Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   U-Cash-Trojaner startet bei Browserstart und legt Vista lahm (https://www.trojaner-board.de/121952-u-cash-trojaner-startet-browserstart-legt-vista-lahm.html)

IamShine 12.08.2012 23:45
U-Cash-Trojaner startet bei Browserstart und legt Vista lahm
 
Hallo,
ich bitte um Hilfe beim U-Cash-Trojaner. Bin ein durchschnittlicher User, also keine Ahnung hiervon.
Habe evt. irgendwo auf hxxp:\\www.serienjunkies.org einen infizierten Link erwischt, obwohl ich nicht als Administrator gesurft bin. Plötzlich erschien auf dem gesamten Bildschirm ein Text von der angeblichen Bundespolizei, ich hätte einen von mehreren Gesetzesverstößen begangen, die dann aufgeführt wurden, teilweise mit Info, welches Strafmaß darauf steht, z.B. Nutzung von urheberrechtlich geschützten Inhalten, Download von verbotenen pornografischen Inhalten, oder mein Computer wurde ohne mein Wissen zum Versenden von Spams verwendet, und noch einiges andere. Es war eine IP-Adresse dargestellt, die meine sei, und es wurde gesagt, dass gerade meine Identität bestimmt würde und innerhalb der kommenden 72 Stunden ein Strafverfahren gegen mich angestrebt würde. Ich könne dies vermeiden, wenn ich innerhalb dieser Zeit 100 Euro mittels UCash-Verfahren oder einem anderen Verfahren, die dann beide erklärt wurden, zahlen würde. Ansonsten würde nach weiteren 72 Stunden ein Strafverfahren gestartet. Möglich sei diese 100-Euro-Regelung durch eine Gesetzesänderung von ca. Mitte August 2012 (habe den genauen Tag vergessen). Gleichzeitig wurde meine Screen-Kamera aktiviert, so dass ich mich in einem kleinen Kästchen auf dem Bildschirm sah. Habe diesen Trojaner-Screen leider nicht fotografiert. Da ich per W-Lan im Netz war, konnte ich kein LAN-Kabel ziehen und den Bildschirm nur durch Herunterfahren mittels Gedrückthalten der An-Taste verlassen. Nach erneutem Hochfahren konnte ich scheinbar normal auf Vista arbeiten, wenngleich ständig die Meldung kam „Windows-Hostprozess (Rundll32) funktioniert nicht mehr“, doch sobald ich wieder Internetverbindung herstellte und den Internet Explorer öffnete, erschien wieder die Bundespolizei-Meldung und der Laptop war blockiert. Im Nachhinein habe ich festgestellt, dass ich nicht mehr im Abgesicherten Modus mit Eingabeaufforderung starten konnte, wohl aber im Abgesicherten Modus. Der Laptop ist übrigens in kein Netzwerk integriert.
Habe dann mein täglich geupdatetes Avira Free Antivirus gestartet und eine Schnelle Systemprüfung auf C: ohne Administratorrechte durchgeführt.
Ergebnis (da ich mich nicht traue, das logfile vom infizierten Rechner auf Datenträger zu kopieren oder mit dem infizierten Rechner wieder online zu gehen, damit er nicht womöglich Malware nachlädt, muss ich alle folgenden logfiles abtippen und beschränke mich auf das Nötigste und hoffentlich Relevante):
…
Beginne mit der Suche in ‘C:\Users\XXX’
C:\Users\XXX\AppData\Local\Microsoft\Temporary Internet Files\Content.IE5\0SG8HQCs\video_downloader.exe
C:\Users\XXX\AppData\LocalLow\Google\GoogleEarth\webdata\f_0000f2
[WARNUNG] Unerwartetes Dateiende erreicht
C:\Users\XXX\AppData\LocalLow\Google\GoogleEarth\webdata\f_000101
[WARNUNG] Unerwartetes Dateiende erreicht
C:\Users\XXX\Desktop\XXX diverses\XXX\OOo_2.2.0_Win32Intel_install_de.exe
[WARNUNG] Die Version dieses Archives wird nicht unterstützt
C:\Users\XXX\Desktop\XXX Schule\wechsel\kramixer.exe
[WARNUNG] Unerwartetes Dateiende erreicht
C: \Users\XXX\Downloads\Downloads\video_downloader.exe
Beginne mit der Suche in ‘C:\Windows’
Beginne mit der Suche in ‘C:\Users\’
C:\Users\XXX\AppData\Local\Microsoft\Temporary Internet Files\Content.IE5\0SG8HQCs\video_downloader.exe
C:\Users\XXX\AppData\LocalLow\Google\GoogleEarth\webdata\f_0000f2
[WARNUNG] Unerwartetes Dateiende erreicht
C:\Users\XXX\AppData\LocalLow\Google\GoogleEarth\webdata\f_000101
[WARNUNG] Unerwartetes Dateiende erreicht
C:\Users\XXX\Desktop\XXX diverses\XXX\OOo_2.2.0_Win32Intel_install_de.exe
[WARNUNG] Die Version dieses Archives wird nicht unterstützt
C:\Users\XXX\Desktop\XXX Schule\wechsel\kramixer.exe
[WARNUNG] Unerwartetes Dateiende erreicht
C: \Users\XXX\Downloads\Downloads\video_downloader.exe
Beginne mit der Suche in ‘C:\Program Files‘

