Trojaner-Board - Security Shield (Trojan.LameShield)

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - Security Shield (Trojan.LameShield) (https://www.trojaner-board.de/118317-security-shield-trojan-lameshield.html)

Security Shield (Trojan.LameShield)

Hallo,

ich habe mir bedauerlicherweise vor ein paar Stunden beim surfen im Netz Security Shield eingefangen, aufgefallen ist es mir als die hier im Forum geschilderten Pop-ups erschienen.

Da ich eh schon Malwarebytes installiert hatte, hab ich sofort einen vollständigen Scan vorgenommen. Malwarebytes habe ich davor geupdated.

Ich kenne mich nicht so wahnsinnig gut mit Computern, wäre super, wenn eine/r von euch mir weiterhelfen könnte, wie ich weiter vorgehen soll.

Hier das letzte Logfile (Rechner starte ich nach dem Post dieses Beitrags neu, das sollte dann den infizierten Speicherplatz auch in die Quarantäne schieben, oder?)

Code:

Malwarebytes Anti-Malware 1.61.0.1400

www.malwarebytes.org
 

Datenbank Version: v2012.07.02.01
 

Windows 7 Service Pack 1 x86 NTFS

Internet Explorer 9.0.8112.16421

Steffi :: PUSSYBOX-2 [Administrator]
 

02.07.2012 05:23:28

mbam-log-2012-07-02 (05-23-28).txt
 

Art des Suchlaufs: Vollständiger Suchlauf

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 328244

Laufzeit: 1 Stunde(n), 30 Minute(n), 30 Sekunde(n)
 

Infizierte Speicherprozesse: 1

C:\Users\Steffi\AppData\Local\qwksgtuhk.exe (Trojan.LameShield) -> 4596 -> Löschen bei Neustart.
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 1

C:\Users\Steffi\AppData\Local\qwksgtuhk.exe (Trojan.LameShield) -> Erfolgreich gelöscht und in Quarantäne gestellt.
 

(Ende)

die lezte Logdatei davor ist aus dem April, häng ich hier auch mal an, kann ja nicht schaden:

Code:

Malwarebytes Anti-Malware 1.60.1.1000

www.malwarebytes.org
 

Datenbank Version: v2012.04.04.08
 

Windows 7 Service Pack 1 x86 NTFS

Internet Explorer 9.0.8112.16421

Steffi :: PUSSYBOX-2 [Administrator]
 

05.04.2012 00:06:36

mbam-log-2012-04-05 (00-06-36).txt
 

Art des Suchlaufs: Quick-Scan

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 184435

Laufzeit: 5 Minute(n), 11 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 0

(Keine bösartigen Objekte gefunden)
 

(Ende)

Falls benötigt, kann ich noch ältere Logfiles (Malwarebytes) zur Verfügung stellen.

Im Voraus schon mal vielen Dank,
Liebe Grüße -
Stella

hi,
Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

Starte bitte die
OTL.exe
.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Kopiere nun den Inhalt in die http://larusso.trojaner-board.de/Images/otlfix.jpg
Textbox.

Code:

activex

netsvcs

msconfig

%SYSTEMDRIVE%\*.

%PROGRAMFILES%\*.exe

%LOCALAPPDATA%\*.exe

%systemroot%\*. /mp /s

/md5start

userinit.exe

eventlog.dll

scecli.dll

netlogon.dll

cngaudit.dll

ws2ifsl.sys

sceclt.dll

ntelogon.dll

winlogon.exe

logevent.dll

user32.DLL

explorer.exe

iaStor.sys

nvstor.sys

atapi.sys

IdeChnDr.sys

viasraid.sys

AGP440.sys

vaxscsi.sys

nvatabus.sys

viamraid.sys

nvata.sys

nvgts.sys

iastorv.sys

ViPrt.sys

eNetHook.dll

ahcix86.sys

KR10N.sys

nvstor32.sys

ahcix86s.sys

/md5stop

%systemroot%\system32\drivers\*.sys /lockedfiles

%systemroot%\System32\config\*.sav

%systemroot%\system32\*.dll /lockedfiles

%USERPROFILE%\*.*

%USERPROFILE%\Local Settings\Temp\*.exe

%USERPROFILE%\Local Settings\Temp\*.dll

%USERPROFILE%\Application Data\*.exe

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs

CREATERESTOREPOINT

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Kopiere
nun den Inhalt aus OTL.txt und Extra.txt hier in Deinen Thread

Hi Markusg -

das ging aber schnell, vielen Dank!

Hier die beiden Logfiles:

OTL.txt

Code:

OTL logfile created on: 02.07.2012 13:06:24 - Run 1

OTL by OldTimer - Version 3.2.53.1     Folder = C:\Users\Steffi\Desktop

 Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

2,96 Gb Total Physical Memory | 2,16 Gb Available Physical Memory | 72,88% Memory free

5,92 Gb Paging File | 4,99 Gb Available in Paging File | 84,25% Paging File free

Paging file location(s): c:\pagefile.sys 0 0 [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 143,79 Gb Total Space | 94,76 Gb Free Space | 65,90% Space Free | Partition Type: NTFS

Drive D: | 139,61 Gb Total Space | 121,98 Gb Free Space | 87,37% Space Free | Partition Type: NTFS

Drive E: | 14,65 Gb Total Space | 9,91 Gb Free Space | 67,63% Space Free | Partition Type: NTFS

 

Computer Name: PUSSYBOX-2 | User Name: Steffi | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2012.07.02 12:59:27 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Users\Steffi\Desktop\OTL.exe

PRC - [2012.07.02 07:13:10 | 000,013,160 | ---- | M] (Absolute Software Corp.) -- C:\Windows\System32\Upgrd.exe

PRC - [2012.07.02 07:13:00 | 000,058,288 | ---- | M] (Absolute Software Corp.) -- C:\Windows\System32\rpcnet.exe

PRC - [2012.03.26 17:08:12 | 000,931,200 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft Security Client\msseces.exe

PRC - [2012.03.26 17:03:40 | 000,011,552 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft Security Client\MsMpEng.exe

PRC - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe

PRC - [2011.10.13 18:21:52 | 000,249,648 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft\BingBar\SeaPort.EXE

PRC - [2011.06.24 06:22:20 | 000,271,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe

PRC - [2011.02.25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe

PRC - [2011.01.17 19:50:34 | 011,322,880 | ---- | M] (OpenOffice.org) -- C:\Programme\OpenOffice.org 3\program\soffice.exe

PRC - [2011.01.17 19:50:34 | 011,314,688 | ---- | M] (OpenOffice.org) -- C:\Programme\OpenOffice.org 3\program\soffice.bin

PRC - [2010.11.20 14:17:56 | 001,121,792 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe

PRC - [2010.11.20 14:17:47 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe

PRC - [2009.07.27 22:56:44 | 000,081,920 | ---- | M] (Andrea Electronics Corporation) -- C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_638e19a9cc691dc9\AEstSrv.exe

PRC - [2009.07.27 22:54:08 | 000,221,266 | ---- | M] (IDT, Inc.) -- C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_638e19a9cc691dc9\stacsv.exe

PRC - [2009.07.27 22:52:48 | 000,458,844 | ---- | M] (IDT, Inc.) -- C:\Programme\IDT\WDM\sttray.exe

PRC - [2009.06.24 21:19:50 | 000,140,520 | ---- | M] (CyberLink Corp.) -- C:\Programme\CyberLink\PowerDVD DX\PDVDDXSrv.exe

PRC - [2009.02.27 10:18:32 | 000,217,088 | ---- | M] (Alps Electric Co., Ltd.) -- C:\Programme\DellTPad\Apoint.exe

PRC - [2009.02.01 07:15:38 | 000,049,152 | ---- | M] (Alps Electric Co., Ltd.) -- C:\Programme\DellTPad\ApntEx.exe

PRC - [2009.02.01 05:43:30 | 000,049,250 | ---- | M] (Alps Electric Co., Ltd.) -- C:\Programme\DellTPad\hidfind.exe

PRC - [2009.01.18 19:27:18 | 000,036,864 | ---- | M] (Creative Technology Ltd.) -- C:\Windows\OEM13Mon.exe

PRC - [2009.01.08 05:55:00 | 000,072,224 | ---- | M] (O2Micro International) -- C:\Windows\System32\drivers\o2flash.exe

PRC - [2008.11.24 20:56:46 | 000,054,568 | ---- | M] (Alps Electric Co., Ltd.) -- C:\Programme\DellTPad\ApMsgFwd.exe

 

 
 ========== Modules (No Company Name) ==========

 

MOD - [2012.06.13 21:40:28 | 011,833,344 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\a501b7960f6c6e2e39162b83f3303aaa\System.Web.ni.dll

MOD - [2012.05.10 14:06:51 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\03dee80574f4ec770b6f77ca030ded6c\System.Runtime.Remoting.ni.dll

MOD - [2012.05.10 14:05:46 | 007,967,232 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\ce9ff6baf9053ed2ed673d948179195c\System.ni.dll

MOD - [2012.05.10 14:05:38 | 011,492,864 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\acfc1391e45fedd2a359778ea57d914c\mscorlib.ni.dll

MOD - [2012.02.09 21:59:24 | 000,985,088 | ---- | M] () -- C:\Programme\OpenOffice.org 3\program\libxml2.dll

MOD - [2011.09.27 08:23:00 | 000,087,912 | ---- | M] () -- C:\Programme\Common Files\Apple\Apple Application Support\zlib1.dll

MOD - [2011.09.27 08:22:40 | 001,242,472 | ---- | M] () -- C:\Programme\Common Files\Apple\Apple Application Support\libxml2.dll

MOD - [2008.12.11 19:47:34 | 000,055,808 | ---- | M] () -- C:\Windows\System32\bcmwlrmt.dll

MOD - [2008.03.30 16:22:42 | 000,070,144 | ---- | M] () -- C:\Programme\PSPad editor\PSPadShell.dll

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV - [2012.07.02 07:13:00 | 000,058,288 | ---- | M] (Absolute Software Corp.) [Auto | Running] -- C:\Windows\System32\rpcnet.exe -- (rpcnet) Remote Procedure Call (RPC)

SRV - [2012.06.23 08:59:11 | 000,250,056 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)

SRV - [2012.06.17 06:06:03 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)

SRV - [2012.03.26 17:03:40 | 000,214,952 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Microsoft Security Client\NisSrv.exe -- (NisSrv)

SRV - [2012.03.26 17:03:40 | 000,011,552 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc)

SRV - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)

SRV - [2011.10.21 16:23:42 | 000,196,176 | ---- | M] (Microsoft Corporation.) [Auto | Stopped] -- C:\Programme\Microsoft\BingBar\BBSvc.EXE -- (BBSvc)

SRV - [2011.10.13 18:21:52 | 000,249,648 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Microsoft\BingBar\SeaPort.EXE -- (BBUpdate)

SRV - [2010.11.20 14:17:56 | 001,121,792 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)

SRV - [2009.07.27 22:56:44 | 000,081,920 | ---- | M] (Andrea Electronics Corporation) [Auto | Running] -- C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_638e19a9cc691dc9\AEstSrv.exe -- (AESTFilters)

SRV - [2009.07.27 22:54:08 | 000,221,266 | ---- | M] (IDT, Inc.) [Auto | Running] -- C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_638e19a9cc691dc9\stacsv.exe -- (STacSV)

SRV - [2009.07.14 03:16:15 | 000,016,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\StorSvc.dll -- (StorSvc)

SRV - [2009.07.14 03:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)

SRV - [2009.07.14 03:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)

SRV - [2009.07.14 03:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)

SRV - [2009.01.08 05:55:00 | 000,072,224 | ---- | M] (O2Micro International) [Auto | Running] -- C:\Windows\System32\drivers\o2flash.exe -- (O2FLASH)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - File not found [Kernel | On_Demand | Stopped] -- c:\program files\dell support center\pcdsrvc.pkms -- (PCDSRVC{E9D79540-57D5953E-06020101}_0)

DRV - [2012.03.20 20:44:12 | 000,074,112 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\NisDrvWFP.sys -- (NisDrv)

DRV - [2010.11.20 14:30:15 | 000,175,360 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmbus.sys -- (vmbus)

DRV - [2010.11.20 14:30:15 | 000,040,704 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmstorfl.sys -- (storflt)

DRV - [2010.11.20 14:30:15 | 000,028,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\storvsc.sys -- (storvsc)

DRV - [2010.11.20 12:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)

DRV - [2010.11.20 11:14:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VMBusHID.sys -- (VMBusHID)

DRV - [2010.11.20 11:14:41 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vms3cap.sys -- (s3cap)

DRV - [2010.06.23 10:21:32 | 000,259,176 | ---- | M] (Realtek                                            ) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169)

DRV - [2009.07.27 22:52:26 | 000,408,576 | ---- | M] (IDT, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\stwrt.sys -- (STHDA)

DRV - [2009.06.24 21:19:48 | 000,087,536 | ---- | M] (CyberLink Corp.) [2011/03/07 19:52:34] [Kernel | Auto | Running] -- C:\Programme\CyberLink\PowerDVD DX\000.fcl -- ({1E444BE9-B8EC-4ce6-8C2B-6536FB7F4FB7})

DRV - [2009.03.24 17:25:24 | 000,197,680 | ---- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Apfiltr.sys -- (ApfiltrService)

DRV - [2009.01.18 19:27:28 | 000,235,840 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\OEM13Vid.sys -- (OEM13Vid)

DRV - [2009.01.18 19:27:24 | 000,007,424 | ---- | M] (EyePower Games Pte. Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\OEM13Vfx.sys -- (OEM13Vfx)

DRV - [2009.01.08 05:55:00 | 000,051,616 | ---- | M] (O2Micro ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\o2mdg.sys -- (O2MDGRDR)

DRV - [2009.01.08 05:55:00 | 000,041,760 | ---- | M] (O2Micro ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\o2sdg.sys -- (O2SDGRDR)

DRV - [2008.12.11 19:47:16 | 000,018,424 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\bcm42rly.sys -- (BCM42RLY)

DRV - [2006.09.24 15:28:46 | 000,005,248 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | Boot | Running] -- C:\Windows\System32\speedfan.sys -- (speedfan)

DRV - [1996.04.03 21:33:26 | 000,005,248 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\System32\giveio.sys -- (giveio)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE - HKLM\..\SearchScopes,DefaultScope = {F7D15FE7-9604-4051-ADAB-F3FCAC15C356}

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKLM\..\SearchScopes\{F7D15FE7-9604-4051-ADAB-F3FCAC15C356}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&Form=DLSDF7&pc=MDDS&src={referrer:source?}

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/USSMB/8

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/USSMB/8

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1

IE - HKCU\..\SearchScopes,DefaultScope = {F7D15FE7-9604-4051-ADAB-F3FCAC15C356}

IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC

IE - HKCU\..\SearchScopes\{F7D15FE7-9604-4051-ADAB-F3FCAC15C356}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=DLSDF7&pc=MDDS&src=IE-SearchBox

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

 
 ========== FireFox ==========

 

FF - prefs.js..browser.startup.homepage: ""

FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.5

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24

FF - user.js - File not found

 

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_3_300_262.dll ()

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()

FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=1.6.0_33: C:\Windows\system32\npdeployJava1.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8051.1204: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@veetle.com/vbp;version=0.9.16: C:\Users\Steffi\Desktop\Veetle\VLCBroadcast\npvbp.dll File not found

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.06.17 06:06:04 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.07.02 07:17:24 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 3.1.11\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2011.11.10 22:22:01 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 3.1.11\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins [2012.04.16 03:32:31 | 000,000,000 | ---D | M]

FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.06.17 06:06:04 | 000,000,000 | ---D | M]

FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.07.02 07:17:24 | 000,000,000 | ---D | M]

 

[2011.03.07 19:37:25 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Steffi\AppData\Roaming\mozilla\Extensions

[2010.12.10 23:09:21 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Steffi\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}

[2012.06.29 12:20:28 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Steffi\AppData\Roaming\mozilla\Firefox\Profiles\0spd8zk9.default\extensions

[2011.03.07 19:37:26 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Steffi\AppData\Roaming\mozilla\Firefox\Profiles\0spd8zk9.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}

[2012.07.02 07:17:26 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions

[2012.07.02 07:17:26 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}

[2012.07.02 07:17:26 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}

[2012.06.17 06:06:04 | 000,085,472 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll

[2011.10.04 13:02:46 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml

[2011.10.04 13:02:46 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml

[2011.10.04 13:02:46 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml

[2011.10.04 13:02:46 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml

[2011.10.04 13:02:46 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml

[2011.10.04 13:02:46 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml

 

O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1       localhost

O1 - Hosts: ::1             localhost

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.

