574654167-1001\..\Toolbar\WebBrowser: (SearchElf 1.2 Toolbar) - {F4E6547E-325B-403C-A3BB-AD29ED37A92F} - C:\Program Files\SearchElf_1.2\prxtbSea0.dll (Conduit Ltd.)

O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)

O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)

O4 - HKLM..\Run: [CLMLServer] C:\Program Files\HomeCinema\Power2Go\CLMLSvc.exe (CyberLink)

O4 - HKLM..\Run: [PowerManager] C:\Program Files\Power Manager\PM.exe ()

O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)

O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)

O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)

O4 - HKU\S-1-5-21-2954311596-1565164629-2574654167-1001..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe (Nero AG)

O4 - Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DSL-Manager.lnk = C:\Program Files\DSL-Manager\DslMgr.exe (T-Systems Enterprise Services GmbH)

O4 - Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DSL-Manager.lnk = C:\Program Files\DSL-Manager\DslMgr.exe (T-Systems Enterprise Services GmbH)

O4 - Startup: C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DSL-Manager.lnk = C:\Program Files\DSL-Manager\DslMgr.exe (T-Systems Enterprise Services GmbH)

O4 - Startup: C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DSL-Manager.lnk = C:\Program Files\DSL-Manager\DslMgr.exe (T-Systems Enterprise Services GmbH)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)

O13 - gopher Prefix: missing

O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)

O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab (System Requirements Lab Class)

O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 10.3.1)

O16 - DPF: {CAFEEFAC-0017-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 1.7.0_03)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 1.7.0_03)

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{8660B1CA-198A-4D32-A3BD-4630E08FAD64}: DhcpNameServer = 192.168.0.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{AD197E5A-BCDB-411A-84B2-A2144B7340F9}: DhcpNameServer = 192.168.0.1

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)

O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img29.jpg

O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img29.jpg

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

O33 - MountPoints2\{7c2dfa00-fb52-11dc-9606-00140b4345ce}\Shell - "" = AutoRun

O33 - MountPoints2\{7c2dfa00-fb52-11dc-9606-00140b4345ce}\Shell\AutoRun\command - "" = H:\LaunchU3.exe -a

O34 - HKLM BootExecute: (autocheck autochk *)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 

NetSvcs: FastUserSwitchingCompatibility -  File not found

NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)

NetSvcs: Nla -  File not found

NetSvcs: Ntmssvc -  File not found

NetSvcs: NWCWorkstation -  File not found

NetSvcs: Nwsapagent -  File not found

NetSvcs: SRService -  File not found

NetSvcs: WmdmPmSp -  File not found

NetSvcs: LogonHours -  File not found

NetSvcs: PCAudit -  File not found

NetSvcs: helpsvc -  File not found

NetSvcs: uploadmgr -  File not found

 

MsConfig - StartUpReg: Windows Defender - hkey= - key= -  File not found

MsConfig - State: "bootini" - 2

MsConfig - State: "startup" - 2

 

SafeBootMin: AppMgmt - Service

SafeBootMin: Base - Driver Group

SafeBootMin: Boot Bus Extender - Driver Group

SafeBootMin: Boot file system - Driver Group

SafeBootMin: File system - Driver Group

SafeBootMin: Filter - Driver Group

SafeBootMin: HelpSvc - Service

SafeBootMin: NTDS -  File not found

SafeBootMin: PCI Configuration - Driver Group

SafeBootMin: PNP Filter - Driver Group

SafeBootMin: Primary disk - Driver Group

SafeBootMin: sacsvr - Service

SafeBootMin: SCSI Class - Driver Group

SafeBootMin: System Bus Extender - Driver Group

SafeBootMin: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)

SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

SafeBootNet: AppMgmt - Service

SafeBootNet: Base - Driver Group

SafeBootNet: Boot Bus Extender - Driver Group

SafeBootNet: Boot file system - Driver Group

SafeBootNet: File system - Driver Group

SafeBootNet: Filter - Driver Group

SafeBootNet: HelpSvc - Service

SafeBootNet: Messenger - Service

SafeBootNet: NDIS Wrapper - Driver Group

SafeBootNet: NetBIOSGroup - Driver Group

SafeBootNet: NetDDEGroup - Driver Group

SafeBootNet: Network - Driver Group

SafeBootNet: NetworkProvider - Driver Group

SafeBootNet: NTDS -  File not found

SafeBootNet: PCI Configuration - Driver Group

SafeBootNet: PNP Filter - Driver Group

SafeBootNet: PNP_TDI - Driver Group

SafeBootNet: Primary disk - Driver Group

SafeBootNet: rdsessmgr - Service

SafeBootNet: sacsvr - Service

SafeBootNet: SCSI Class - Driver Group

SafeBootNet: Streams Drivers - Driver Group

SafeBootNet: System Bus Extender - Driver Group

SafeBootNet: TDI - Driver Group

SafeBootNet: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)

SafeBootNet: WudfPf - Driver

SafeBootNet: WudfUsbccidDriver - Driver

SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net

SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient

SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService

SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans

SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers

SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

ActiveX: {0213C6AF-5562-4D09-884C-2ADCFC8C2F35} - Microsoft .NET Framework 1.1 Security Update (KB2656353)

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)

ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - 

ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0

ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework

ActiveX: {2A3320D6-C805-4280-B423-B665BDE33D8F} - Microsoft .NET Framework 1.1 Security Update (KB979906)

ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework

ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)

ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - 

ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Webordner

ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings

ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install

ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework

ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1

ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player

ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX: {E78BFA60-5393-4C38-82AB-E8019E464EB4} - .NET Framework

ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP

ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig

ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

 

Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: msacm.l3codecp - C:\Windows\System32\l3codecp.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)

Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)

Drivers32: vidc.DIVX - C:\Windows\System32\DivX.dll (DivX, Inc.)

Drivers32: vidc.i420 - C:\Windows\System32\i420vfw.dll (www.helixcommunity.org)

Drivers32: vidc.yv12 - C:\Windows\System32\DivX.dll (DivX, Inc.)

 

CREATERESTOREPOINT

Restore point Set: OTL Restore Point

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2012.04.05 08:45:55 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\DivX

[2012.04.03 12:44:01 | 000,000,000 | ---D | C] -- C:\Program Files\ESET

[2012.04.02 11:02:24 | 000,000,000 | ---D | C] -- C:\Users\***\Desktop\scan

[2012.04.02 10:23:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2012.04.02 10:23:09 | 000,020,464 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys

[2012.04.02 09:27:44 | 000,000,000 | -HSD | C] -- C:\Config.Msi

[2012.04.02 09:23:45 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft WSE

[2012.04.02 09:21:46 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\PackageAware

[2012.04.02 08:53:14 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Avira

[2012.04.02 08:51:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira

[2012.04.02 08:50:58 | 000,028,520 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\ssmdrv.sys

[2012.04.02 08:50:57 | 000,036,000 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avkmgr.sys

[2012.04.02 08:50:56 | 000,137,416 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avipbb.sys

[2012.04.02 08:50:56 | 000,074,640 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avgntflt.sys

[2012.04.02 08:50:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira

[2012.04.02 08:50:55 | 000,000,000 | ---D | C] -- C:\Program Files\Avira

[2012.04.01 21:22:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes

[2012.04.01 21:21:42 | 000,000,000 | ---D | C] -- C:\Program Files\iPod

[2012.04.01 21:21:39 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes

[2012.04.01 20:34:42 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java

[2012.04.01 16:44:09 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Malwarebytes

[2012.04.01 16:43:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2012.04.01 16:43:57 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware

[2012.03.31 21:53:02 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java(1)

[2012.03.31 16:59:46 | 000,000,000 | ---D | C] -- C:\Windows\Temp

[2012.03.25 18:34:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira(91)

 
 ========== Files - Modified Within 30 Days ==========

 

[2012.04.05 08:55:54 | 000,638,748 | ---- | M] () -- C:\Windows\System32\perfh007.dat

[2012.04.05 08:55:54 | 000,604,324 | ---- | M] () -- C:\Windows\System32\perfh009.dat