Beginne mit der Desinfektion:
C: \Users\XXX\Downloads\Downloads\video_downloader.exe
[FUND] Enthält Erkennungsmuster der Adware ADWARE/InstallCor.A
[HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen ‚569119be.qua‘ verschoben!
C:\Users\XXX\AppData\Local\Microsoft\Temporary Internet Files\Content.IE5\0SG8HQCs\video_downloader.exe
[FUND] Enthält Erkennungsmuster der Adware ADWARE/InstallCor.A
[HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen ‚4e063619.qua‘ verschoben!

Ende des Suchlaufs…
…
4 Viren bzw. unerwünschte Programme wurden gefunden
…
2 Dateien wurden in die Quarantäne verschoben
…
8 Warnungen
2 Hinweise

Mir fällt ein, dass ich die im logfile genannte Datei video_downloader.exe irgendwo ca. 3 Tage zuvor von serienjunkies.org runtergeladen und möglicherweise auch gestartet hatte, aber eben nicht erst kurz vor Auftauchen des Trojaners. Kurz nach Runterladen der Datei video_downloader.exe hatte avira auch mehrmals eine Meldung angezeigt, dass das Virus ‚Adware‘ gefunden worden sei, irgendwann gab es diese Meldung dann aber nicht mehr. Video_downloader.exe müsste ein download gewesen sein, zu dem ich aufgefordert wurde, als ich entweder nach Streams von Spartacus oder Games of Thrones gesucht habe – sollte ich den Admin von serienjunkies-org informieren? Sollte ich bei der Polizei Anzeige erstatten?

Die Desinfektion durch avira hat nichts gebracht. Avira konnte ab dann auch nicht mehr updaten. Habe danach mit avira eine Vollständige Systemprüfung auf C: und D: durchgeführt und folgendes Ergebnis bekommen:
…
Beginne mit der Suche in ‘C:\‘ <BOOT>
C:\$RECYCLE.BIN\S-1-5-21-2799112012-1549174850-2009520858-1000\$RCYTGJ2.exe
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\V015TM4T/avira_free_antivirus_de.exe
[WARNUNG] Die Datei ist kennwortgeschützt
C:\Users\XXX\AppData\LocalLow\Google\GoogleEarth\webdata\f_0000f2
[WARNUNG] Unerwartetes Dateiende erreicht
C:\Users\XXX\AppData\LocalLow\Google\GoogleEarth\webdata\f_000101
[WARNUNG] Unerwartetes Dateiende erreicht
C:\Users\XXX\Desktop\XXX diverses\XXX\OOo_2.2.0_Win32Intel_install_de.exe
[WARNUNG] Die Version dieses Archives wird nicht unterstützt
C:\Users\XXX\Desktop\XXX Schule\wechsel\kramixer.exe
[WARNUNG] Unerwartetes Dateiende erreicht
Beginne mit der Suche in ‘D:\‘ <RECOVER>

Beginne mit der Desinfektion:
C:\$RECYCLE.BIN\S-1-5-21-2799112012-1549174850-2009520858-1000\$RCYTGJ2.exe
[FUND] Enthält Erkennungsmuster der Adware ADWARE/InstallCor.A
[HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen ‚56cd5a57.qua‘ verschoben!