O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)

O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)

O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)

O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.

O4 - HKLM..\Run: [Apoint] C:\Programme\DellTPad\Apoint.exe (Alps Electric Co., Ltd.)

O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)

O4 - HKLM..\Run: [dellsupportcenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P dellsupportcenter File not found

O4 - HKLM..\Run: [MSC] C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)

O4 - HKLM..\Run: [OEM13Mon.exe] C:\Windows\OEM13Mon.exe (Creative Technology Ltd.)

O4 - HKLM..\Run: [PDVDDXSrv] C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe (CyberLink Corp.)

O4 - HKLM..\Run: [SysTrayApp] C:\Programme\IDT\WDM\sttray.exe (IDT, Inc.)

O4 - Startup: C:\Users\Steffi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = C:\Programme\OpenOffice.org 3\program\quickstart.exe ()

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O9 - Extra Button: In Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : In Windows Live Writer in Blog veröffentliche&n - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)

O13 - gopher Prefix: missing

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Java Plug-in 1.6.0_33)

O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)

O16 - DPF: {CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Java Plug-in 1.6.0_33)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Java Plug-in 1.6.0_33)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{CAC4889E-0665-49E7-9CE4-7B38C1EADC2B}: DhcpNameServer = 192.168.1.254

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{CF7BB424-3720-4F30-9729-426088F112FB}: DhcpNameServer = 192.168.2.1

O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8050.1202.dll (Microsoft Corporation)

O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8050.1202.dll (Microsoft Corporation)

O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Programme\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)

O20 - AppInit_DLLs: (C:\Windows\system32\guard32.dll) -  File not found

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O24 - Desktop WallPaper: C:\Users\Steffi\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg

O24 - Desktop BackupWallPaper: C:\Users\Steffi\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

O34 - HKLM BootExecute: (autocheck autochk *)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

 

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)

ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0

ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework

ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework

ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings

ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install

ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP

ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig

ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

 

NetSvcs: FastUserSwitchingCompatibility -  File not found

NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)

NetSvcs: Nla -  File not found

NetSvcs: Ntmssvc -  File not found

NetSvcs: NWCWorkstation -  File not found

NetSvcs: Nwsapagent -  File not found

NetSvcs: SRService -  File not found

NetSvcs: WmdmPmSp -  File not found

NetSvcs: LogonHours -  File not found

NetSvcs: PCAudit -  File not found

NetSvcs: helpsvc -  File not found

NetSvcs: uploadmgr -  File not found

 

MsConfig - StartUpReg: Adobe ARM - hkey= - key= - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)

MsConfig - StartUpReg: DELL Webcam Manager - hkey= - key= - C:\Program Files\Dell\Dell Webcam Manager\DellWMgr.exe (Creative Technology Ltd.)

MsConfig - StartUpReg: DellSupportCenter - hkey= - key= -  File not found

MsConfig - StartUpReg: DivX Download Manager - hkey= - key= -  File not found

MsConfig - StartUpReg: iTunesHelper - hkey= - key= - C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)

MsConfig - StartUpReg: Microsoft Default Manager - hkey= - key= - C:\Program Files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe (Microsoft Corporation)

MsConfig - StartUpReg: PDVDDXSrv - hkey= - key= - C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe (CyberLink Corp.)

MsConfig - StartUpReg: QuickTime Task - hkey= - key= - C:\Program Files\QuickTime\QTTask.exe (Apple Inc.)

MsConfig - StartUpReg: SynTPEnh - hkey= - key= - C:\Programme\Synaptics\SynTP\SynTPEnh.exe (Synaptics Incorporated)

MsConfig - State: "services" - 0

MsConfig - State: "startup" - 2

 

CREATERESTOREPOINT

Restore point Set: OTL Restore Point

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2012.07.02 12:59:24 | 000,595,968 | ---- | C] (OldTimer Tools) -- C:\Users\Steffi\Desktop\OTL.exe

[2012.07.02 05:22:01 | 000,000,000 | ---D | C] -- C:\Users\Steffi\AppData\Local\ElevatedDiagnostics

[2012.06.13 21:59:43 | 000,000,000 | ---D | C] -- C:\Users\Steffi\AppData\Local\Macromedia

 
 ========== Files - Modified Within 30 Days ==========

 

[2012.07.02 12:59:27 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Users\Steffi\Desktop\OTL.exe

[2012.07.02 12:54:56 | 000,017,920 | ---- | M] () -- C:\Windows\System32\rpcnetp.exe

[2012.07.02 12:54:51 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job

[2012.07.02 12:54:49 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2012.07.02 07:17:47 | 000,011,248 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2012.07.02 07:17:47 | 000,011,248 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2012.07.02 07:17:26 | 000,656,266 | ---- | M] () -- C:\Windows\System32\perfh007.dat

[2012.07.02 07:17:26 | 000,618,108 | ---- | M] () -- C:\Windows\System32\perfh009.dat

[2012.07.02 07:17:26 | 000,131,006 | ---- | M] () -- C:\Windows\System32\perfc007.dat

[2012.07.02 07:17:26 | 000,107,388 | ---- | M] () -- C:\Windows\System32\perfc009.dat

[2012.07.02 07:13:32 | 000,058,288 | ---- | M] (Absolute Software Corp.) -- C:\Windows\System32\rpcnet.dll

[2012.07.02 07:13:10 | 000,013,160 | ---- | M] (Absolute Software Corp.) -- C:\Windows\System32\Upgrd.exe

[2012.07.02 07:13:00 | 000,058,288 | ---- | M] (Absolute Software Corp.) -- C:\Windows\System32\rpcnet.exe

[2012.07.02 07:10:23 | 000,017,920 | ---- | M] () -- C:\Windows\System32\rpcnetp.dll

[2012.07.02 07:09:50 | 2385,154,048 | -HS- | M] () -- C:\hiberfil.sys

[2012.07.02 05:22:39 | 000,001,073 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2012.06.27 13:55:15 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_09_00.Wdf

[2012.06.13 21:39:05 | 000,334,992 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT

[2012.06.04 23:19:11 | 000,000,064 | ---- | M] () -- C:\Users\Steffi\Desktop\Das ouk Forum ouk allgemein.URL

 
 ========== Files Created - No Company Name ==========

 

[2012.06.27 13:55:15 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_09_00.Wdf

[2012.06.02 17:15:25 | 000,000,064 | ---- | C] () -- C:\Users\Steffi\Desktop\Das ouk Forum ouk allgemein.URL

[2011.03.29 13:36:14 | 000,007,602 | ---- | C] () -- C:\Users\Steffi\AppData\Local\Resmon.ResmonCfg

[2011.03.08 14:30:34 | 000,668,160 | ---- | C] () -- C:\Windows\System32\autochk.exe

[2011.03.08 14:30:01 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe

[2011.03.07 20:56:45 | 000,000,431 | ---- | C] () -- C:\Users\Steffi\AppData\Local\Win7_Upgrade.bat

[2011.03.07 20:47:03 | 000,001,794 | ---- | C] () -- C:\Users\Steffi\AppData\Local\Win7_tmp1.htm

[2011.03.07 19:42:50 | 000,021,532 | ---- | C] () -- C:\Windows\System32\emptyregdb.dat

[2011.03.07 19:25:26 | 000,017,920 | ---- | C] () -- C:\Windows\System32\rpcnetp.dll

[2011.03.07 19:24:31 | 000,017,920 | ---- | C] () -- C:\Windows\System32\rpcnetp.exe

[2011.02.11 18:40:40 | 000,004,096 | ---- | C] ( ) -- C:\Windows\System32\IGFXDEVLib.dll

[2010.08.25 20:30:02 | 000,439,308 | ---- | C] () -- C:\Windows\System32\igcompkrng500.bin

[2010.08.25 20:30:00 | 000,982,240 | ---- | C] () -- C:\Windows\System32\igkrng500.bin

[2010.08.25 20:30:00 | 000,092,356 | ---- | C] () -- C:\Windows\System32\igfcg500m.bin

[2010.08.25 19:57:00 | 000,000,151 | ---- | C] () -- C:\Windows\System32\GfxUI.exe.config

 
 ========== LOP Check ==========

 

[2011.03.07 19:37:03 | 000,000,000 | ---D | M] -- C:\Users\Steffi\AppData\Roaming\Local

[2011.03.07 19:37:26 | 000,000,000 | ---D | M] -- C:\Users\Steffi\AppData\Roaming\OpenOffice.org

[2011.03.07 21:11:04 | 000,000,000 | ---D | M] -- C:\Users\Steffi\AppData\Roaming\PCDr

[2011.03.07 19:37:28 | 000,000,000 | ---D | M] -- C:\Users\Steffi\AppData\Roaming\Thunderbird

[2009.07.14 06:53:46 | 000,027,340 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

 
 ========== Purity Check ==========

 

 

 
 ========== Custom Scans ==========

 
 < %SYSTEMDRIVE%\*. >

[2011.03.07 19:12:02 | 000,000,000 | -H-D | M] -- C:\$INPLACE.~TR

[2009.07.14 06:54:09 | 000,000,000 | -HSD | M] -- C:\$Recycle.Bin

[2011.03.07 19:43:20 | 000,000,000 | -H-D | M] -- C:\$WINDOWS.~Q

[2011.03.08 22:05:03 | 000,000,000 | -HSD | M] -- C:\boot

[2009.10.11 18:28:52 | 000,000,000 | ---D | M] -- C:\DELL

[2009.07.14 06:53:55 | 000,000,000 | -HSD | M] -- C:\Documents and Settings

[2009.10.11 16:17:47 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen

[2009.07.29 11:15:32 | 000,000,000 | ---D | M] -- C:\Drivers

[2009.07.29 07:09:27 | 000,000,000 | ---D | M] -- C:\EFI

[2011.02.28 17:48:39 | 000,000,000 | -HSD | M] -- C:\found.000

[2011.02.15 22:16:54 | 000,000,000 | ---D | M] -- C:\Intel

[2009.07.14 04:37:05 | 000,000,000 | ---D | M] -- C:\PerfLogs

[2012.04.26 12:36:32 | 000,000,000 | R--D | M] -- C:\Program Files

[2012.04.26 12:36:33 | 000,000,000 | -H-D | M] -- C:\ProgramData

[2009.10.11 16:17:48 | 000,000,000 | -HSD | M] -- C:\Programme

[2011.03.07 20:23:01 | 000,000,000 | -HSD | M] -- C:\Recovery

[2012.07.02 13:08:30 | 000,000,000 | -HSD | M] -- C:\System Volume Information

[2011.03.07 19:38:10 | 000,000,000 | R--D | M] -- C:\Users

[2012.05.01 00:06:43 | 000,000,000 | ---D | M] -- C:\Windows

 
 < %PROGRAMFILES%\*.exe >

 
 < %LOCALAPPDATA%\*.exe >

 
 < %systemroot%\*. /mp /s >

 
 < MD5 for: AGP440.SYS  >

[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\drivers\AGP440.sys

[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_x86_neutral_a97a2a0d0fbc6696\AGP440.sys

[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_b9e9435f20046eeb\AGP440.sys

[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_bc1a57271cf2f285\AGP440.sys

 
 < MD5 for: ATAPI.SYS  >

[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\drivers\atapi.sys

[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_x86_neutral_fab873f3e8a3315c\atapi.sys

[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_dd0e7e3d82dd640d\atapi.sys

[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_df3f92057fcbe7a7\atapi.sys

 
 < MD5 for: CNGAUDIT.DLL  >

[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\System32\cngaudit.dll

[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll

 
 < MD5 for: EXPLORER.EXE  >

[2011.02.26 07:19:21 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_54149f9ef14031fc\explorer.exe

[2009.07.14 03:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_518afd35db100430\explorer.exe

[2011.02.26 07:51:13 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=255CF508D7CFB10E0794D6AC93280BD8 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_525b5180f3f95373\explorer.exe

[2009.10.31 07:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_51a66d6ddafc2ed1\explorer.exe

[2011.02.26 07:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_51a3a583dafd0cef\explorer.exe

[2010.11.20 14:17:09 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_53bc10fdd7fe87ca\explorer.exe

[2011.02.25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\explorer.exe

[2011.02.25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_5389023fd8245f84\explorer.exe

[2009.08.03 07:49:47 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_526619d4f3f142e6\explorer.exe

[2009.08.03 07:35:50 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_51e07e31dad00878\explorer.exe

[2009.10.31 08:00:51 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_52283b2af41f3691\explorer.exe

 
 < MD5 for: IASTOR.SYS  >

[2009.01.19 21:41:16 | 000,328,728 | ---- | M] (Intel Corporation) MD5=BAABB0301949774A66B955C65319635A -- C:\Drivers\storage\R208747\IaStor.sys

[2009.01.19 21:41:16 | 000,328,728 | ---- | M] (Intel Corporation) MD5=BAABB0301949774A66B955C65319635A -- C:\Windows\System32\drivers\iaStor.sys

[2009.01.19 21:41:16 | 000,328,728 | ---- | M] (Intel Corporation) MD5=BAABB0301949774A66B955C65319635A -- C:\Windows\System32\DriverStore\FileRepository\iaahci.inf_x86_neutral_47b7c899f0c30d85\iaStor.sys

[2009.01.19 21:41:16 | 000,328,728 | ---- | M] (Intel Corporation) MD5=BAABB0301949774A66B955C65319635A -- C:\Windows\System32\DriverStore\FileRepository\iastor.inf_x86_neutral_010ccaa72e16692a\iaStor.sys

 
 < MD5 for: IASTORV.SYS  >

[2011.03.11 07:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- C:\Windows\System32\drivers\iaStorV.sys

[2011.03.11 07:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_0bcee2057afcc090\iaStorV.sys

[2011.03.11 07:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_b0daddb9e6380745\iaStorV.sys

[2011.03.11 07:43:55 | 000,332,160 | ---- | M] (Intel Corporation) MD5=71F1A494FEDF4B33C02C4A6A28D6D9E9 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_aef580fde910b4b0\iaStorV.sys

[2011.03.11 07:28:00 | 000,332,160 | ---- | M] (Intel Corporation) MD5=778D0E6D7D9EBA0C403BADBAAD41DB20 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_b152a892ff64119f\iaStorV.sys

[2009.07.14 03:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_aee7a89be91b9000\iaStorV.sys

[2010.11.20 14:29:54 | 000,332,160 | ---- | M] (Intel Corporation) MD5=A3CAE5D281DB4CFF7CFF8233507EE5AD -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_668286aa35d55928\iaStorV.sys

[2010.11.20 14:29:54 | 000,332,160 | ---- | M] (Intel Corporation) MD5=A3CAE5D281DB4CFF7CFF8233507EE5AD -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_b118bc63e60a139a\iaStorV.sys