[2012.04.05 08:55:54 | 000,130,668 | ---- | M] () -- C:\Windows\System32\perfc007.dat

[2012.04.05 08:55:54 | 000,107,760 | ---- | M] () -- C:\Windows\System32\perfc009.dat

[2012.04.05 08:49:51 | 000,139,818 | ---- | M] () -- C:\ProgramData\nvModes.dat

[2012.04.05 08:49:50 | 000,139,818 | ---- | M] () -- C:\ProgramData\nvModes.001

[2012.04.05 08:49:24 | 000,003,168 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0

[2012.04.05 08:49:24 | 000,003,168 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0

[2012.04.05 08:49:02 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2012.04.05 08:48:57 | 2146,418,688 | -HS- | M] () -- C:\hiberfil.sys

[2012.04.05 08:47:40 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat

[2012.04.05 08:47:38 | 000,000,757 | ---- | M] () -- C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DSL-Manager.lnk

[2012.04.05 08:42:09 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job

[2012.04.03 18:01:04 | 000,001,356 | ---- | M] () -- C:\Users\***\AppData\Local\d3d9caps.dat

[2012.04.02 11:05:32 | 000,000,020 | ---- | M] () -- C:\Users\***\defogger_reenable

[2012.04.02 08:51:13 | 000,001,813 | ---- | M] () -- C:\Users\Public\Desktop\Avira Control Center.lnk

[2012.04.01 21:22:25 | 000,001,630 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk

[2012.04.01 20:20:11 | 000,434,368 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT

 
 ========== Files Created - No Company Name ==========

 

[2012.04.04 15:34:40 | 2146,418,688 | -HS- | C] () -- C:\hiberfil.sys

[2012.04.02 11:09:45 | 000,000,884 | ---- | C] () -- C:\Windows\tasks\Adobe Flash Player Updater.job

[2012.04.02 11:05:09 | 000,000,020 | ---- | C] () -- C:\Users\***\defogger_reenable

[2012.04.02 08:51:13 | 000,001,813 | ---- | C] () -- C:\Users\Public\Desktop\Avira Control Center.lnk

[2012.04.01 21:22:25 | 000,001,630 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk

[2010.12.30 12:39:49 | 000,000,215 | ---- | C] () -- C:\Windows\gkv501me.INI

[2010.12.30 12:39:49 | 000,000,202 | ---- | C] () -- C:\Windows\gkv501di.INI

[2010.12.30 12:39:49 | 000,000,200 | ---- | C] () -- C:\Windows\gkv501ti.INI

[2010.12.30 12:39:49 | 000,000,131 | ---- | C] () -- C:\Windows\gkstart1.INI

[2010.12.30 12:39:30 | 000,375,296 | ---- | C] () -- C:\Windows\System32\tx32.dll

[2010.12.30 12:39:26 | 000,000,202 | ---- | C] () -- C:\Windows\System32\IC32.INI

 
 ========== LOP Check ==========

 

[2011.02.27 15:58:35 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\T-Online

[2011.04.27 11:05:17 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Audacity

[2008.02.24 19:13:23 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Canon

[2008.02.14 18:31:37 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\InterVideo

[2008.03.01 18:45:18 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\klickTel

[2011.10.09 15:42:14 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\OpenOffice.org

[2011.04.25 19:45:30 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\PhotoScape

[2008.02.28 17:14:43 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\T-Online

[2008.02.14 20:00:56 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Template

[2009.12.26 23:59:51 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\TuneUp Software

[2008.05.18 21:29:10 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\XnView

[2008.05.01 11:35:09 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\InterVideo

[2012.01.18 16:51:10 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\LibreOffice

[2012.01.18 15:34:55 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\OpenOffice.org

[2008.02.10 13:39:30 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\PeerNetworking

[2008.03.21 18:47:36 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\T-Online

[2009.12.25 19:32:45 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\TuneUp Software

[2012.04.05 08:47:41 | 000,032,514 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

 
 ========== Purity Check ==========

 

 