Ende des Suchlaufs…
…
1 Viren bzw. unerwünschte Programme wurden gefunden
…
1 Dateien wurden in die Quarantäne verschoben
…
5 Warnungen
1 Hinweise


Habe dann auf anderem Rechner gegoogelt und einige Infos über den UCash-Trojaner gefunden, aber nur überflogen. Bin dann auf euch gestoßen und habe entsprechend euren Anweisungen die folgenden Schritte unternommen, wobei ich die nötigen Programme davor auf CD gebrannt habe und von CD auf den infizierten Rechner kopiert und von dort gestartet habe:

Habe Malwarebytes AntiMalware auf den infizierten Rechner gebracht. Da die Malware-Datenbank schon 40 Tage alt war, habe ich die rules.ref-Datei durch die aktuelle rules.ref-Datei ersetzt – dann ließ sich Malwarebytes aber nicht mehr starten und gab eine Fehlermeldung aus. Habe dann die 40 Tage alte Malwarebytes AntiMalware gestartet und danach einen Neustart gemacht.
Hier ist das logfile:
Malwarebytes Anti-Malware (Test) 1.62.0.1300
…

Datenbank Version: v2012.07.03.05
Windows Vista Service Pack 2 x86 NFTS
Internet Explorer 9.0.8112.16421
Admin :: xxx-PC [Administrator]
Schutz: Deaktiviert
12.08.2012 15:01:10
mbam-log-2012-08-12 (15-01-19).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\ID:\)
Aktivierte Suchlaufeinstellungen: Speicher – Autostart –Registrierung – Dateisystem – Heuristiks/Extra – Heuristiks/Shuriken – PUP – PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 499669
Laufzeit: 1 Stunde, 38 Min

…

Infizierte Registrierungsschlüssel: 1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion/Uninstall\Video Downloader (PUP.BundleInstaller.VG) -> Erfolgreich gelöscht und in Quarantäne gestellt.

…

Infizierte Dateien: 1
C.\Program Files\vGrabber-software/‘Uninstall.exe (PUP.BundleInstaller.VG) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)

Habe dann defogger gestartet entsprechend euren Anweisungen –ohne Fehlermeldung. Habe dann defogger geschlossen. Neustart. Fehlermeldung „Windows-Hostprozess (Rundll32) funktioniert nicht mehr“ erhalten. Habe Avira-Echtzeitscanner deaktiviert und Malwarebytes Protection disabled.

Habe dann OTL mehrfach gestartet, weil ich vergessen hatte, das System neu zu starten bzw. den Avira-Echtzeitscanner zu deaktivieren und Malwarebytes Protection zu disablen. Quick Scan durchgeführt. Das „Extras“-Scan-log ist allerdings nur beim ersten Starten von OTL erstellt worden… Meint ihr, ich kann es riskieren, die scan logs per USB-Stick auf einen anderen Rechner zu kopieren, oder riskiere ich dann eine Verseuchung des anderen Rechners? Ansonsten müsste ich die gesamten langen scan logs abtippen??? Oder soll ich schauen, ob ich inzwischen wieder ins Internet kann? Dann kann ich die scan logs vom infizierten Rechner aus posten…???
System neugestartet. Habe Avira-Echtzeitscanner deaktiviert und Malwarebytes Protection disabled.
Dann gmer gestartet. Während des Scans Fehlermeldung „96jksucf.exe funktioniert nicht mehr“.
Problemereignisname: APPCRASH
Anwendungsname: 96jksucf.exe
Anwendungsversion: 1.0.15.15641
Anwendungszeitstempel: 4e21f2b1
Fehlermodulname 96jksucf.exe
Fehlermodulversion: 1.0.15.15641
Fehlermodulzeitstempel 4e21f2b1
Ausnahmecode c0000005
Ausnahmeoffset 0000c676
Betriebssystemversion 6.0.6002.2.2.0.768.3
Gebietsschema-ID 1031
Zusatzinformation 1: a76a
Zusatzinformation 2: 5cf9039e0c8e4e0bf02ab3e23db0c4f0
Zusatzinformation 3: b114
Zusatzinformation 4: d9d01fee0875b74ac070be8d125aa4b2

Habe dann das Programm geschlossen. Was kann ich nun tun? Auf dem Rechner sind nur einige Office-Dokumente, Audios und Videos sowie Mails und Kontakte, die ich gerne retten würde und die auch problemlos geöffnet werden können.
Danke im Voraus!

cosinus 16.08.2012 10:49
Lass die Finger von solchen Portalen!
Die Links zu den Filmen verweisen immer auf irgendwelche 1click Hoster, diese Angebote sind illegal und meistens ungeprüft!
Zudem haben solche Portale meist die Nutzer in Abofallen laufen lassen und gerade solche standen schon vor Monaten in dem Verdacht, Malware zu verteilen zB über Exploits, die den Bundestrojaner bzw. deren Ableger auf verwundbare Rechner installiert!