[2011.03.11 07:52:21 | 000,332,160 | ---- | M] (Intel Corporation) MD5=B9039A34C2F8769490DCC494E2402445 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_afae2d45020c148b\iaStorV.sys

 
 < MD5 for: NETLOGON.DLL  >

[2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\System32\netlogon.dll

[2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_ffbf212e963c0162\netlogon.dll

[2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_fd8e0d66994d7dc8\netlogon.dll

 
 < MD5 for: NVSTOR.SYS  >

[2011.03.11 07:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- C:\Windows\System32\drivers\nvstor.sys

[2011.03.11 07:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_0276fc3b3ea60d41\nvstor.sys

[2011.03.11 07:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_3ba44e691d6eb11d\nvstor.sys

[2011.03.11 07:44:01 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4520B63899E867F354EE012D34E11536 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_39bef1ad20475e88\nvstor.sys

[2011.03.11 07:28:10 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=66D468654A58594F5F3BA63D5AD5B1AF -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_3c1c1942369abb77\nvstor.sys

[2011.03.11 07:52:25 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=8A7583A3B58D3EEB28BB26626526BC91 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_3a779df43942be63\nvstor.sys

[2010.11.20 14:30:06 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=9283C58EBAA2618F93482EB5DABCEC82 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_dd659ed032d28a14\nvstor.sys

[2010.11.20 14:30:06 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=9283C58EBAA2618F93482EB5DABCEC82 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_3be22d131d40bd72\nvstor.sys

[2009.07.14 03:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_39b1194b205239d8\nvstor.sys

 
 < MD5 for: SCECLI.DLL  >

[2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_37e4387f3a6f0483\scecli.dll

[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\System32\scecli.dll

[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_3a154c47375d881d\scecli.dll

 
 < MD5 for: USER32.DLL  >

[2009.07.14 03:16:17 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=34B7E222E81FAFA885F0C5F2CFA56861 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_cd0ec264ceb014a3\user32.dll

[2010.11.20 14:21:33 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 -- C:\Windows\System32\user32.dll

[2010.11.20 14:21:33 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_cf3fd62ccb9e983d\user32.dll

 
 < MD5 for: USERINIT.EXE  >

[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\System32\userinit.exe

[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe

[2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe

 
 < MD5 for: WINLOGON.EXE  >

[2012.04.04 15:56:38 | 000,199,240 | ---- | M] () MD5=097D0E812D7A9A3101CE46CB2BE0474D -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe

[2009.10.28 08:17:59 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_6fc699643622d177\winlogon.exe

[2009.10.28 07:52:08 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=3BABE6767C78FBF5FB8435FEED187F30 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_703394514f56f7c2\winlogon.exe

[2010.11.20 14:17:54 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\System32\winlogon.exe

[2010.11.20 14:17:54 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_71ca6b0233339500\winlogon.exe

[2009.07.14 03:14:45 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=8EC6A4AB12B8F3759E21F8E3A388F2CF -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_6f99573a36451166\winlogon.exe

 
 < MD5 for: WS2IFSL.SYS  >

[2009.07.14 01:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\System32\drivers\ws2ifsl.sys

[2009.07.14 01:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_4f5cf6f829213bb2\ws2ifsl.sys

 
 < %systemroot%\system32\drivers\*.sys /lockedfiles >

 
 < %systemroot%\System32\config\*.sav >

 
 < %systemroot%\system32\*.dll /lockedfiles >

[2008.12.11 19:47:34 | 000,055,808 | ---- | M] () Unable to obtain MD5 -- C:\Windows\system32\bcmwlrmt.dll

 
 < %USERPROFILE%\*.* >

[2012.07.02 13:08:28 | 001,572,864 | -HS- | M] () -- C:\Users\Steffi\NTUSER.DAT

[2012.07.02 13:08:28 | 000,262,144 | -HS- | M] () -- C:\Users\Steffi\ntuser.dat.LOG1

[2011.03.07 19:28:48 | 000,000,000 | -HS- | M] () -- C:\Users\Steffi\ntuser.dat.LOG2

[2011.03.07 19:28:49 | 000,065,536 | -HS- | M] () -- C:\Users\Steffi\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TM.blf

[2011.03.07 19:28:49 | 000,524,288 | -HS- | M] () -- C:\Users\Steffi\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000001.regtrans-ms

[2011.03.07 19:28:49 | 000,524,288 | -HS- | M] () -- C:\Users\Steffi\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000002.regtrans-ms

[2011.03.07 20:45:28 | 000,000,020 | -HS- | M] () -- C:\Users\Steffi\ntuser.ini

 
 < %USERPROFILE%\Local Settings\Temp\*.exe >

 
 < %USERPROFILE%\Local Settings\Temp\*.dll >

 
 < %USERPROFILE%\Application Data\*.exe >

 
 < HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs >

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Required: DebugWindows [binary data]

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Windows: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16

 
 <           >
 

< End of report >

Extras.txt

Code:

OTL Extras logfile created on: 02.07.2012 13:06:24 - Run 1

OTL by OldTimer - Version 3.2.53.1     Folder = C:\Users\Steffi\Desktop

 Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

2,96 Gb Total Physical Memory | 2,16 Gb Available Physical Memory | 72,88% Memory free

5,92 Gb Paging File | 4,99 Gb Available in Paging File | 84,25% Paging File free

Paging file location(s): c:\pagefile.sys 0 0 [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 143,79 Gb Total Space | 94,76 Gb Free Space | 65,90% Space Free | Partition Type: NTFS

Drive D: | 139,61 Gb Total Space | 121,98 Gb Free Space | 87,37% Space Free | Partition Type: NTFS

Drive E: | 14,65 Gb Total Space | 9,91 Gb Free Space | 67,63% Space Free | Partition Type: NTFS

 

Computer Name: PUSSYBOX-2 | User Name: Steffi | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Extra Registry (SafeList) ==========

 

 
 ========== File Associations ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)

.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

 

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]

.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

 
 ========== Shell Spawning ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)

htmlfile [edit] -- Reg Error: Key error.

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()

Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [explore] -- Reg Error: Value error.

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

 
 ========== Security Center Settings ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"cval" = 1

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

"VistaSp1" = Reg Error: Unknown registry data type -- File not found

"AntiVirusOverride" = 0

"AntiSpywareOverride" = 0

"FirewallOverride" = 0

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

 
 ========== Firewall Settings ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 
 ========== Authorized Applications List ==========

 

 
 ========== Vista Active Open Ports Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{8562DE92-22C9-4466-BB1B-EE437159E6AD}" = lport=2869 | protocol=6 | dir=in | app=system | 

"{943E9AE6-93CB-4EAB-8E50-55C666454079}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 

 
 ========== Vista Active Application Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{06043C20-63A0-4AD3-ACEE-AA0AD418C4A0}" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe | 

"{233E7DED-BFAD-49B2-A770-CB284CB9470D}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 

"{2C877D23-59BB-4245-91CC-3555DAD1E66A}" = dir=in | app=c:\program files\cyberlink\powerdvd dx\pdvddxsrv.exe | 

"{2E881E32-F4B2-4FEF-859F-56984690BDEC}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 

"{4BE6611D-3382-49D4-BCD0-468FF3A45B8C}" = protocol=6 | dir=in | app=c:\program files\dell video chat\dellvideochat.exe | 

"{71E0B8DB-B5EE-4A95-9F35-57ABEED05BD5}" = dir=in | app=c:\program files\windows live\messenger\wlcsdk.exe | 

"{83DA100A-0FB0-4B61-8A2B-6484565B22C2}" = dir=in | app=c:\program files\cyberlink\powerdvd dx\powerdvd.exe | 

"{85F2C0CF-AF5B-4FDD-8293-8070F82C54D7}" = protocol=17 | dir=in | app=c:\program files\dell video chat\dellvideochat.exe | 

"{9B42DEEA-E4AA-422B-A30E-550B4C97BB35}" = protocol=6 | dir=in | app=c:\program files\dell video chat\dellvideochat.exe | 

"{A67067D9-92EC-427B-9B38-BA659522E6A2}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 

"{A814CDCD-1330-4159-945E-0250311146F6}" = dir=in | app=c:\program files\windows live\sync\windowslivesync.exe | 

"{BB67530C-A20C-483F-A8B5-1709834FD6D0}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 

"{BEE28170-00ED-421B-81AA-0E0F93C03FA5}" = dir=in | app=c:\program files\common files\apple\apple application support\webkit2webprocess.exe | 

"{C5F9ABF9-152E-4BE6-A796-5F5282DB1F38}" = protocol=17 | dir=in | app=c:\program files\dell video chat\dellvideochat.exe | 

"{E35EDC08-0BDA-4F03-916B-EADEFF478C8B}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | 

"TCP Query User{DE10C00D-9769-43A0-98E8-4E02A2823B25}C:\program files\videolan\vlc\vlc.exe" = protocol=6 | dir=in | app=c:\program files\videolan\vlc\vlc.exe | 

"UDP Query User{768A7A9F-98E7-43DB-99D9-59C9A4FCCFAA}C:\program files\videolan\vlc\vlc.exe" = protocol=17 | dir=in | app=c:\program files\videolan\vlc\vlc.exe | 

 
 ========== HKEY_LOCAL_MACHINE Uninstall List ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{0394CDC8-FABD-4ED8-B104-03393876DFDF}" = Roxio Creator Tools

"{07159635-9DFE-4105-BFC0-2817DB540C68}" = Roxio Activation Module

"{095B1DCF-5E8B-47EC-9B18-481918A731DB}" = Microsoft Default Manager

"{0D397393-9B50-4C52-84D5-77E344289F87}" = Roxio Creator Data

"{0F842B77-56EA-4AAF-8295-81A022350B5E}" = Microsoft Security Client

"{1280E900-35DA-4E08-A700-B79A5B2B8532}" = Microsoft Antimalware Service DE-DE Language Pack

"{1B343C8C-F170-4829-8481-E163317C5830}" = iTunes

"{1D5E29AD-39A9-4D0A-A8B6-46A6FCD8C995}" = Live! Cam Avatar

"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool

"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT

"{26A24AE4-039D-4CA4-87B4-2F83216022F0}" = Java(TM) 6 Update 22

"{26A24AE4-039D-4CA4-87B4-2F83216033FF}" = Java(TM) 6 Update 33

"{2A981294-F14C-4F0F-9627-D793270922F8}" = Bonjour

"{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Roxio Update Manager

"{3138EAD3-700B-4A10-B617-B3F8096EE30D}" = Dell Edoc Viewer

"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile

"{4286716B-1287-48E7-9078-3DC8248DBA96}" = OpenOffice.org 3.3

"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater

"{4AB8B41B-3AF1-46BE-99B0-0ACD3B300C0A}" = Junk Mail filter update

"{50779A29-834E-4E36-BBEB-B7CABC67A825}" = Microsoft Security Client DE-DE Language Pack

"{5A166C0B-9557-4364-A057-F946D674E6AC}" = Windows Live Mail

"{619CDD8A-14B6-43A1-AB6C-0F4EE48CE048}" = Roxio Creator Copy

"{65D0C510-D7B6-4438-9FC8-E6B91115AB0D}" = Live! Cam Avatar Creator

"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Roxio Express Labeler 3

"{669C7BD8-DAA2-49B6-966C-F1E2AAE6B17E}" = Cisco PEAP Module

"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD DX

"{6B96DADA-1A27-4A04-8CB2-CC45168D05FA}" = Windows Live Fotogalerie

"{6D3963B0-E13B-4FC3-B0FF-506A304BB043}" = Cisco EAP-FAST Module

"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable

"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053

"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update

"{7BE15435-2D3E-4B58-867F-9C75BED0208C}" = QuickTime

"{81821BF8-DA20-4F8C-AA87-F70A274828D4}" = Windows Live Writer

"{835686C5-8650-49EB-8CA0-4528B4035495}" = Windows Live Call

"{83770D14-21B9-44B3-8689-F7B523F94560}" = Cisco LEAP Module

"{837B6259-6FF5-4E66-87C1-A5A15ED36FF4}" = Windows Live Messenger

"{83E2CFA9-E0EB-4E08-9F85-43E577FF3D60}" = Windows Live Anmelde-Assistent

"{83FFCFC7-88C6-41C6-8752-958A45325C82}" = Roxio Creator Audio

"{880AF49C-34F7-4285-A8AD-8F7A3D1C33DC}" = Roxio Creator BDAV Plugin

"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek 8136 8168 8169 Ethernet Driver

"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight

"{8A74E887-8F0F-4017-AF53-CBA42211AAA5}" = Microsoft Sync Framework Runtime Native v1.0 (x86)

"{8C1E2925-14F8-45AA-B999-1E2A74BF5607}" = Windows Live Sync

"{8D337F77-BE7F-41A2-A7CB-D5A63FD7049B}" = Sonic CinePlayer Decoder Pack

"{8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E}" = Choice Guard

"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System

"{95120000-00AF-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (German)

"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting

"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

"{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = Dell Touchpad

"{A83279FD-CA4B-4206-9535-90974DE76654}" = Apple Application Support

"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.3) - Deutsch

"{AC76BA86-7AD7-5464-3428-900000000004}" = Spelling Dictionaries Support For Adobe Reader 9

"{B4089055-D468-45A4-A6BA-5A138DD715FC}" = Bing Bar

"{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}" = Microsoft Sync Framework Services Native v1.0 (x86)

"{C8B0680B-CDAE-4809-9F91-387B6DE00F7C}" = Roxio Creator DE

"{CACAEB5F-174D-4C7C-AC56-A33289A807CA}" = Apple Mobile Device Support

"{DF5F687F-8018-4542-9F98-7084E9022917}" = Windows Live Essentials

"{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}" = IDT Audio

"{EBF2FCA1-518E-441D-A92A-DCEE9625959E}" = Dell Sicherungs- und Wiederherstellungs-Manager

"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]

"{F69E83CF-B440-43F8-89E6-6EA80712109B}" = Windows Live Communications Platform

"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack

"{FD023F61-65E9-465C-B558-7C64EB2B97E6}" = Dell Handbuch zum Einstieg

"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX

"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin

"Advanced Audio FX Engine" = Advanced Audio FX Engine

"Advanced Video FX Engine" = Advanced Video FX Engine

"Broadcom 802.11b Network Adapter" = Dienstprogramm für Dell Wireless WLAN Karte

"Creative OEM013" = Laptop Integrated Webcam Driver (1.01.01.0529)  

"Dell Video Chat" = Dell Video Chat

"Dell Webcam Center" = Dell Webcam Center

"Dell Webcam Manager" = Dell Webcam Manager

"HDMI" = Intel(R) Graphics Media Accelerator Driver

"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.61.0.1400

"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile

"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack

"Microsoft Security Client" = Microsoft Security Essentials

"Mozilla Firefox 13.0.1 (x86 de)" = Mozilla Firefox 13.0.1 (x86 de)

"Mozilla Thunderbird (3.1.11)" = Mozilla Thunderbird (3.1.11)

"MozillaMaintenanceService" = Mozilla Maintenance Service

"PSPad editor_is1" = PSPad editor

"smartmontools" = smartmontools

"SpeedFan" = SpeedFan (remove only)

"SynTPDeinstKey" = Synaptics Pointing Device Driver

"VLC media player" = VLC media player 1.1.7

"WinLiveSuite_Wave3" = Windows Live Essentials

"WinRAR archiver" = WinRAR

 
 ========== Last 20 Event Log Errors ==========

 

[ Application Events ]

Error - 26.05.2012 03:55:35 | Computer Name = Pussybox-2 | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: m->NextScheduledEvent 7214126