 
 ========== Custom Scans ==========

 
 < %ALLUSERSPROFILE%\Application Data\*. >

 
 < %ALLUSERSPROFILE%\Application Data\*.exe /s >

 
 < %APPDATA%\*. >

[2012.01.15 15:09:21 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Adobe

[2009.10.19 13:52:12 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Ahead

[2012.01.15 22:26:38 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Apple Computer

[2012.04.02 08:53:14 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Avira

[2012.04.05 08:45:55 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\DivX

[2009.10.19 14:12:31 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Help

[2008.02.10 11:32:39 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Identities

[2008.05.01 11:35:09 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\InterVideo

[2012.01.18 16:51:10 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\LibreOffice

[2008.03.21 19:27:58 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Macromedia

[2012.04.01 16:44:09 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Malwarebytes

[2006.11.02 14:37:34 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Media Center Programs

[2012.04.02 09:23:47 | 000,000,000 | --SD | M] -- C:\Users\***\AppData\Roaming\Microsoft

[2012.01.18 15:34:55 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\OpenOffice.org

[2011.02.08 23:25:37 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\OpenOffice.org2

[2008.02.10 13:39:30 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\PeerNetworking

[2008.03.21 18:47:36 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\T-Online

[2009.12.25 19:32:45 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\TuneUp Software

 
 < %APPDATA%\*.exe /s >

[2012.04.02 09:23:47 | 000,010,134 | R--- | M] () -- C:\Users\***\AppData\Roaming\Microsoft\Installer\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}\ARPPRODUCTICON.exe

 
 < %SYSTEMDRIVE%\*.exe >

 
 < MD5 for: AGP440.SYS  >

[2008.01.18 23:42:26 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_51b95d75\AGP440.sys

[2008.01.18 23:42:26 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys

[2008.01.18 23:42:26 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys

[2008.01.18 23:42:26 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_bbfe6647bbd2a4c6\AGP440.sys

[2007.11.03 01:26:51 | 000,056,504 | ---- | M] (Microsoft Corporation) MD5=198636E76971EBC96404547EC0FD5E75 -- C:\Windows\System32\drivers\AGP440.sys

[2007.11.03 01:26:51 | 000,056,504 | ---- | M] (Microsoft Corporation) MD5=198636E76971EBC96404547EC0FD5E75 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_cb7c81c7\AGP440.sys

[2007.11.03 01:26:51 | 000,056,504 | ---- | M] (Microsoft Corporation) MD5=198636E76971EBC96404547EC0FD5E75 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6000.20598_none_b85cfa98dae9b436\AGP440.sys

[2006.11.02 11:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys

 
 < MD5 for: ATAPI.SYS  >

[2007.11.03 01:53:24 | 000,021,688 | ---- | M] (Microsoft Corporation) MD5=0B77F93AB73798F97E8E0A0AA4CCBEEF -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_44b6b0d0\atapi.sys

[2007.11.03 01:53:24 | 000,021,688 | ---- | M] (Microsoft Corporation) MD5=0B77F93AB73798F97E8E0A0AA4CCBEEF -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20694_none_db7e36353dc64123\atapi.sys

[2009.04.10 23:32:28 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\drivers\atapi.sys

[2009.04.10 23:32:28 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_b12d8e84\atapi.sys

[2009.04.10 23:32:28 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys

[2008.01.17 18:54:38 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=224505155EC3E36D7A1F36E446F04C2A -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_ecc53ff9\atapi.sys

[2008.01.17 18:54:38 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=224505155EC3E36D7A1F36E446F04C2A -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16584_none_daff695624a08568\atapi.sys

[2008.01.18 23:41:32 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys

[2008.01.18 23:41:32 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys

[2006.11.02 11:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys

[2008.01.17 18:54:38 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=BFD3DF48C9ED81934FE21E8E3CFC2496 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_27cad3e5\atapi.sys

[2008.01.17 18:54:38 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=BFD3DF48C9ED81934FE21E8E3CFC2496 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20707_none_dbe288453d7a8ed6\atapi.sys