Poste bitte alle Logs von Malwarebytes vollständig und unzensiert

Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:
hier steht das Log

IamShine 16.08.2012 12:31
Vielen Dank für deine Antwort, ja, man lernt wohl am besten durch Schmerz.

Wie bekomme ich das log vom infizierten Rechner runter, ohne zu riskieren, andere Rechner zu infizieren, oder kann ich nach Ausführen von Malwarebytes wieder versuchen, mit dem Rechner online zu gehen?

Danke!

cosinus 16.08.2012 13:52
Ja mit dem Rechner ins Internet gehen, für eine Analyse/Bereinigung brauchen wir das eh

IamShine 16.08.2012 14:20
Auch nach Durchlauf der 40-Tage alten Malwarebytes-Version ist der Trojaner noch drauf, wenn ich den Browser im normalen Modus starte...???

Der Trojaner hat sich nun verändert - nicht erst bei Browserstart, sondern schon bei Einloggen ins Internet wird er aktiv und blockiert alles.

Wollte gerade im abgesicherten Modus mit Eingabeaufforderung starten - dabei Systemabsturz während des Bootvorgangs...

Habe nun noch einmal einen fullscan mit Malwarebytes 1.62.0.1300 gemacht, ohne Befunde (und trotzdem ist der Trojaner ab Interneteinwahl aktiv). Wie gesagt, ist die rules.ref-Datei mittlerweile mehr als 40 Tage alt, ich kann sie aber nicht durch die aktuelle ersetzen, weil sich Malwarebytes dann nicht mehr starten lässt.

Neustart im abgesicherten Modus mit Eingabeaufforderung hat eben gerade funktioniert, falls das hilft???

cosinus 17.08.2012 17:22
Funktioniert noch der abgesicherte Modus mit Netzwerktreibern? Mit Internetverbindung?



Abgesicherter Modus zur Bereinigung
  • Windows mit F8-Taste beim Start in den abgesicherten Modus bringen.
  • Starte den Rechner in den abgesicherten Modus mit Netzwerktreibern:

    Windows im abgesicherten Modusstarten

IamShine 17.08.2012 17:47
ja, danke! Schreibe gerade vom infizierten Rechner. Soll ich die aktualisierte Malwarebytes-Version runterladen und fullscan machen? Dauert über 1 Stunde.

Hallo Cosinus,

meine Antwort von eben taucht im Thread gar nicht auf?
Die Antwort war ja. Habe jetzt die aktualisierte Malwarebytes ausgeführt, Quickscan, und 2 Trojaner gefunden und die 2 gefundenen Trojaner noch nicht entfernt.
Hier das logfile:
Code:
Malwarebytes Anti-Malware (Test) 1.62.0.1300
www.malwarebytes.org

Datenbank Version: v2012.08.17.06

Windows Vista Service Pack 2 x86 NTFS (Abgesichertenmodus/Netzwerkfähig)
Internet Explorer 9.0.8112.16421
Admin :: GERRIT-PC [Administrator]

Schutz: Deaktiviert

17.08.2012 18:57:31
mbam-log-2012-08-17 (19-11-11).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 229066
Laufzeit: 3 Minute(n), 46 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 2
C:\Users\Gerrit\AppData\Local\Temp\update00.b.exe (Trojan.Inject) -> Keine Aktion durchgeführt.
C:\Users\Gerrit\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk (Trojan.Ransom.Gen) -> Keine Aktion durchgeführt.