 

Error - 26.05.2012 03:55:35 | Computer Name = Pussybox-2 | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: m->NextScheduledSPRetry 7214126

 

Error - 26.05.2012 03:55:36 | Computer Name = Pussybox-2 | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: Continuously busy for more than a second

 

Error - 26.05.2012 03:55:36 | Computer Name = Pussybox-2 | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: m->NextScheduledEvent 7215155

 

Error - 26.05.2012 03:55:36 | Computer Name = Pussybox-2 | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: m->NextScheduledSPRetry 7215155

 

Error - 26.05.2012 03:55:37 | Computer Name = Pussybox-2 | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: Continuously busy for more than a second

 

Error - 26.05.2012 03:55:37 | Computer Name = Pussybox-2 | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: m->NextScheduledEvent 7216169

 

Error - 26.05.2012 03:55:37 | Computer Name = Pussybox-2 | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: m->NextScheduledSPRetry 7216169

 

Error - 26.05.2012 03:55:38 | Computer Name = Pussybox-2 | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: Continuously busy for more than a second

 

Error - 26.05.2012 03:55:38 | Computer Name = Pussybox-2 | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: m->NextScheduledEvent 7217183

 

Error - 26.05.2012 03:55:38 | Computer Name = Pussybox-2 | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: m->NextScheduledSPRetry 7217183

 

Error - 26.05.2012 03:55:39 | Computer Name = Pussybox-2 | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: Continuously busy for more than a second

 

Error - 26.05.2012 03:55:39 | Computer Name = Pussybox-2 | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: m->NextScheduledEvent 7218182

 

Error - 26.05.2012 03:55:39 | Computer Name = Pussybox-2 | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: m->NextScheduledSPRetry 7218182

 

Error - 26.05.2012 08:45:30 | Computer Name = Pussybox-2 | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: Continuously busy for more than a second

 

Error - 26.05.2012 08:45:30 | Computer Name = Pussybox-2 | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: m->NextScheduledEvent 24609797

 

Error - 26.05.2012 08:45:30 | Computer Name = Pussybox-2 | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: m->NextScheduledSPRetry 24609797

 

Error - 26.05.2012 08:45:33 | Computer Name = Pussybox-2 | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: Continuously busy for more than a second

 

Error - 26.05.2012 08:45:33 | Computer Name = Pussybox-2 | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: m->NextScheduledEvent 24612402

 

Error - 26.05.2012 08:45:33 | Computer Name = Pussybox-2 | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: m->NextScheduledSPRetry 24612402

 

[ Broadcom Wireless LAN Events ]

Error - 13.06.2012 05:20:48 | Computer Name = Pussybox-2 | Source = WLAN-Tray | ID = 0

Description = 11:20:48, Wed, Jun 13, 12 Error - User "" does not have administrative

 privileges on this system 

 

Error - 25.06.2012 08:07:46 | Computer Name = Pussybox-2 | Source = WLAN-Tray | ID = 0

Description = 14:07:46, Mon, Jun 25, 12 Error - User "" does not have administrative

 privileges on this system 

 

[ System Events ]

Error - 02.07.2012 07:13:02 | Computer Name = Pussybox-2 | Source = Ntfs | ID = 262199

Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.

Führen

 Sie auf dem Volume "System" den Befehl "chkdsk" aus.

 

Error - 02.07.2012 07:13:02 | Computer Name = Pussybox-2 | Source = Ntfs | ID = 262199

Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.

Führen

 Sie auf dem Volume "System" den Befehl "chkdsk" aus.

 

Error - 02.07.2012 07:13:02 | Computer Name = Pussybox-2 | Source = Ntfs | ID = 262199

Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.

Führen

 Sie auf dem Volume "System" den Befehl "chkdsk" aus.

 

Error - 02.07.2012 07:13:02 | Computer Name = Pussybox-2 | Source = Ntfs | ID = 262199

Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.

Führen

 Sie auf dem Volume "System" den Befehl "chkdsk" aus.

 

Error - 02.07.2012 07:13:02 | Computer Name = Pussybox-2 | Source = Ntfs | ID = 262199

Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.

Führen

 Sie auf dem Volume "System" den Befehl "chkdsk" aus.

 

Error - 02.07.2012 07:13:02 | Computer Name = Pussybox-2 | Source = Ntfs | ID = 262199

Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.

Führen

 Sie auf dem Volume "System" den Befehl "chkdsk" aus.

 

Error - 02.07.2012 07:13:02 | Computer Name = Pussybox-2 | Source = Ntfs | ID = 262199

Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.

Führen

 Sie auf dem Volume "System" den Befehl "chkdsk" aus.

 

Error - 02.07.2012 07:13:02 | Computer Name = Pussybox-2 | Source = Ntfs | ID = 262199

Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.

Führen

 Sie auf dem Volume "System" den Befehl "chkdsk" aus.

 

Error - 02.07.2012 07:13:02 | Computer Name = Pussybox-2 | Source = Ntfs | ID = 262199

Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.

Führen

 Sie auf dem Volume "System" den Befehl "chkdsk" aus.

 

Error - 02.07.2012 07:13:02 | Computer Name = Pussybox-2 | Source = Ntfs | ID = 262199

Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.

Führen

 Sie auf dem Volume "System" den Befehl "chkdsk" aus.

 

 

< End of report >

Ich hab während dem Quickscan ein paar Mal die Fehlermeldung bekommen, dass OTL.exe beschädigt sei. Eine Datei wäre beschädigt und nicht lesbar und ich soll CHKDSK ausführen. Was bedeutet denn das?

in der folgenden anleitung "name" durch deinen nutzernamen ersetzen bitte.
hi
für eine weitere analyse benötige ich mal folgendes.
c:\Users\name\AppData\LocalLow\Sun\Java\Deployment\cachedort rechtsklick auf den ordner cache, diesen mit winrar oder einem anderen programm packen, und im upload channel hochladen bitte
Trojaner-Board Upload Channel
kurz bescheid geben, wenn erledigt

Hi!

Nachdem ich gefühlte 100 Stunden den Ordner gesucht habe, den du einsehen willst, habe ich ihn erfolgreich als zip hochgeladen. (glaub ich zumindest ... )

Falls es das noch nicht war, gib mir bitte ein kurzes Feedback.

Danke!

danke

Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich
ziehen und eine Bereinigung der Infektion noch erschweren.

Downloade dir bitte Combofix von einem dieser Downloadspiegel

Link 1
Link 2

WICHTIG - Speichere Combofix auf deinem Desktop

Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten

Zitat:

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

starte den Rechner einfach neu. Dies sollte das Problem beheben.

Sodele.

Das von Combofix angelegte Log hieß in meinem Fall nur "Log.txt", ist aber wahrscheinlich das, was du haben wolltest. Hier ist es:

Code:

ComboFix 12-07-02.01 - Steffi 03.07.2012   0:59.1.2 - x86

Microsoft Windows 7 Professional   6.1.7601.1.1252.49.1031.18.3033.1836 [GMT 2:00]

ausgeführt von:: c:\users\Steffi\Desktop\ComboFix.exe

AV: Microsoft Security Essentials *Disabled/Updated* {9765EA51-0D3C-7DFB-6091-10E4E1F341F6}

SP: Microsoft Security Essentials *Disabled/Updated* {2C040BB5-2B06-7275-5A21-2B969A740B4B}

SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\users\Steffi\AppData\Roaming\Local

c:\users\Steffi\AppData\Roaming\Local\Temp\DDM\Settings\0.ddi

c:\users\Steffi\AppData\Roaming\Local\Temp\DDM\Settings\1.ddi

c:\users\Steffi\AppData\Roaming\Local\Temp\DDM\Settings\12.ddi

c:\users\Steffi\AppData\Roaming\Local\Temp\DDM\Settings\13.ddi

c:\users\Steffi\AppData\Roaming\Local\Temp\DDM\Settings\14.ddi

c:\users\Steffi\AppData\Roaming\Local\Temp\DDM\Settings\15.ddi

c:\users\Steffi\AppData\Roaming\Local\Temp\DDM\Settings\16.ddi

c:\users\Steffi\AppData\Roaming\Local\Temp\DDM\Settings\17.ddi

c:\users\Steffi\AppData\Roaming\Local\Temp\DDM\Settings\18.ddi

c:\users\Steffi\AppData\Roaming\Local\Temp\DDM\Settings\19.ddi

c:\users\Steffi\AppData\Roaming\Local\Temp\DDM\Settings\20.ddi

c:\users\Steffi\AppData\Roaming\Local\Temp\DDM\Settings\21.ddi

c:\users\Steffi\AppData\Roaming\Local\Temp\DDM\Settings\22.ddi

c:\users\Steffi\AppData\Roaming\Local\Temp\DDM\Settings\23.ddi

c:\users\Steffi\AppData\Roaming\Local\Temp\DDM\Settings\24.ddi

c:\users\Steffi\AppData\Roaming\Local\Temp\DDM\Settings\25.ddi

c:\users\Steffi\AppData\Roaming\Local\Temp\DDM\Settings\26.ddi

c:\users\Steffi\AppData\Roaming\Local\Temp\DDM\Settings\27.ddi

c:\users\Steffi\AppData\Roaming\Local\Temp\DDM\Settings\3.ddi

c:\users\Steffi\AppData\Roaming\Local\Temp\DDM\Settings\30.ddi

c:\users\Steffi\AppData\Roaming\Local\Temp\DDM\Settings\31.ddi

c:\users\Steffi\AppData\Roaming\Local\Temp\DDM\Settings\4.ddi

c:\users\Steffi\AppData\Roaming\Local\Temp\DDM\Settings\5.ddi

c:\users\Steffi\AppData\Roaming\Local\Temp\DDM\Settings\6.ddi

c:\users\Steffi\AppData\Roaming\Local\Temp\DDM\Settings\7.ddi

c:\users\Steffi\AppData\Roaming\Local\Temp\DDM\Settings\8.ddi

c:\users\Steffi\AppData\Roaming\Local\Temp\DDM\Settings\9.ddi

c:\users\Steffi\AppData\Roaming\Local\Temp\DDM\Settings\arrow.sexcity2.cd1_ns.avi.ddr

c:\users\Steffi\AppData\Roaming\Local\Temp\DDM\Settings\Black_Swan_DVDSCR_ns.avi.ddr

c:\users\Steffi\AppData\Roaming\Local\Temp\DDM\Settings\conan.2010.12.09.sarah.silverman.hdtv.xvid-bff_ns.avi.ddr

c:\users\Steffi\AppData\Roaming\Local\Temp\DDM\Settings\Conan.2010.12.16.Mark.Wahlberg.HDTV.XviD-BFF_ns.avi.ddr

c:\users\Steffi\AppData\Roaming\Local\Temp\DDM\Settings\Conan.2010.12.20.Aaron.Eckhart.HDTV.XviD-BFF_ns.avi.ddr

c:\users\Steffi\AppData\Roaming\Local\Temp\DDM\Settings\Conan.2010.12.21.Kevin.Spacey.HDTV.XviD-BFF_ns.avi.ddr

c:\users\Steffi\AppData\Roaming\Local\Temp\DDM\Settings\Conan.2010.12.22.Jack.Black.HDTV.XviD-sHoTV_ns.avi.ddr

c:\users\Steffi\AppData\Roaming\Local\Temp\DDM\Settings\Easy.A.parlin_ns.avi.ddr

c:\users\Steffi\AppData\Roaming\Local\Temp\DDM\Settings\Family.Guy.Its.A.Trap.2010.DVDRip.parlin_ns.avi.ddr

c:\users\Steffi\AppData\Roaming\Local\Temp\DDM\Settings\Family.Guy.Its.A.Trap.2010.DVDRip.XviD.ph2_ns.avi.ddr

c:\users\Steffi\AppData\Roaming\Local\Temp\DDM\Settings\Hung.S01E01.avi.ddr

c:\users\Steffi\AppData\Roaming\Local\Temp\DDM\Settings\Hung.S01E02.avi.ddr

c:\users\Steffi\AppData\Roaming\Local\Temp\DDM\Settings\lap-hftw_ns.avi.ddr

c:\users\Steffi\AppData\Roaming\Local\Temp\DDM\Settings\Misfits.S01E01.DVDRip.XviD-P0W4_ns.avi(2).ddr

c:\users\Steffi\AppData\Roaming\Local\Temp\DDM\Settings\Misfits.S01E01.DVDRip.XviD-P0W4_ns.avi(3).ddr

c:\users\Steffi\AppData\Roaming\Local\Temp\DDM\Settings\Misfits.S01E01.DVDRip.XviD-P0W4_ns.avi.ddr

c:\users\Steffi\AppData\Roaming\Local\Temp\DDM\Settings\Misfits.S01E02.DVDRip.XviD-P0W4_ns.avi(2).ddr

c:\users\Steffi\AppData\Roaming\Local\Temp\DDM\Settings\Misfits.S01E02.DVDRip.XviD-P0W4_ns.avi.ddr

c:\users\Steffi\AppData\Roaming\Local\Temp\DDM\Settings\Misfits.S01E03.DVDRip.XviD-P0W4_ns.avi(2).ddr

c:\users\Steffi\AppData\Roaming\Local\Temp\DDM\Settings\Misfits.S01E03.DVDRip.XviD-P0W4_ns.avi.ddr

c:\users\Steffi\AppData\Roaming\Local\Temp\DDM\Settings\Misfits.S01E04.DVDRip.XviD-P0W4DVD_ns.avi.ddr

c:\users\Steffi\AppData\Roaming\Local\Temp\DDM\Settings\Misfits.S01E05.DVDRip.XviD-P0W4_ns.avi.ddr

c:\users\Steffi\AppData\Roaming\Local\Temp\DDM\Settings\Misfits.S01E06.DVDRip.XviD-P0W4_ns.avi.ddr

c:\users\Steffi\AppData\Roaming\Local\Temp\DDM\Settings\settings.ddi

c:\users\Steffi\AppData\Roaming\Local\Temp\DDM\Settings\Sex_and_the_City_2_2010_ns.avi(2).ddr

c:\users\Steffi\AppData\Roaming\Local\Temp\DDM\Settings\Sex_and_the_City_2_2010_ns.avi.ddr

c:\users\Steffi\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\arrow.sexcity2.cd1_ns.avi(2).ddp

c:\users\Steffi\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\arrow.sexcity2.cd1_ns.avi.ddp

c:\users\Steffi\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\Black_Swan_DVDSCR_ns.avi

c:\users\Steffi\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\conan.2010.12.09.sarah.silverman.hdtv.xvid-bff_ns.avi

c:\users\Steffi\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\Conan.2010.12.16.Mark.Wahlberg.HDTV.XviD-BFF_ns.avi

c:\users\Steffi\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\Conan.2010.12.20.Aaron.Eckhart.HDTV.XviD-BFF_ns.avi

c:\users\Steffi\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\Conan.2010.12.21.Kevin.Spacey.HDTV.XviD-BFF_ns.avi

c:\users\Steffi\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\Conan.2010.12.22.Jack.Black.HDTV.XviD-sHoTV_ns.avi

c:\users\Steffi\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\Easy.A.parlin_ns.avi

c:\users\Steffi\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\Family.Guy.Its.A.Trap.2010.DVDRip.parlin_ns.avi.ddp

c:\users\Steffi\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\Family.Guy.Its.A.Trap.2010.DVDRip.XviD.ph2_ns.avi.ddp

c:\users\Steffi\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\Hung.S01E01.avi

c:\users\Steffi\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\Hung.S01E02.avi

c:\users\Steffi\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\Hung.S01E03.avi.ddp

c:\users\Steffi\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\lap-hftw_ns.avi

c:\users\Steffi\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\Misfits.S01E01.DVDRip.XviD-P0W4_ns.avi

c:\users\Steffi\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\Misfits.S01E01.DVDRip.XviD-P0W4_ns.avi(3).ddp

c:\users\Steffi\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\Misfits.S01E01.DVDRip.XviD-P0W4_ns.avi.ddp

c:\users\Steffi\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\Misfits.S01E02.DVDRip.XviD-P0W4_ns.avi

c:\users\Steffi\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\Misfits.S01E02.DVDRip.XviD-P0W4_ns.avi(3).ddp

c:\users\Steffi\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\Misfits.S01E02.DVDRip.XviD-P0W4_ns.avi(4).ddp

c:\users\Steffi\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\Misfits.S01E02.DVDRip.XviD-P0W4_ns.avi.ddp

c:\users\Steffi\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\Misfits.S01E03.DVDRip.XviD-P0W4_ns(2).avi

c:\users\Steffi\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\Misfits.S01E03.DVDRip.XviD-P0W4_ns.avi

c:\users\Steffi\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\Misfits.S01E04.DVDRip.XviD-P0W4_ns.avi.ddp

c:\users\Steffi\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\Misfits.S01E04.DVDRip.XviD-P0W4DVD_ns.avi

c:\users\Steffi\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\Misfits.S01E05.DVDRip.XviD-P0W4_ns.avi

c:\users\Steffi\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\Misfits.S01E06.DVDRip.XviD-P0W4_ns.avi

c:\users\Steffi\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\Sex_and_the_City_2_2010_ns.avi

c:\users\Steffi\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\Sex_and_the_City_2_2010_ns.avi.ddp

c:\users\Steffi\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\the.back-up.plan.2010.dvdrip.xvid-arrow_ns.avi

c:\users\Steffi\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\the.closer.s06e13.hdtv.xvid-fever_ns.avi

c:\users\Steffi\AppData\Roaming\Local\Temp\DDM\Settings\the.back-up.plan.2010.dvdrip.xvid-arrow_ns.avi.ddr

c:\users\Steffi\AppData\Roaming\Local\Temp\DDM\Settings\the.closer.s06e13.hdtv.xvid-fever_ns.avi.ddr

.