 
 < MD5 for: CNGAUDIT.DLL  >

[2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll

[2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll

 
 < MD5 for: EVENTLOG.DLL  >

[2007.01.12 23:30:08 | 000,007,216 | ---- | M] () MD5=C2A279A458A06DE2C83D842AA042B5A8 -- C:\Program Files\HomeCinema\PowerDirector\EventLog.dll

 
 < MD5 for: IASTOR.SYS  >

[2007.07.12 16:35:02 | 000,305,176 | ---- | M] (Intel Corporation) MD5=2358C53F30CB9DCD1D3843C4E2F299B2 -- C:\Windows\System32\drivers\iaStor.sys

[2007.07.12 16:35:02 | 000,305,176 | ---- | M] (Intel Corporation) MD5=2358C53F30CB9DCD1D3843C4E2F299B2 -- C:\Windows\System32\DriverStore\FileRepository\iastor.inf_ec8a8d1b\iaStor.sys

 
 < MD5 for: IASTORV.SYS  >

[2008.01.18 23:42:52 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_c9df7691\iaStorV.sys

[2008.01.18 23:42:52 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys

[2006.11.02 11:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\drivers\iaStorV.sys

[2006.11.02 11:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys

 
 < MD5 for: NETLOGON.DLL  >

[2006.11.02 11:46:11 | 000,559,616 | ---- | M] (Microsoft Corporation) MD5=889A2C9F2AACCD8F64EF50AC0B3D553B -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6000.16386_none_fb80f5473b0ed783\netlogon.dll

[2009.04.10 23:28:24 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\System32\netlogon.dll

[2009.04.10 23:28:24 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_ffa3304f351bb3a3\netlogon.dll

[2008.01.18 23:35:38 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll

 
 < MD5 for: NVSTOR.SYS  >

[2006.11.02 11:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\drivers\nvstor.sys

[2006.11.02 11:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys

[2008.01.18 23:42:10 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys

[2008.01.18 23:42:10 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys

 
 < MD5 for: NVSTOR32.SYS  >

[2007.01.27 17:21:04 | 000,101,160 | ---- | M] (NVIDIA Corporation) MD5=4A9A6368BEF61C9608FE7CC21B1F8886 -- C:\DRIVER\SATA\NFORCE\nvstor32.sys

[2007.01.27 17:21:04 | 000,101,160 | ---- | M] (NVIDIA Corporation) MD5=4A9A6368BEF61C9608FE7CC21B1F8886 -- C:\Windows\System32\DriverStore\FileRepository\nvstor32.inf_54ba863a\nvstor32.sys

[2007.07.02 17:37:08 | 000,110,112 | ---- | M] (NVIDIA Corporation) MD5=703E3A7093B0FAC0EEBADBB8E931ECAF -- C:\Windows\System32\DriverStore\FileRepository\nvrd32.inf_bbf77119\nvstor32.sys

[2007.08.09 19:12:30 | 000,110,624 | ---- | M] (NVIDIA Corporation) MD5=DC5F166422BEEBF195E3E4BB8AB4EE22 -- C:\Windows\System32\drivers\nvstor32.sys

[2007.08.09 19:12:30 | 000,110,624 | ---- | M] (NVIDIA Corporation) MD5=DC5F166422BEEBF195E3E4BB8AB4EE22 -- C:\Windows\System32\DriverStore\FileRepository\nvstor32.inf_99d8b088\nvstor32.sys

 
 < MD5 for: SCECLI.DLL  >

[2008.01.18 23:36:20 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll

[2006.11.02 11:46:12 | 000,176,640 | ---- | M] (Microsoft Corporation) MD5=80E2839D05CA5970A86D7BE2A08BFF61 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6000.16386_none_35d7205fdc305e3e\scecli.dll

[2009.04.10 23:28:26 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\System32\scecli.dll

[2009.04.10 23:28:26 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e\scecli.dll

 
 < MD5 for: USER32.DLL  >

[2007.11.03 01:17:10 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=3322B167C8F76319C991B851514DFAC9 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.20587_none_cb8c4940898e24a6\user32.dll