(Ende)
Hallo cosinus,

habe jetzt auch den vollständigen scan durchgeführt. Hier das logfile:
Code:
Malwarebytes Anti-Malware (Test) 1.62.0.1300
www.malwarebytes.org

Datenbank Version: v2012.08.17.06

Windows Vista Service Pack 2 x86 NTFS (Abgesichertenmodus/Netzwerkfähig)
Internet Explorer 9.0.8112.16421
Admin :: GERRIT-PC [Administrator]

Schutz: Deaktiviert

17.08.2012 19:35:04
mbam-log-2012-08-17 (19-35-04).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 395104
Laufzeit: 51 Minute(n), 38 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 2
C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS001FD.log (Extension.Mismatch) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS001FE.log (Extension.Mismatch) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)
Habe defogger als admin gestartet, bin auf disable gegangen, keine Fehlermeldung nach scanende. Habe nicht auf re-enable geklickt. Starte Rechner jetzt neu.

cosinus 17.08.2012 21:08
Malwarebytes erstellt bei jedem Scanvorgang genau ein Log. Hast du in der Vergangenheit schonmal mit Malwarebytes gescannt?
Wenn ja dann stehen auch alle Logs zu jedem Scanvorgang im Reiter Logdateien. Bitte alle posten, die dort sichtbar sind.

Führ bitte auch ESET aus, danach sehen wir weiter.

Hinweis: ESET zeigt durchaus öfter ein paar Fehlalarme. Deswegen soll auch von ESET immer nur erst das Log gepostet und nichts entfernt werden.

ESET Online Scanner
Bitte während der Online-Scans evtl. vorhandene externe Festplatten einschalten! Bitte während der Scans alle Hintergrundwächter (Anti-Virus-Programm, Firewall, Skriptblocking und ähnliches) abstellen und nicht vergessen, alles hinterher wieder einzuschalten.
  • Anmerkung für Vista und Win7 User: Bitte den Browser unbedingt so öffnen: per Rechtsklick => als Administrator ausführen
  • Dein Anti-Virus-Programm während des Scans deaktivieren.

    Button http://img695.imageshack.us/img695/1599/eset1l.jpg (<< klick) drücken.
    • Firefox-User:
      Bitte esetsmartinstaller_enu.exe downloaden.Das Firefox-Addon auf dem Desktop speichern und dann installieren.
    • IE-User:
      müssen das Installieren eines ActiveX Elements erlauben.
  • Setze den einen Haken bei Yes, i accept the Terms of Use.
  • Drücke den http://img707.imageshack.us/img707/687/starteg.jpg Button.
  • Warte bis die Komponenten herunter geladen wurden.
  • Setze einen Haken bei "Scan archives".
  • Gehe sicher das bei Remove Found Threats kein Hacken gesetzt ist.
  • http://img707.imageshack.us/img707/687/starteg.jpg drücken.
  • Die Signaturen werden herunter geladen.Der Scan beginnt automatisch.
Wenn der Scan beendet wurde
  • Klicke Finish.
  • Browser schließen.
Drücke bitte die http://larusso.trojaner-board.de/Images/windows.jpg + R Taste und kopiere folgenden Text in das Ausführen Fenster.
Code:
"%PROGRAMFILES%\Eset\Eset Online Scanner\log.txt"
Hinweis: Falls du ein 64-Bit-Windows einsetzt, lautet der Pfad so:

Code:
"%PROGRAMFILES(X86)%\Eset\Eset Online Scanner\log.txt"
Poste nun den Inhalt der log.txt.


Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:
hier steht das Log

IamShine 17.08.2012 21:46
ja, habe in den letzten Tagen mehrfach malwarebytes gestartet, und ich finde 6 log-Dateien im Reiter von malwarebytes, kann aber nicht mehr posten, weil ich mich vom infizierten Rechner aus scheinbar nicht mehr in euer Board einloggen kann. Schon bei Einwahl ins WLAN braucht der Rechner ca. 4-5 Versuche, bevor es klappt. Wenn ich mich dann im Trojaner-Board einlogge, kommt zwar der Wollkommensgruß, aber auf der Startseite ist dann kein Benutzername eingetragen (egal ob ich gerade mit einem anderen Rechner bei euch eingeloggt bin oder nicht). Wenn ich dann ein paar andere Links auf eurer Startseite klicke, bis irgendwo unten "Gehe zu Benutzerkontrollzentrum" anklickbar ist, komme ich darüber auf den normalen Startbildschirm mit Text "Willkommen, IamShine". Wenn ich dann in Meine Themen reingehe, zeigt er mir nur den Thread-Stand an, den ich hatte, direkt bevor ich den fullscan mit malwarebytes gemacht habe (letzter Beitrag 18:22 von cosinus), und ich kann darauf nicht direkt antworten, weil das securitytoken nicht mehr gültig ist (aber von einem sicheren Rechner aus, von dem aus ich jetztg schreibe, habe ich Zugriff auf den späteren Thread-Verlauf bis jetzt). Übrigens arbeite ich die ganze Zeit über nur aus dem abgesicherten Modus mit Netzwerktreibern heraus, soll ich es mal aus de´m normalen Modus probieren?