Infizierte Kopie von c:\windows\System32\autochk.exe wurde gefunden und desinfiziert 

Kopie von - c:\windows\winsxs\x86_microsoft-windows-autochk_31bf3856ad364e35_6.1.7600.16385_none_e1ca436d2314b860\autochk.exe wurde wiederhergestellt 

.

.

(((((((((((((((((((((((   Dateien erstellt von 2012-06-02 bis 2012-07-02  ))))))))))))))))))))))))))))))

.

.

2012-07-02 23:03 . 2012-07-02 23:05        --------        d-----w-        c:\users\Steffi\AppData\Local\temp

2012-07-02 23:03 . 2012-07-02 23:03        --------        d-----w-        c:\users\Default\AppData\Local\temp

2012-07-02 22:55 . 2012-07-02 22:55        56200        ----a-w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{4426796B-F464-474C-8528-18B3C61F9313}\offreg.dll

2012-07-02 21:59 . 2012-07-02 21:59        29904        ----a-w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{4426796B-F464-474C-8528-18B3C61F9313}\MpKsla97d691e.sys

2012-07-02 05:26 . 2012-05-31 03:41        6762896        ----a-w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{4426796B-F464-474C-8528-18B3C61F9313}\mpengine.dll

2012-07-02 05:17 . 2012-07-02 05:17        476936        ----a-w-        c:\windows\system32\npdeployJava1.dll

2012-07-02 03:22 . 2012-07-02 03:22        --------        d-----w-        c:\users\Steffi\AppData\Local\ElevatedDiagnostics

2012-06-30 17:58 . 2012-05-31 03:41        6762896        ----a-w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll

2012-06-21 18:55 . 2012-06-02 22:19        53784        ----a-w-        c:\windows\system32\wuauclt.exe

2012-06-21 18:55 . 2012-06-02 22:19        45080        ----a-w-        c:\windows\system32\wups2.dll

2012-06-21 18:55 . 2012-06-02 22:12        2422272        ----a-w-        c:\windows\system32\wucltux.dll

2012-06-21 18:55 . 2012-06-02 22:19        1933848        ----a-w-        c:\windows\system32\wuaueng.dll

2012-06-21 18:55 . 2012-06-02 22:19        35864        ----a-w-        c:\windows\system32\wups.dll

2012-06-21 18:55 . 2012-06-02 22:19        577048        ----a-w-        c:\windows\system32\wuapi.dll

2012-06-21 18:55 . 2012-06-02 22:12        88576        ----a-w-        c:\windows\system32\wudriver.dll

2012-06-21 18:55 . 2012-06-02 13:19        171904        ----a-w-        c:\windows\system32\wuwebv.dll

2012-06-21 18:55 . 2012-06-02 13:12        33792        ----a-w-        c:\windows\system32\wuapp.exe

2012-06-13 19:59 . 2012-06-13 19:59        --------        d-----w-        c:\users\Steffi\AppData\Local\Macromedia

2012-06-13 19:49 . 2012-02-10 21:55        713784        ------w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{CDF3C294-C896-43B3-AC04-5F66B1DF4C9C}\gapaengine.dll

2012-06-13 08:33 . 2012-04-28 03:17        183808        ----a-w-        c:\windows\system32\drivers\rdpwd.sys

2012-06-13 08:33 . 2012-04-07 11:26        2342400        ----a-w-        c:\windows\system32\msi.dll

2012-06-13 08:33 . 2012-05-15 01:05        2343936        ----a-w-        c:\windows\system32\win32k.sys

2012-06-13 08:33 . 2012-04-26 04:45        58880        ----a-w-        c:\windows\system32\rdpwsx.dll

2012-06-13 08:33 . 2012-04-26 04:45        129536        ----a-w-        c:\windows\system32\rdpcorekmts.dll

2012-06-13 08:33 . 2012-04-26 04:41        8192        ----a-w-        c:\windows\system32\rdrmemptylst.exe

2012-06-13 08:33 . 2012-05-01 04:44        164352        ----a-w-        c:\windows\system32\profsvc.dll

2012-06-13 08:33 . 2012-04-24 04:36        140288        ----a-w-        c:\windows\system32\cryptsvc.dll

2012-06-13 08:33 . 2012-04-24 04:36        1158656        ----a-w-        c:\windows\system32\crypt32.dll

2012-06-13 08:33 . 2012-04-24 04:36        103936        ----a-w-        c:\windows\system32\cryptnet.dll

2012-06-09 01:20 . 2012-06-09 01:20        421200        ----a-w-        c:\program files\Mozilla Firefox\msvcp100.dll

2012-06-09 01:20 . 2012-06-09 01:20        770384        ----a-w-        c:\program files\Mozilla Firefox\msvcr100.dll

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-07-02 23:05 . 2011-03-07 17:25        17920        ----a-w-        c:\windows\system32\rpcnetp.dll

2012-07-02 23:05 . 2009-10-11 15:32        58288        ----a-w-        c:\windows\system32\rpcnet.dll

2012-07-02 23:04 . 2011-03-07 17:24        17920        ----a-w-        c:\windows\system32\rpcnetp.exe

2012-07-02 21:58 . 2010-11-06 21:59        13160        ----a-w-        c:\windows\system32\Upgrd.exe

2012-07-02 21:58 . 2009-10-11 15:32        58288        ------w-        c:\windows\system32\rpcnet.exe

2012-07-02 05:17 . 2011-02-28 16:04        472840        ----a-w-        c:\windows\system32\deployJava1.dll

2012-06-23 06:59 . 2012-04-05 19:15        426184        ----a-w-        c:\windows\system32\FlashPlayerApp.exe

2012-06-23 06:59 . 2011-05-25 11:58        70344        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl

2012-04-04 13:56 . 2011-02-28 15:20        22344        ----a-w-        c:\windows\system32\drivers\mbam.sys

2012-06-17 04:06 . 2011-03-29 11:03        85472        ----a-w-        c:\program files\mozilla firefox\components\browsercomps.dll

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1174016]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-03-20 1451304]

"OEM13Mon.exe"="c:\windows\OEM13Mon.exe" [2009-01-18 36864]

"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2008-12-11 3563520]

"SysTrayApp"="c:\program files\IDT\WDM\sttray.exe" [2009-07-27 458844]

"PDVDDXSrv"="c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2009-06-24 140520]

"Apoint"="c:\program files\DellTPad\Apoint.exe" [2009-02-27 217088]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-03-01 421160]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-02-11 137752]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-02-11 171032]

"Persistence"="c:\windows\system32\igfxpers.exe" [2011-02-11 172568]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]

"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-09-27 59240]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-10-24 421888]

"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-03-26 931200]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]

.

c:\users\Steffi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

OpenOffice.org 3.3.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

@="Service"

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

@="Driver"

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]

2012-01-03 07:37        843712        ----a-w-        c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DELL Webcam Manager]

2007-07-27 21:43        118784        ----a-w-        c:\program files\Dell\Dell Webcam Manager\DellWMgr.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]

2011-03-01 20:45        421160        ----a-w-        c:\program files\iTunes\iTunesHelper.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Default Manager]

2009-04-24 16:05        250192        ----a-w-        c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PDVDDXSrv]

2009-06-24 19:19        140520        ------w-        c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]

2011-10-24 13:28        421888        ----a-w-        c:\program files\QuickTime\QTTask.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]

2009-03-20 05:36        1451304        ----a-w-        c:\program files\Synaptics\SynTP\SynTPEnh.exe

.

R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [x]

R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\Mozilla Maintenance Service\maintenanceservice.exe [x]

R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [x]

R3 NisSrv;Microsoft-Netzwerkinspektion;c:\program files\Microsoft Security Client\NisSrv.exe [x]

R3 PCDSRVC{E9D79540-57D5953E-06020101}_0;PCDSRVC{E9D79540-57D5953E-06020101}_0 - PCDR Kernel Mode Service Helper Driver;c:\program files\dell support center\pcdsrvc.pkms [x]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]

S1 MpKsla97d691e;MpKsla97d691e;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{4426796B-F464-474C-8528-18B3C61F9313}\MpKsla97d691e.sys [x]

S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]

S2 {1E444BE9-B8EC-4ce6-8C2B-6536FB7F4FB7};Power Control [2011/03/07 19:52];c:\program files\CyberLink\PowerDVD DX\000.fcl [x]

S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [x]

S2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_638e19a9cc691dc9\aestsrv.exe [x]

S2 BBSvc;Bing Bar Update Service;c:\program files\Microsoft\BingBar\BBSvc.EXE [x]

S2 BBUpdate;BBUpdate;c:\program files\Microsoft\BingBar\SeaPort.EXE [x]

S3 O2MDGRDR;O2MDGRDR;c:\windows\system32\DRIVERS\o2mdg.sys [x]

S3 O2SDGRDR;O2SDGRDR;c:\windows\system32\DRIVERS\o2sdg.sys [x]

S3 OEM13Vfx;Creative Camera OEM013 Video VFX Driver;c:\windows\system32\DRIVERS\OEM13Vfx.sys [x]

S3 OEM13Vid;Creative Camera OEM013 Driver;c:\windows\system32\DRIVERS\OEM13Vid.sys [x]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [x]

.

.

--- Andere Dienste/Treiber im Speicher ---

.

*NewlyCreated* - WS2IFSL

*Deregistered* - cmderd

*Deregistered* - cmdGuard

*Deregistered* - cmdHlp

*Deregistered* - inspect

.

Inhalt des "geplante Tasks" Ordners

.

2012-07-02 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-05 06:59]

.

.

------- Zusätzlicher Suchlauf -------

.

uInternet Settings,ProxyOverride = *.local

TCP: DhcpNameServer = 192.168.2.1

FF - ProfilePath - c:\users\Steffi\AppData\Roaming\Mozilla\Firefox\Profiles\0spd8zk9.default\

FF - prefs.js: browser.startup.homepage - 

.

.

------- Dateityp-Verknüpfung -------

.

txtfile="c:\program files\PSPad editor\PSPad.exe" "%1"

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

HKLM-Run-dellsupportcenter - c:\program files\Dell Support Center\bin\sprtcmd.exe

MSConfigStartUp-DellSupportCenter - c:\program files\Dell Support Center\bin\sprtcmd.exe

MSConfigStartUp-DivX Download Manager - c:\program files\DivX\DivX Plus Web Player\DDmService.exe

AddRemove-{1D5E29AD-39A9-4D0A-A8B6-46A6FCD8C995} - c:\program files\InstallShield Installation Information\{1D5E29AD-39A9-4D0A-A8B6-46A6FCD8C995}\setup.exe

AddRemove-{65D0C510-D7B6-4438-9FC8-E6B91115AB0D} - c:\program files\InstallShield Installation Information\{65D0C510-D7B6-4438-9FC8-E6B91115AB0D}\setup.exe

.

.

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PCDSRVC{E9D79540-57D5953E-06020101}_0]

"ImagePath"="\??\c:\program files\dell support center\pcdsrvc.pkms"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\{1E444BE9-B8EC-4ce6-8C2B-6536FB7F4FB7}]

"ImagePath"="\??\c:\program files\CyberLink\PowerDVD DX\000.fcl"

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]

@Denied: (2) (LocalSystem)

"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,

   d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,bb,b5,59,4a,43,00,00,45,80,08,50,\

"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,

   d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,bb,b5,59,4a,43,00,00,45,80,08,50,\

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

------------------------ Weitere laufende Prozesse ------------------------

.

c:\program files\Microsoft Security Client\MsMpEng.exe

c:\windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_638e19a9cc691dc9\STacSV.exe

c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

c:\program files\Bonjour\mDNSResponder.exe

c:\windows\system32\DRIVERS\o2flash.exe

c:\windows\system32\rpcnet.exe

c:\windows\System32\WLTRYSVC.EXE

c:\windows\System32\bcmwltry.exe

c:\windows\system32\taskhost.exe

c:\windows\system32\conhost.exe

c:\program files\OpenOffice.org 3\program\soffice.exe

c:\program files\OpenOffice.org 3\program\soffice.bin

c:\program files\DellTPad\ApMsgFwd.exe

c:\program files\DellTPad\HidFind.exe

c:\program files\DellTPad\Apntex.exe

c:\windows\system32\conhost.exe

c:\program files\iPod\bin\iPodService.exe

c:\windows\system32\sppsvc.exe

.

**************************************************************************

.

Zeit der Fertigstellung: 2012-07-03  01:08:17 - PC wurde neu gestartet

ComboFix-quarantined-files.txt  2012-07-02 23:08

.

Vor Suchlauf: 9 Verzeichnis(se), 102.496.133.120 Bytes frei

Nach Suchlauf: 16 Verzeichnis(se), 102.580.559.872 Bytes frei

.

- - End Of File - - 76F1CE09405D0085D40545CC2C6DDC4C

download tdss killer:
http://www.trojaner-board.de/82358-t...entfernen.html
Klicke auf Change parameters
• Setze die Haken bei Verify driver digital signatures und Detect TDLFS file system
• Klick auf OK und anschließend auf Start scan
- bei funden erst mal immer skip wählen, log posten

Hi Markus,

das TDSS Log ist zu lang um es hier direkt zu posten, hängt daher gezipped an.

sehr gut
Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

Starte bitte die
OTL.exe
.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Kopiere nun den Inhalt in die http://larusso.trojaner-board.de/Images/otlfix.jpg
Textbox.

Code:

activex

netsvcs

msconfig

%SYSTEMDRIVE%\*.