[2008.01.18 23:36:48 | 000,627,200 | ---- | M] (Microsoft Corporation) MD5=B974D9F06DC7D1908E825DC201681269 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_cd386c416d5c7f32\user32.dll

[2006.11.02 11:46:13 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=E698A5437B89A285ACA3FF022356810A -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.16386_none_cb01aa4570716e5e\user32.dll

[2009.04.10 23:28:26 | 000,627,712 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\user32.dll

[2009.04.10 23:28:26 | 000,627,712 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6002.18005_none_cf23e54d6a7e4a7e\user32.dll

 
 < MD5 for: USERINIT.EXE  >

[2008.01.18 23:33:34 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe

[2008.01.18 23:33:34 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe

[2006.11.02 11:45:50 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=22027835939F86C3E47AD8E3FBDE3D11 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6000.16386_none_d9f1f819d4c4e737\userinit.exe

 
 < MD5 for: VIAMRAID.SYS  >

[2006.11.08 15:23:52 | 000,102,912 | ---- | M] (VIA Technologies inc,.ltd) MD5=7DC3E1DC6E4F8BE381C31BFEA578412A -- C:\Windows\System32\drivers\viamraid.sys

[2006.11.08 15:23:52 | 000,102,912 | ---- | M] (VIA Technologies inc,.ltd) MD5=7DC3E1DC6E4F8BE381C31BFEA578412A -- C:\Windows\System32\DriverStore\FileRepository\viamraid.inf_74a36694\viamraid.sys

 
 < MD5 for: WININIT.EXE  >

[2008.01.18 23:33:38 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\System32\wininit.exe

[2008.01.18 23:33:38 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6001.18000_none_30f2b8cf0450a6a2\wininit.exe

[2007.11.03 01:17:50 | 000,095,744 | ---- | M] (Microsoft Corporation) MD5=39D959CD9F3BC44F78DB3C6588AAC3FE -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6000.20593_none_2f37c4ba208e02ab\wininit.exe

[2006.11.02 11:45:57 | 000,095,744 | ---- | M] (Microsoft Corporation) MD5=D4385B03E8CCCEE6F0EE249F827C1F3E -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6000.16386_none_2ebbf6d3076595ce\wininit.exe

 
 < MD5 for: WINLOGON.EXE  >

[2012.01.13 14:53:20 | 000,182,856 | ---- | M] () MD5=63EEC8A8B221AB79045E776E5F592868 -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe

[2009.04.10 23:28:14 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\System32\winlogon.exe

[2009.04.10 23:28:14 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe

[2006.11.02 11:45:57 | 000,308,224 | ---- | M] (Microsoft Corporation) MD5=9F75392B9128A91ABAFB044EA350BAAD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6000.16386_none_6d8c3f1ad8066b21\winlogon.exe

[2007.11.03 01:17:50 | 000,308,224 | ---- | M] (Microsoft Corporation) MD5=A3FEA6ED9FD3CF07219A632E4A716226 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6000.20593_none_6e080d01f12ed7fe\winlogon.exe

[2008.01.18 23:33:38 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe

 
 < MD5 for: WS2IFSL.SYS  >

[2006.11.02 10:58:26 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=84620AECDCFD2A7A14E6263927D8C0ED -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6000.16386_none_4d4fded8cae2956d\ws2ifsl.sys

[2008.01.18 21:56:50 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\System32\drivers\ws2ifsl.sys

[2008.01.18 21:56:50 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6001.18000_none_4f86a0d4c7cda641\ws2ifsl.sys

 
 < %systemroot%\system32\drivers\*.sys /lockedfiles >

 
 < %systemroot%\System32\config\*.sav >

[2008.01.18 03:38:11 | 008,011,776 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV

[2008.01.18 03:38:07 | 000,102,400 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV

[2008.01.18 03:38:12 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV

[2008.01.18 03:38:27 | 016,478,208 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV

[2008.01.18 03:38:29 | 006,029,312 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV

 
 < %systemroot%\*. /mp /s >

 
 < %systemroot%\system32\*.dll /lockedfiles >

 
 <           >
 

< End of report >