Okay, 30 Min. später - lasse gerade ESET laufen. Weiß aber noch nicht, wie ich das ESET-log und die 6 malwarebytes-logs ins Forum bringen soll, da die Anmeldung nicht von dem Rechner aus klappt, auch nicht im normalen Windows-Modus, in dem ich jetzt bin, sondern immer auf dem Stand um ca. 18 Uhr ist, kurz bevor ich mit malwarebytes 2 Trojanerfiles gefunden habe...???

Die 6 malware-logs und das ESET-log hätte ich hier, ESET hat 7 Hits angezeigt, kann aber nicht vom infizierten Rechner ins Forum einloggen, um zu posten - soll ich mal von dem Rechner aus ein neues Thema eröffnen, um die logs darüber reinzustellen - das funktioniert nämlich, gerade probiert...? Komme jetzt übrigens wieder immer beim ersten Einwählen ins Internet.

cosinus 18.08.2012 13:11
Bitte kein neues Thema aufmachen!
Schieb die Logs auf einen Stick und dann postest du die Logs von einem funktionierenden Rechner aus

IamShine 18.08.2012 15:51
danke. Hatte nur Angst, dass ich mir den nächsten Rechner infiziere.

erstes protection log von malwarebytes:
Code:
2012/08/12 11:56:01 +0200        GERRIT-PC        Gerrit        MESSAGE        Starting protection
2012/08/12 11:56:05 +0200        GERRIT-PC        Gerrit        MESSAGE        Protection started successfully
2012/08/12 11:56:08 +0200        GERRIT-PC        Gerrit        MESSAGE        Starting IP protection
2012/08/12 11:56:10 +0200        GERRIT-PC        Gerrit        MESSAGE        IP Protection started successfully
2012/08/12 12:01:28 +0200        GERRIT-PC        Gerrit        MESSAGE        Starting protection
2012/08/12 12:01:31 +0200        GERRIT-PC        Gerrit        MESSAGE        Protection started successfully
2012/08/12 12:01:34 +0200        GERRIT-PC        Gerrit        MESSAGE        Starting IP protection
2012/08/12 12:01:37 +0200        GERRIT-PC        Gerrit        MESSAGE        IP Protection started successfully
2012/08/12 12:18:09 +0200        GERRIT-PC        Gerrit        MESSAGE        Executing scheduled update:  Daily
2012/08/12 12:18:09 +0200        GERRIT-PC        Gerrit        ERROR        Scheduled update failed:  Host not found failed with error code 0
2012/08/12 14:59:28 +0200        GERRIT-PC        Gerrit        MESSAGE        Starting protection
2012/08/12 14:59:31 +0200        GERRIT-PC        Gerrit        ERROR        Integrity verification failed failed with error code 2
2012/08/12 14:59:31 +0200        GERRIT-PC        Gerrit        MESSAGE        Protection stopped
2012/08/12 21:50:28 +0200        GERRIT-PC        Gerrit        MESSAGE        Starting protection
2012/08/12 21:50:31 +0200        GERRIT-PC        Gerrit        MESSAGE        Protection started successfully
2012/08/12 21:50:34 +0200        GERRIT-PC        Gerrit        MESSAGE        Starting IP protection
2012/08/12 21:50:37 +0200        GERRIT-PC        Gerrit        MESSAGE        IP Protection started successfully
2012/08/12 23:35:14 +0200        GERRIT-PC        Gerrit        MESSAGE        Starting protection
2012/08/12 23:35:17 +0200        GERRIT-PC        Gerrit        MESSAGE        Protection started successfully
2012/08/12 23:35:20 +0200        GERRIT-PC        Gerrit        MESSAGE        Starting IP protection
2012/08/12 23:35:23 +0200        GERRIT-PC        Gerrit        MESSAGE        IP Protection started successfully
erstes scan log:
Code:
Malwarebytes Anti-Malware (Trial) 1.62.0.1300
www.malwarebytes.org