%PROGRAMFILES%\*.exe

%LOCALAPPDATA%\*.exe

%systemroot%\*. /mp /s

/md5start

userinit.exe

eventlog.dll

scecli.dll

netlogon.dll

cngaudit.dll

ws2ifsl.sys

sceclt.dll

ntelogon.dll

winlogon.exe

logevent.dll

user32.DLL

explorer.exe

iaStor.sys

nvstor.sys

atapi.sys

IdeChnDr.sys

viasraid.sys

AGP440.sys

vaxscsi.sys

nvatabus.sys

viamraid.sys

nvata.sys

nvgts.sys

iastorv.sys

ViPrt.sys

eNetHook.dll

ahcix86.sys

KR10N.sys

nvstor32.sys

ahcix86s.sys

/md5stop

%systemroot%\system32\drivers\*.sys /lockedfiles

%systemroot%\System32\config\*.sav

%systemroot%\system32\*.dll /lockedfiles

%USERPROFILE%\*.*

%USERPROFILE%\Local Settings\Temp\*.exe

%USERPROFILE%\Local Settings\Temp\*.dll

%USERPROFILE%\Application Data\*.exe

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs

CREATERESTOREPOINT

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Kopiere
nun den Inhalt aus OTL.txt und Extra.txt hier in Deinen Thread

Hi!

Hm. Es wurde von OTL nur ein OTL.txt erstellt, Extra.txt ist nach diesem Quickscan nirgendwo zu entdecken ...

Ausserdem erhielt ich währen dem Scan folgende Fehlermeldung:
"OTL.exe beschädigt
C:/Users/Steffi/AppData/Local/Mozilla/Firefox/Profiles/0spd8zk9.default/Cache/9/BD
beschädigt und nicht lesbar, CHKDSK ausführen."

Hab ausserdem vergessen bei OTL bei Extra-Registrierung "Benutze Safe List" anzuklicken (stattdessen "Aus"). Ist das ein Problem?

Hier trotzdem der OTL.txt Log:

Code:

OTL logfile created on: 04.07.2012 02:38:01 - Run 2

OTL by OldTimer - Version 3.2.53.1     Folder = C:\Users\Steffi\Desktop

 Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

2,96 Gb Total Physical Memory | 2,12 Gb Available Physical Memory | 71,41% Memory free

5,92 Gb Paging File | 4,83 Gb Available in Paging File | 81,53% Paging File free

Paging file location(s): c:\pagefile.sys 0 0 [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 143,79 Gb Total Space | 95,40 Gb Free Space | 66,35% Space Free | Partition Type: NTFS

Drive D: | 139,61 Gb Total Space | 122,19 Gb Free Space | 87,52% Space Free | Partition Type: NTFS

Drive E: | 14,65 Gb Total Space | 9,91 Gb Free Space | 67,63% Space Free | Partition Type: NTFS

 

Computer Name: PUSSYBOX-2 | User Name: Steffi | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - C:\Windows\System32\Upgrd.exe (Absolute Software Corp.)

PRC - C:\Windows\System32\rpcnet.exe (Absolute Software Corp.)

PRC - C:\Users\Steffi\Desktop\OTL.exe (OldTimer Tools)

PRC - C:\Programme\Microsoft Security Client\msseces.exe (Microsoft Corporation)

PRC - C:\Programme\Microsoft Security Client\MpCmdRun.exe (Microsoft Corporation)

PRC - C:\Programme\Microsoft Security Client\MsMpEng.exe (Microsoft Corporation)

PRC - C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)

PRC - C:\Programme\Microsoft\BingBar\SeaPort.EXE (Microsoft Corporation)

PRC - C:\Windows\System32\conhost.exe (Microsoft Corporation)

PRC - C:\Windows\explorer.exe (Microsoft Corporation)

PRC - C:\Programme\OpenOffice.org 3\program\soffice.exe (OpenOffice.org)

PRC - C:\Programme\OpenOffice.org 3\program\soffice.bin (OpenOffice.org)

PRC - C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)

PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)

PRC - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_638e19a9cc691dc9\AEstSrv.exe (Andrea Electronics Corporation)

PRC - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_638e19a9cc691dc9\stacsv.exe (IDT, Inc.)

PRC - C:\Programme\IDT\WDM\sttray.exe (IDT, Inc.)

PRC - C:\Programme\CyberLink\PowerDVD DX\PDVDDXSrv.exe (CyberLink Corp.)

PRC - C:\Programme\DellTPad\Apoint.exe (Alps Electric Co., Ltd.)

PRC - C:\Programme\DellTPad\ApntEx.exe (Alps Electric Co., Ltd.)

PRC - C:\Programme\DellTPad\hidfind.exe (Alps Electric Co., Ltd.)

PRC - C:\Windows\OEM13Mon.exe (Creative Technology Ltd.)

PRC - C:\Windows\System32\drivers\o2flash.exe (O2Micro International)

PRC - C:\Programme\DellTPad\ApMsgFwd.exe (Alps Electric Co., Ltd.)

 

 
 ========== Modules (No Company Name) ==========

 

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\a501b7960f6c6e2e39162b83f3303aaa\System.Web.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\03dee80574f4ec770b6f77ca030ded6c\System.Runtime.Remoting.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\ce9ff6baf9053ed2ed673d948179195c\System.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\acfc1391e45fedd2a359778ea57d914c\mscorlib.ni.dll ()

MOD - C:\Programme\OpenOffice.org 3\program\libxml2.dll ()

MOD - C:\Programme\Common Files\Apple\Apple Application Support\zlib1.dll ()

MOD - C:\Programme\Common Files\Apple\Apple Application Support\libxml2.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\System.Runtime.Remoting.resources\2.0.0.0_de_b77a5c561934e089\System.Runtime.Remoting.resources.dll ()

MOD - C:\Windows\System32\bcmwlrmt.dll ()

MOD - C:\Programme\PSPad editor\PSPadShell.dll ()

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV - (rpcnet) Remote Procedure Call (RPC) -- C:\Windows\System32\rpcnet.exe (Absolute Software Corp.)

SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)

SRV - (MozillaMaintenance) -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)

SRV - (NisSrv) -- C:\Programme\Microsoft Security Client\NisSrv.exe (Microsoft Corporation)

SRV - (MsMpSvc) -- C:\Programme\Microsoft Security Client\MsMpEng.exe (Microsoft Corporation)

SRV - (AdobeARMservice) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)

SRV - (BBSvc) -- C:\Programme\Microsoft\BingBar\BBSvc.EXE (Microsoft Corporation.)

SRV - (BBUpdate) -- C:\Programme\Microsoft\BingBar\SeaPort.EXE (Microsoft Corporation)

SRV - (WMPNetworkSvc) -- C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)

SRV - (AESTFilters) -- C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_638e19a9cc691dc9\AEstSrv.exe (Andrea Electronics Corporation)

SRV - (STacSV) -- C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_638e19a9cc691dc9\stacsv.exe (IDT, Inc.)

SRV - (StorSvc) -- C:\Windows\System32\StorSvc.dll (Microsoft Corporation)

SRV - (SensrSvc) -- C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)

SRV - (PeerDistSvc) -- C:\Windows\System32\PeerDistSvc.dll (Microsoft Corporation)

SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)

SRV - (O2FLASH) -- C:\Windows\System32\drivers\o2flash.exe (O2Micro International)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - (PCDSRVC{E9D79540-57D5953E-06020101}_0) -- c:\program files\dell support center\pcdsrvc.pkms File not found

DRV - (catchme) -- C:\Users\Steffi\AppData\Local\Temp\catchme.sys File not found

DRV - (MpKslc83f78ca) -- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{9CFB798F-CC05-420C-95B6-F9FB021084D3}\MpKslc83f78ca.sys (Microsoft Corporation)

DRV - (NisDrv) -- C:\Windows\System32\drivers\NisDrvWFP.sys (Microsoft Corporation)

DRV - (vmbus) -- C:\Windows\System32\drivers\vmbus.sys (Microsoft Corporation)

DRV - (storflt) -- C:\Windows\System32\drivers\vmstorfl.sys (Microsoft Corporation)

DRV - (storvsc) -- C:\Windows\System32\drivers\storvsc.sys (Microsoft Corporation)

DRV - (TsUsbFlt) -- C:\Windows\System32\drivers\TsUsbFlt.sys (Microsoft Corporation)

DRV - (VMBusHID) -- C:\Windows\System32\drivers\VMBusHID.sys (Microsoft Corporation)

DRV - (s3cap) -- C:\Windows\System32\drivers\vms3cap.sys (Microsoft Corporation)

DRV - (RTL8169) -- C:\Windows\System32\drivers\Rtlh86.sys (Realtek                                            )

DRV - (STHDA) -- C:\Windows\System32\drivers\stwrt.sys (IDT, Inc.)

DRV - ({1E444BE9-B8EC-4ce6-8C2B-6536FB7F4FB7}) -- C:\Programme\CyberLink\PowerDVD DX\000.fcl (CyberLink Corp.)

DRV - (ApfiltrService) -- C:\Windows\System32\drivers\Apfiltr.sys (Alps Electric Co., Ltd.)

DRV - (OEM13Vid) -- C:\Windows\System32\drivers\OEM13Vid.sys (Creative Technology Ltd.)

DRV - (OEM13Vfx) -- C:\Windows\System32\drivers\OEM13Vfx.sys (EyePower Games Pte. Ltd.)

DRV - (O2MDGRDR) -- C:\Windows\System32\drivers\o2mdg.sys (O2Micro )

DRV - (O2SDGRDR) -- C:\Windows\System32\drivers\o2sdg.sys (O2Micro )

DRV - (BCM42RLY) -- C:\Windows\System32\drivers\bcm42rly.sys (Broadcom Corporation)

DRV - (speedfan) -- C:\Windows\System32\speedfan.sys (Windows (R) 2000 DDK provider)

DRV - (giveio) -- C:\Windows\System32\giveio.sys ()

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE - HKLM\..\SearchScopes,DefaultScope = {F7D15FE7-9604-4051-ADAB-F3FCAC15C356}

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKLM\..\SearchScopes\{F7D15FE7-9604-4051-ADAB-F3FCAC15C356}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&Form=DLSDF7&pc=MDDS&src={referrer:source?}

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/USSMB/8

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1

IE - HKCU\..\SearchScopes,DefaultScope = {F7D15FE7-9604-4051-ADAB-F3FCAC15C356}

IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC

IE - HKCU\..\SearchScopes\{F7D15FE7-9604-4051-ADAB-F3FCAC15C356}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=DLSDF7&pc=MDDS&src=IE-SearchBox

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

 
 ========== FireFox ==========

 

FF - prefs.js..browser.startup.homepage: ""

FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.5

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24

FF - user.js - File not found

 

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_3_300_262.dll ()

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()

FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=1.6.0_33: C:\Windows\system32\npdeployJava1.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8051.1204: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@veetle.com/vbp;version=0.9.16: C:\Users\Steffi\Desktop\Veetle\VLCBroadcast\npvbp.dll File not found

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.06.17 06:06:04 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.07.02 07:17:24 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 3.1.11\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2011.11.10 22:22:01 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 3.1.11\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins [2012.04.16 03:32:31 | 000,000,000 | ---D | M]

FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.06.17 06:06:04 | 000,000,000 | ---D | M]

FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.07.02 07:17:24 | 000,000,000 | ---D | M]

 

[2011.03.07 19:37:25 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Steffi\AppData\Roaming\mozilla\Extensions

[2010.12.10 23:09:21 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Steffi\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}

[2012.06.29 12:20:28 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Steffi\AppData\Roaming\mozilla\Firefox\Profiles\0spd8zk9.default\extensions

[2011.03.07 19:37:26 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Steffi\AppData\Roaming\mozilla\Firefox\Profiles\0spd8zk9.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}

[2012.07.02 07:17:26 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions

[2012.07.02 07:17:26 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}

[2012.07.02 07:17:26 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}

[2012.06.17 06:06:04 | 000,085,472 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll

[2011.10.04 13:02:46 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml

[2011.10.04 13:02:46 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml

[2011.10.04 13:02:46 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml

[2011.10.04 13:02:46 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml

[2011.10.04 13:02:46 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml

[2011.10.04 13:02:46 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml

 

O1 HOSTS File: ([2012.07.03 01:05:22 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1       localhost

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.

O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)

O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)

O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)

O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.

O4 - HKLM..\Run: [Apoint] C:\Programme\DellTPad\Apoint.exe (Alps Electric Co., Ltd.)

O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)

O4 - HKLM..\Run: [MSC] C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)

O4 - HKLM..\Run: [OEM13Mon.exe] C:\Windows\OEM13Mon.exe (Creative Technology Ltd.)

O4 - HKLM..\Run: [PDVDDXSrv] C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe (CyberLink Corp.)

O4 - HKLM..\Run: [SysTrayApp] C:\Programme\IDT\WDM\sttray.exe (IDT, Inc.)

O4 - Startup: C:\Users\Steffi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = C:\Programme\OpenOffice.org 3\program\quickstart.exe ()

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O9 - Extra Button: In Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : In Windows Live Writer in Blog veröffentliche&n - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Java Plug-in 1.6.0_33)

O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)

O16 - DPF: {CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Java Plug-in 1.6.0_33)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Java Plug-in 1.6.0_33)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{CAC4889E-0665-49E7-9CE4-7B38C1EADC2B}: DhcpNameServer = 192.168.1.254

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{CF7BB424-3720-4F30-9729-426088F112FB}: DhcpNameServer = 192.168.2.1

O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8050.1202.dll (Microsoft Corporation)

O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8050.1202.dll (Microsoft Corporation)

O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Programme\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O24 - Desktop WallPaper: C:\Users\Steffi\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg

O24 - Desktop BackupWallPaper: C:\Users\Steffi\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

O34 - HKLM BootExecute: (autocheck autochk *)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = ComFile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

 

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)

ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0

ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework

ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework

ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings

ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install

ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP

ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig

ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

 

NetSvcs: FastUserSwitchingCompatibility -  File not found

NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)

NetSvcs: Nla -  File not found

NetSvcs: Ntmssvc -  File not found

NetSvcs: NWCWorkstation -  File not found

NetSvcs: Nwsapagent -  File not found

NetSvcs: SRService -  File not found

NetSvcs: WmdmPmSp -  File not found

NetSvcs: LogonHours -  File not found

NetSvcs: PCAudit -  File not found

NetSvcs: helpsvc -  File not found

NetSvcs: uploadmgr -  File not found

 

MsConfig - StartUpReg: Adobe ARM - hkey= - key= - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)

MsConfig - StartUpReg: DELL Webcam Manager - hkey= - key= - C:\Program Files\Dell\Dell Webcam Manager\DellWMgr.exe (Creative Technology Ltd.)

MsConfig - StartUpReg: iTunesHelper - hkey= - key= - C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)

MsConfig - StartUpReg: Microsoft Default Manager - hkey= - key= - C:\Program Files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe (Microsoft Corporation)

MsConfig - StartUpReg: PDVDDXSrv - hkey= - key= - C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe (CyberLink Corp.)

MsConfig - StartUpReg: QuickTime Task - hkey= - key= - C:\Program Files\QuickTime\QTTask.exe (Apple Inc.)

MsConfig - StartUpReg: SynTPEnh - hkey= - key= - C:\Programme\Synaptics\SynTP\SynTPEnh.exe (Synaptics Incorporated)

MsConfig - State: "services" - 0

MsConfig - State: "startup" - 2

 

CREATERESTOREPOINT

System Restore Service not available.

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2012.07.03 13:12:46 | 002,135,640 | ---- | C] (Kaspersky Lab ZAO) -- C:\Users\Steffi\Desktop\tdsskiller.exe

[2012.07.03 01:08:19 | 000,000,000 | ---D | C] -- C:\Windows\temp

[2012.07.03 01:07:32 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN

[2012.07.03 01:03:32 | 000,000,000 | ---D | C] -- C:\Users\Steffi\AppData\Local\temp

[2012.07.03 00:58:03 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe

[2012.07.03 00:58:03 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe

[2012.07.03 00:58:03 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe

[2012.07.03 00:57:57 | 000,000,000 | ---D | C] -- C:\Qoobox

[2012.07.03 00:57:47 | 000,000,000 | ---D | C] -- C:\Windows\erdnt

[2012.07.03 00:54:17 | 004,568,951 | R--- | C] (Swearware) -- C:\Users\Steffi\Desktop\ComboFix.exe

[2012.07.02 12:59:24 | 000,595,968 | ---- | C] (OldTimer Tools) -- C:\Users\Steffi\Desktop\OTL.exe

[2012.07.02 05:22:01 | 000,000,000 | ---D | C] -- C:\Users\Steffi\AppData\Local\ElevatedDiagnostics

[2012.06.13 21:59:43 | 000,000,000 | ---D | C] -- C:\Users\Steffi\AppData\Local\Macromedia

 
 ========== Files - Modified Within 30 Days ==========

 

[2012.07.04 02:27:35 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job

[2012.07.04 02:27:30 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2012.07.04 02:27:30 | 000,017,920 | ---- | M] () -- C:\Windows\System32\rpcnetp.exe

[2012.07.03 13:24:44 | 000,058,892 | ---- | M] () -- C:\Users\Steffi\Desktop\log tdsskiller.zip

[2012.07.03 13:12:48 | 002,135,640 | ---- | M] (Kaspersky Lab ZAO) -- C:\Users\Steffi\Desktop\tdsskiller.exe

[2012.07.03 01:21:30 | 000,011,248 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2012.07.03 01:21:30 | 000,011,248 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2012.07.03 01:18:56 | 000,656,266 | ---- | M] () -- C:\Windows\System32\perfh007.dat

[2012.07.03 01:18:56 | 000,618,108 | ---- | M] () -- C:\Windows\System32\perfh009.dat

[2012.07.03 01:18:56 | 000,131,006 | ---- | M] () -- C:\Windows\System32\perfc007.dat

[2012.07.03 01:18:56 | 000,107,388 | ---- | M] () -- C:\Windows\System32\perfc009.dat

[2012.07.03 01:17:45 | 000,058,288 | ---- | M] (Absolute Software Corp.) -- C:\Windows\System32\rpcnet.dll

[2012.07.03 01:17:24 | 000,013,160 | ---- | M] (Absolute Software Corp.) -- C:\Windows\System32\Upgrd.exe

[2012.07.03 01:17:14 | 000,058,288 | ---- | M] (Absolute Software Corp.) -- C:\Windows\System32\rpcnet.exe

[2012.07.03 01:14:27 | 000,017,920 | ---- | M] () -- C:\Windows\System32\rpcnetp.dll

[2012.07.03 01:13:31 | 2385,154,048 | -HS- | M] () -- C:\hiberfil.sys

[2012.07.03 01:05:22 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts

[2012.07.03 00:55:07 | 004,568,951 | R--- | M] (Swearware) -- C:\Users\Steffi\Desktop\ComboFix.exe

[2012.07.03 00:35:54 | 001,846,783 | ---- | M] () -- C:\Users\Steffi\Desktop\cache.zip

[2012.07.02 12:59:27 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Users\Steffi\Desktop\OTL.exe

[2012.07.02 05:22:39 | 000,001,073 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2012.06.27 13:55:15 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_09_00.Wdf

[2012.06.13 21:39:05 | 000,334,992 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT

[2012.06.04 23:19:11 | 000,000,064 | ---- | M] () -- C:\Users\Steffi\Desktop\Das ouk Forum ouk allgemein.URL

 
 ========== Files Created - No Company Name ==========

 

[2012.07.03 13:24:44 | 000,058,892 | ---- | C] () -- C:\Users\Steffi\Desktop\log tdsskiller.zip

[2012.07.03 00:58:03 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe

[2012.07.03 00:58:03 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe

[2012.07.03 00:58:03 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe

[2012.07.03 00:58:03 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe

[2012.07.03 00:58:03 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe

[2012.07.03 00:35:53 | 001,846,783 | ---- | C] () -- C:\Users\Steffi\Desktop\cache.zip

[2012.06.27 13:55:15 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_09_00.Wdf

[2011.03.29 13:36:14 | 000,007,602 | ---- | C] () -- C:\Users\Steffi\AppData\Local\Resmon.ResmonCfg

[2011.03.08 14:30:01 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe

[2011.03.07 20:56:45 | 000,000,431 | ---- | C] () -- C:\Users\Steffi\AppData\Local\Win7_Upgrade.bat

[2011.03.07 20:47:03 | 000,001,794 | ---- | C] () -- C:\Users\Steffi\AppData\Local\Win7_tmp1.htm

[2011.03.07 19:42:50 | 000,021,532 | ---- | C] () -- C:\Windows\System32\emptyregdb.dat

[2011.03.07 19:25:26 | 000,017,920 | ---- | C] () -- C:\Windows\System32\rpcnetp.dll

[2011.03.07 19:24:31 | 000,017,920 | ---- | C] () -- C:\Windows\System32\rpcnetp.exe

[2011.02.11 18:40:40 | 000,004,096 | ---- | C] ( ) -- C:\Windows\System32\IGFXDEVLib.dll

[2010.08.25 20:30:02 | 000,439,308 | ---- | C] () -- C:\Windows\System32\igcompkrng500.bin

[2010.08.25 20:30:00 | 000,982,240 | ---- | C] () -- C:\Windows\System32\igkrng500.bin

[2010.08.25 20:30:00 | 000,092,356 | ---- | C] () -- C:\Windows\System32\igfcg500m.bin

[2010.08.25 19:57:00 | 000,000,151 | ---- | C] () -- C:\Windows\System32\GfxUI.exe.config

 
 ========== LOP Check ==========

 

[2011.03.07 19:37:26 | 000,000,000 | ---D | M] -- C:\Users\Steffi\AppData\Roaming\OpenOffice.org

[2011.03.07 21:11:04 | 000,000,000 | ---D | M] -- C:\Users\Steffi\AppData\Roaming\PCDr

[2011.03.07 19:37:28 | 000,000,000 | ---D | M] -- C:\Users\Steffi\AppData\Roaming\Thunderbird

[2009.07.14 06:53:46 | 000,028,096 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

 
 ========== Purity Check ==========

 

 

 
 ========== Custom Scans ==========

 
 < %SYSTEMDRIVE%\*. >

[2011.03.07 19:12:02 | 000,000,000 | ---D | M] -- C:\$INPLACE.~TR

[2012.07.03 01:07:32 | 000,000,000 | -HSD | M] -- C:\$RECYCLE.BIN

[2011.03.07 19:43:20 | 000,000,000 | ---D | M] -- C:\$WINDOWS.~Q

[2011.03.08 22:05:03 | 000,000,000 | ---D | M] -- C:\boot

[2009.10.11 18:28:52 | 000,000,000 | ---D | M] -- C:\DELL

[2009.07.14 06:53:55 | 000,000,000 | -HSD | M] -- C:\Documents and Settings

[2009.10.11 16:17:47 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen

[2009.07.29 11:15:32 | 000,000,000 | ---D | M] -- C:\Drivers

[2009.07.29 07:09:27 | 000,000,000 | ---D | M] -- C:\EFI

[2011.02.28 17:48:39 | 000,000,000 | ---D | M] -- C:\found.000

[2011.02.15 22:16:54 | 000,000,000 | ---D | M] -- C:\Intel

[2009.07.14 04:37:05 | 000,000,000 | ---D | M] -- C:\PerfLogs

[2012.04.26 12:36:32 | 000,000,000 | R--D | M] -- C:\Program Files

[2012.04.26 12:36:33 | 000,000,000 | ---D | M] -- C:\ProgramData

[2009.10.11 16:17:48 | 000,000,000 | -HSD | M] -- C:\Programme

[2012.07.03 01:08:20 | 000,000,000 | ---D | M] -- C:\Qoobox

[2011.03.07 20:23:01 | 000,000,000 | ---D | M] -- C:\Recovery

[2012.07.04 02:38:11 | 000,000,000 | -HSD | M] -- C:\System Volume Information

[2011.03.07 19:38:10 | 000,000,000 | R--D | M] -- C:\Users

[2012.07.03 01:08:19 | 000,000,000 | ---D | M] -- C:\Windows

 
 < %PROGRAMFILES%\*.exe >

 
 < %LOCALAPPDATA%\*.exe >

 
 < %systemroot%\*. /mp /s >

 
 < MD5 for: AGP440.SYS  >

[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\erdnt\cache\AGP440.sys

[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\drivers\AGP440.sys

[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_x86_neutral_a97a2a0d0fbc6696\AGP440.sys

[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_b9e9435f20046eeb\AGP440.sys

[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_bc1a57271cf2f285\AGP440.sys

 
 < MD5 for: ATAPI.SYS  >

[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\erdnt\cache\atapi.sys

[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\drivers\atapi.sys

[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_x86_neutral_fab873f3e8a3315c\atapi.sys

[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_dd0e7e3d82dd640d\atapi.sys

[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_df3f92057fcbe7a7\atapi.sys

 
 < MD5 for: CNGAUDIT.DLL  >

[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\erdnt\cache\cngaudit.dll

[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\System32\cngaudit.dll

[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll

 
 < MD5 for: EXPLORER.EXE  >

[2011.02.26 07:19:21 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_54149f9ef14031fc\explorer.exe

[2009.07.14 03:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_518afd35db100430\explorer.exe

[2011.02.26 07:51:13 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=255CF508D7CFB10E0794D6AC93280BD8 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_525b5180f3f95373\explorer.exe

[2009.10.31 07:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_51a66d6ddafc2ed1\explorer.exe

[2011.02.26 07:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_51a3a583dafd0cef\explorer.exe

[2010.11.20 14:17:09 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_53bc10fdd7fe87ca\explorer.exe

[2011.02.25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\erdnt\cache\explorer.exe

[2011.02.25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\explorer.exe

[2011.02.25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_5389023fd8245f84\explorer.exe

[2009.08.03 07:49:47 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_526619d4f3f142e6\explorer.exe

[2009.08.03 07:35:50 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_51e07e31dad00878\explorer.exe

[2009.10.31 08:00:51 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_52283b2af41f3691\explorer.exe

 
 < MD5 for: IASTOR.SYS  >

[2009.01.19 21:41:16 | 000,328,728 | ---- | M] (Intel Corporation) MD5=BAABB0301949774A66B955C65319635A -- C:\Drivers\storage\R208747\IaStor.sys

[2009.01.19 21:41:16 | 000,328,728 | ---- | M] (Intel Corporation) MD5=BAABB0301949774A66B955C65319635A -- C:\Windows\System32\drivers\iaStor.sys

[2009.01.19 21:41:16 | 000,328,728 | ---- | M] (Intel Corporation) MD5=BAABB0301949774A66B955C65319635A -- C:\Windows\System32\DriverStore\FileRepository\iaahci.inf_x86_neutral_47b7c899f0c30d85\iaStor.sys

[2009.01.19 21:41:16 | 000,328,728 | ---- | M] (Intel Corporation) MD5=BAABB0301949774A66B955C65319635A -- C:\Windows\System32\DriverStore\FileRepository\iastor.inf_x86_neutral_010ccaa72e16692a\iaStor.sys

 
 < MD5 for: IASTORV.SYS  >

[2011.03.11 07:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- C:\Windows\System32\drivers\iaStorV.sys

[2011.03.11 07:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_0bcee2057afcc090\iaStorV.sys

[2011.03.11 07:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_b0daddb9e6380745\iaStorV.sys

[2011.03.11 07:43:55 | 000,332,160 | ---- | M] (Intel Corporation) MD5=71F1A494FEDF4B33C02C4A6A28D6D9E9 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_aef580fde910b4b0\iaStorV.sys

[2011.03.11 07:28:00 | 000,332,160 | ---- | M] (Intel Corporation) MD5=778D0E6D7D9EBA0C403BADBAAD41DB20 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_b152a892ff64119f\iaStorV.sys

[2009.07.14 03:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_aee7a89be91b9000\iaStorV.sys

[2010.11.20 14:29:54 | 000,332,160 | ---- | M] (Intel Corporation) MD5=A3CAE5D281DB4CFF7CFF8233507EE5AD -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_668286aa35d55928\iaStorV.sys

[2010.11.20 14:29:54 | 000,332,160 | ---- | M] (Intel Corporation) MD5=A3CAE5D281DB4CFF7CFF8233507EE5AD -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_b118bc63e60a139a\iaStorV.sys

[2011.03.11 07:52:21 | 000,332,160 | ---- | M] (Intel Corporation) MD5=B9039A34C2F8769490DCC494E2402445 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_afae2d45020c148b\iaStorV.sys

 
 < MD5 for: NETLOGON.DLL  >

[2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\erdnt\cache\netlogon.dll

[2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\System32\netlogon.dll

[2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_ffbf212e963c0162\netlogon.dll

[2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_fd8e0d66994d7dc8\netlogon.dll

 
 < MD5 for: NVSTOR.SYS  >

[2011.03.11 07:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- C:\Windows\System32\drivers\nvstor.sys

[2011.03.11 07:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_0276fc3b3ea60d41\nvstor.sys

[2011.03.11 07:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_3ba44e691d6eb11d\nvstor.sys

[2011.03.11 07:44:01 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4520B63899E867F354EE012D34E11536 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_39bef1ad20475e88\nvstor.sys

[2011.03.11 07:28:10 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=66D468654A58594F5F3BA63D5AD5B1AF -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_3c1c1942369abb77\nvstor.sys

[2011.03.11 07:52:25 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=8A7583A3B58D3EEB28BB26626526BC91 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_3a779df43942be63\nvstor.sys

[2010.11.20 14:30:06 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=9283C58EBAA2618F93482EB5DABCEC82 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_dd659ed032d28a14\nvstor.sys

[2010.11.20 14:30:06 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=9283C58EBAA2618F93482EB5DABCEC82 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_3be22d131d40bd72\nvstor.sys

[2009.07.14 03:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_39b1194b205239d8\nvstor.sys

 
 < MD5 for: SCECLI.DLL  >

[2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_37e4387f3a6f0483\scecli.dll

[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\erdnt\cache\scecli.dll

[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\System32\scecli.dll

[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_3a154c47375d881d\scecli.dll

 
 < MD5 for: USER32.DLL  >

[2009.07.14 03:16:17 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=34B7E222E81FAFA885F0C5F2CFA56861 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_cd0ec264ceb014a3\user32.dll

[2010.11.20 14:21:33 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 -- C:\Windows\erdnt\cache\user32.dll

[2010.11.20 14:21:33 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 -- C:\Windows\System32\user32.dll

[2010.11.20 14:21:33 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_cf3fd62ccb9e983d\user32.dll

 
 < MD5 for: USERINIT.EXE  >

[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\erdnt\cache\userinit.exe

[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\System32\userinit.exe

[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe

[2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe

 
 < MD5 for: WINLOGON.EXE  >

[2012.04.04 15:56:38 | 000,199,240 | ---- | M] () MD5=097D0E812D7A9A3101CE46CB2BE0474D -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe

[2009.10.28 08:17:59 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_6fc699643622d177\winlogon.exe

[2009.10.28 07:52:08 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=3BABE6767C78FBF5FB8435FEED187F30 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_703394514f56f7c2\winlogon.exe

[2010.11.20 14:17:54 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\erdnt\cache\winlogon.exe

[2010.11.20 14:17:54 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\System32\winlogon.exe

[2010.11.20 14:17:54 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_71ca6b0233339500\winlogon.exe

[2009.07.14 03:14:45 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=8EC6A4AB12B8F3759E21F8E3A388F2CF -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_6f99573a36451166\winlogon.exe

 
 < MD5 for: WS2IFSL.SYS  >

[2009.07.14 01:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\System32\drivers\ws2ifsl.sys

[2009.07.14 01:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_4f5cf6f829213bb2\ws2ifsl.sys

 
 < %systemroot%\system32\drivers\*.sys /lockedfiles >

 
 < %systemroot%\System32\config\*.sav >

 
 < %systemroot%\system32\*.dll /lockedfiles >

[2008.12.11 19:47:34 | 000,055,808 | ---- | M] () Unable to obtain MD5 -- C:\Windows\system32\bcmwlrmt.dll

 
 < %USERPROFILE%\*.* >

[2012.07.04 02:43:07 | 001,572,864 | -HS- | M] () -- C:\Users\Steffi\NTUSER.DAT

[2012.07.04 02:43:07 | 000,262,144 | -HS- | M] () -- C:\Users\Steffi\ntuser.dat.LOG1

[2011.03.07 19:28:48 | 000,000,000 | -HS- | M] () -- C:\Users\Steffi\ntuser.dat.LOG2

[2011.03.07 19:28:49 | 000,065,536 | -HS- | M] () -- C:\Users\Steffi\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TM.blf

[2011.03.07 19:28:49 | 000,524,288 | -HS- | M] () -- C:\Users\Steffi\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000001.regtrans-ms

[2011.03.07 19:28:49 | 000,524,288 | -HS- | M] () -- C:\Users\Steffi\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000002.regtrans-ms

[2011.03.07 20:45:28 | 000,000,020 | -HS- | M] () -- C:\Users\Steffi\ntuser.ini

 
 < %USERPROFILE%\Local Settings\Temp\*.exe >

 
 < %USERPROFILE%\Local Settings\Temp\*.dll >

 
 < %USERPROFILE%\Application Data\*.exe >

 
 < HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs >

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Required: DebugWindows [binary data]

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Windows: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16

 
 <           >
 

< End of report >

hattest du mir alle vorhandenen malwarebytes berichte gepostet? falls nein, mal bitte nachreichen

Here we go! Die meisten sind Quickscans, sind aber auch ein paar vollständige Scans dabei. Ich habe alle vorhandenen untereinander in ein txt-Dokument gepackt (chronologisch, fängt mit dem ältesten Scan an) und als zip angehängt.
Die beiden allerletzten Logs von Malwarebytes findest du in meinem ersten Post in diesem Thread.

hi
lade den CCleaner standard:
CCleaner Download - CCleaner 3.20.1750
falls der CCleaner
bereits instaliert, überspringen.
instalieren, öffnen, extras, liste der instalierten programme, als txt speichern. öffnen.
hinter, jedes von dir benötigte programm, schreibe notwendig.
hinter, jedes, von dir nicht benötigte, unnötig.
hinter, dir unbekannte, unbekannt.
liste posten.

Hi!

Bei dieser Übung kommt jetzt meine relatives Unwissen was Computer angeht in's Spiel ... ich hab bei den meisten Programme "unbekannt" dahinter gesetzt, da ich nicht die geringste Ahnung habe, was sie sind oder machen. :confused:
Ich hab so 'ne Ahnung, dass vieles von dem "ab Werk" dabei war.
Schau am besten selbst mal drüber, ich hab für kritische Hinweise dienerseits ein offenes Ohr!

Code:

Adobe Flash Player 10 ActiveX        Adobe Systems Incorporated        07.03.2011                10.0.22.87      notwendig

Adobe Flash Player 11 Plugin        Adobe Systems Incorporated        23.06.2012        6,00MB        11.3.300.262      notwendig

Adobe Reader X (10.1.3) - Deutsch        Adobe Systems Incorporated        16.04.2012        121MB        10.1.3        notwendig

Advanced Audio FX Engine                07.03.2011         unbekannt        

Advanced Video FX Engine                07.03.2011         unbekannt        

Apple Application Support        Apple Inc.        10.11.2011        61,2MB        2.1.5    unbekannt

Apple Mobile Device Support        Apple Inc.        07.03.2011        21,7MB        3.4.0.25    unbekannt

Apple Software Update        Apple Inc.        10.11.2011        2,38MB        2.1.3.127   unbekannt

Bing Bar        Microsoft Corporation        07.01.2012        26,8MB        7.0.850.0    unbekannt

Bonjour        Apple Inc.        07.03.2011        1,09MB        2.0.4.0      unbekannt

CCleaner        Piriform        22.06.2012                3.20    notwendig

Cisco EAP-FAST Module        Cisco Systems, Inc.        16.09.2009        1,04MB        2.1.3   unbekannt

Cisco LEAP Module        Cisco Systems, Inc.        16.09.2009        1,04MB        1.0.12   unbekannt

Cisco PEAP Module        Cisco Systems, Inc.        16.09.2009        868KB        1.0.13    unbekannt

Compatibility Pack für 2007 Office System        Microsoft Corporation        10.05.2012        206MB        12.0.6612.1000     unbekannt

Dell Handbuch zum Einstieg        Dell Inc.        16.09.2009                1.00.0000     notwendig

Dell Sicherungs- und Wiederherstellungs-Manager        Dell, Inc.        16.09.2009                1.0.0 notwendig

Dell Touchpad        ALPS ELECTRIC CO., LTD.        07.03.2011                7.4.102.104  notwendig

Dell Video Chat        SightSpeed Inc.        07.03.2011                6.1 (6751)   unbekannt

Dell Webcam Center                07.03.2011                notwendig

Dell Webcam Manager                07.03.2011                notwendig

Dienstprogramm für Dell Wireless WLAN Karte        Dell Inc.        07.03.2011                4.170.77.18    notwendig

IDT Audio        IDT        07.03.2011                1.0.6217.0      unbekannt

Intel(R) Graphics Media Accelerator Driver                07.03.2011                 unbekannt

iTunes        Apple Inc.        07.03.2011        143MB        10.2.0.34   notwendig

Java(TM) 6 Update 22        Oracle        09.02.2012        97,0MB        6.0.220   notwendig

Java(TM) 6 Update 33        Oracle        02.07.2012        95,6MB        6.0.330   notwendig

Laptop Integrated Webcam Driver (1.01.01.0529)                07.03.2011                notwendig

Malwarebytes Anti-Malware Version 1.61.0.1400        Malwarebytes Corporation        02.07.2012        18,0MB        1.61.0.1400     notwendig

Microsoft .NET Framework 4 Client Profile        Microsoft Corporation        07.03.2011        38,8MB        4.0.30319    notwendig

Microsoft .NET Framework 4 Client Profile DEU Language Pack        Microsoft Corporation        07.03.2011        2,93MB        4.0.30319      notwendig

Microsoft Default Manager        Microsoft Corporation        16.09.2009                2.0.69.0     unbekannt

Microsoft Office PowerPoint Viewer 2007 (German)        Microsoft Corporation        10.05.2012        164MB        12.0.6612.1000     unbekannt

Microsoft Security Essentials        Microsoft Corporation        01.05.2012                4.0.1526.0   unbekannt

Microsoft Silverlight        Microsoft Corporation        16.06.2012        210MB        5.1.10411.0    unbekannt

Microsoft SQL Server 2005 Compact Edition [ENU]        Microsoft Corporation        16.09.2009        1,74MB        3.1.0000     unbekannt

Microsoft Sync Framework Runtime Native v1.0 (x86)        Microsoft Corporation        16.09.2009        624KB        1.0.1215.0     unbekannt

Microsoft Sync Framework Services Native v1.0 (x86)        Microsoft Corporation        16.09.2009        1,44MB        1.0.1215.0    unbekannt

Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053        Microsoft Corporation        07.03.2011        252KB        8.0.50727.4053      unbekannt

Microsoft Visual C++ 2005 Redistributable        Microsoft Corporation        17.06.2011        300KB        8.0.61001     unbekannt

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148        Microsoft Corporation        09.02.2012        596KB        9.0.30729.4148    unbekannt

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161        Microsoft Corporation        10.02.2012        600KB        9.0.30729.6161     unbekannt

Mozilla Firefox 13.0.1 (x86 de)        Mozilla        17.06.2012        37,5MB        13.0.1     notwendig

Mozilla Maintenance Service        Mozilla        17.06.2012        309KB        13.0.1      unbekannt

Mozilla Thunderbird (3.1.11)        Mozilla        23.06.2011                3.1.11 (de)   notwendig

OpenOffice.org 3.3        OpenOffice.org        09.02.2012        431MB        3.3.9567    notwendig

PowerDVD DX        CyberLink Corp.        07.03.2011                8.3.5424      notwendig

PSPad editor        Jan Fiala        11.10.2009                  notwendig

QuickTime        Apple Inc.        10.11.2011        73,2MB        7.71.80.42    notwendig

Realtek 8136 8168 8169 Ethernet Driver        Realtek        07.03.2011                1.00.0005    unbekannt

Roxio Activation Module        Roxio        16.09.2009                1.0      unbekannt

Roxio Creator Audio        Roxio        16.09.2009                3.5.0      unbekannt

Roxio Creator BDAV Plugin        Roxio        16.09.2009                3.5.0    unbekannt

Roxio Creator Copy        Roxio        16.09.2009                3.5.0     unbekannt

Roxio Creator Data        Roxio        16.09.2009                3.5.0    unbekannt

Roxio Creator DE        Roxio        16.09.2009                3.5.0     unbekannt

Roxio Creator Tools        Roxio        16.09.2009                3.5.0      unbekannt

Roxio Express Labeler 3        Roxio        16.09.2009                3.2.1    unbekannt

Roxio Update Manager        Roxio        16.09.2009                6.0.0      unbekannt

smartmontools                07.03.2011                5.40 2010-10-16 r3189 (sf-win32-5.40-1)    unbekannt

Sonic CinePlayer Decoder Pack        Sonic Solutions        16.09.2009                4.2.0    unbekannt

SpeedFan (remove only)                07.03.2011                  unbekannt

Spelling Dictionaries Support For Adobe Reader 9        Adobe Systems Incorporated        23.02.2010        29,6MB        9.0.0      unbekannt

Synaptics Pointing Device Driver        Synaptics Incorporated        07.03.2011                12.2.11.0        unbekannt

VLC media player 1.1.7        VideoLAN        19.09.2011                1.1.7    notwendig

Windows Live Anmelde-Assistent        Microsoft Corporation        07.03.2011        1,93MB        5.000.818.6     unbekannt

Windows Live Essentials        Microsoft Corporation        07.03.2011                14.0.8050.1202    unbekannt

Windows Live Sync        Microsoft Corporation        16.09.2009        2,79MB        14.0.8050.1202   unbekannt

Windows Live-Uploadtool        Microsoft Corporation        16.09.2009        225KB        14.0.8014.1029   unbekannt

WinRAR                07.03.2011                 notwendig

deinstaliere:
Adobe Flash Player alle
Adobe - Adobe Flash Player installieren
neueste version laden
adobe reader:
Adobe - Adobe Reader herunterladen - Alle Versionen
haken bei mcafee security scan raus nehmen

bitte auch mal den adobe reader wie folgt konfigurieren:
adobe reader öffnen, bearbeiten, voreinstellungen.
allgemein:
nur zertifizierte zusatz module verwenden, anhaken.
internet:
hier sollte alles deaktiviert werden, es ist sehr unsicher pdfs automatisch zu öffnen, zu downloaden etc.
es ist immer besser diese direkt abzuspeichern da man nur so die kontrolle hat was auf dem pc vor geht.
bei javascript den haken bei java script verwenden raus nehmen
bei updater, automatisch instalieren wählen.
übernehmen /ok

deinstaliere:
Bing
Java(TM) 6 Update 22
SpeedFan
Spelling Dictionaries
Windows Live : alle die, die du nicht nutzt.

öffne ccleaner, analysieren ccleaner starten
öffne otl, cleanup, pc startet neu, testen wie er läuft.

Hi Markus -

alles unnötige ist deinstalliert, Adobe deinstaliert und aktuelle Versionen installiert und Konfigurationen vorgenommen.
CCleaner ausgeführt.

OTL Cleanup hab ich erst mal gelassen, da sich ein neues Problem ergeben hat :headbang:

Microsoft Security Essentials meldet folgendes:
Exploit:Java/CVE-2012-1723.A

und das auch gleich zwei Mal ...

Die einzigen Zusatzinfos die es dazu gibt sind:
Kategorie: Exploit

Beschreibung: Dieses Programm ist gefährlich. Es nutzt die Sicherheitslücken eines Computers aus.

Empfohlene Aktion: Entfernen Sie diese Software unverzüglich.

Elemente:
file:C:\Users\Steffi\Desktop\cache.zip
file:C:\Users\Steffi\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\63\4a15afff-65b67758

Ich hab die erst mal in Quarantäne verschoben.

Sehr seltsam finde ich, dass es sich um das Element welches auf cache.zip endet um eben jenes ZIP handelt, dass ich dir am 03.06. hier auf dem Upload Channel hocheladen habe. Hö?

Ich hab dann erst mal einen Vollscan mit Malwarebytes gemacht, hier der Log:
(Computer wurde zwischen MS Security-Warnung und Scan nicht neu gestartet, falls das irgendwie wichtig ist ... )

Code:

Malwarebytes Anti-Malware 1.61.0.1400

www.malwarebytes.org
 

Datenbank Version: v2012.07.09.01
 

Windows 7 Service Pack 1 x86 NTFS

Internet Explorer 9.0.8112.16421

Steffi :: PUSSYBOX-2 [Administrator]
 

09.07.2012 06:26:42

mbam-log-2012-07-09 (06-26-42).txt
 

Art des Suchlaufs: Vollständiger Suchlauf

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 299675

Laufzeit: 50 Minute(n), 21 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 0

(Keine bösartigen Objekte gefunden)
 

(Ende)

Zwei Fragen:

Soll ich die beiden Funde erst mal in der Quarantäne (MS Security) lassen, oder löschen?

Ist meinem System noch zu helfen, oder sollte ich mich schon mal mit dem Gedanken anfreunden mein System neu aufzusetzen?

hi,
1. lösche mal das zip archiv vom desktop.
2. java cache leeren:
So leeren Sie den Java-Cache:
3. hast du deinen pc warscheinlich über dieses exploit infiziert, deswegen ist es wichtig, alles aktuell zu halten
gibts denn sonst noch probleme?

Hi Markus -

hab die beiden mal gelöscht und noch mal einen Vollscan mit MS Security gemacht. Sieht so weit so gut aus.

Ein paar Fragen hab ich noch:

Soll ich jetzt mal den OTL Cleanup machen?

Ausserdem hängt in der Quarantäne von Malwarebytes noch der eine (anfängliche) Fund rum. Soll der da bleiben, löscht das Cleanup den oder soll ich den endgültig von Malwarebytes löschen lassen?

Sicherheit: ich mach von diesem Rechner aus auch Onlinebanking, und kaufe ab und an mal was bei Amazon, Ebay oder einem anderen Webshop.
Passwörter werd ich jetzt erst mal überall ändern, kann ja nix schaden.

Für Onlinebanking benutze ich einen TAN-Generator. Wie sicher/unsicher ist das denn? Sollte ich evtl. über weitere Sicherheitsmassnahmen (Chipkartenleser oder so) nachdenken?

Dank dir auf jenden Fall schon mal herzlich für deine schnelle und kompetente Hilfe!