Database version: v2012.07.03.05

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
Gerrit :: GERRIT-PC [limited]

Protection: Enabled

12.08.2012 12:00:45
mbam-log-2012-08-12 (12-00-45).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 158442
Time elapsed: 6 minute(s), 56 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)
zweites protection log:
Code:
2012/08/13 00:02:53 +0200        GERRIT-PC        Gerrit        MESSAGE        Starting protection
2012/08/13 00:02:56 +0200        GERRIT-PC        Gerrit        MESSAGE        Protection started successfully
2012/08/13 00:02:59 +0200        GERRIT-PC        Gerrit        MESSAGE        Starting IP protection
2012/08/13 00:03:02 +0200        GERRIT-PC        Gerrit        MESSAGE        IP Protection started successfully
3. protection log:
Code:
2012/08/16 13:39:14 +0200        GERRIT-PC        (null)        MESSAGE        Executing scheduled update:  Daily
2012/08/16 13:39:14 +0200        GERRIT-PC        (null)        ERROR        Scheduled update failed:  Host not found failed with error code 0
2012/08/16 15:17:00 +0200        GERRIT-PC        Gerrit        MESSAGE        Starting protection
2012/08/16 15:17:06 +0200        GERRIT-PC        Gerrit        MESSAGE        Protection started successfully
2012/08/16 15:17:09 +0200        GERRIT-PC        Gerrit        MESSAGE        Starting IP protection
2012/08/16 15:17:13 +0200        GERRIT-PC        Gerrit        MESSAGE        IP Protection started successfully
2012/08/16 15:24:28 +0200        GERRIT-PC        Gerrit        MESSAGE        Starting protection
2012/08/16 15:24:33 +0200        GERRIT-PC        Gerrit        MESSAGE        Protection started successfully
2012/08/16 15:24:36 +0200        GERRIT-PC        Gerrit        MESSAGE        Starting IP protection
2012/08/16 15:24:39 +0200        GERRIT-PC        Gerrit        MESSAGE        IP Protection started successfully
2012/08/16 15:41:03 +0200        GERRIT-PC        Gerrit        MESSAGE        Starting protection
2012/08/16 15:41:06 +0200        GERRIT-PC        Gerrit        MESSAGE        Protection started successfully
2012/08/16 15:41:09 +0200        GERRIT-PC        Gerrit        MESSAGE        Starting IP protection
2012/08/16 15:41:14 +0200        GERRIT-PC        Gerrit        MESSAGE        IP Protection started successfully
2. scan log:
Code:
Malwarebytes Anti-Malware (Trial) 1.62.0.1300
www.malwarebytes.org

Database version: v2012.07.03.05

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
Gerrit :: GERRIT-PC [limited]

Protection: Enabled

16.08.2012 15:40:45
mbam-log-2012-08-16 (15-40-45).txt

Scan type: Full scan (C:\|D:\|)
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 319636
Time elapsed: 1 hour(s), 1 minute(s), 10 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)
4. protection log:
Code:
2012/08/17 22:54:56 +0200        GERRIT-PC        Gerrit        MESSAGE        Starting protection
2012/08/17 22:54:59 +0200        GERRIT-PC        Gerrit        MESSAGE        Protection started successfully
2012/08/17 22:55:02 +0200        GERRIT-PC        Gerrit        MESSAGE        Starting IP protection
2012/08/17 22:55:05 +0200        GERRIT-PC        Gerrit        MESSAGE        IP Protection started successfully
2012/08/17 22:57:46 +0200        GERRIT-PC        Gerrit        MESSAGE        Executing scheduled update:  Daily
2012/08/17 22:57:57 +0200        GERRIT-PC        Gerrit        MESSAGE        Scheduled update executed successfully:  database updated from version v2012.08.17.06 to version v2012.08.17.07
2012/08/17 22:57:57 +0200        GERRIT-PC        Gerrit        MESSAGE        Starting database refresh
2012/08/17 22:57:57 +0200        GERRIT-PC        Gerrit        MESSAGE        Stopping IP protection
2012/08/17 22:57:59 +0200        GERRIT-PC        Gerrit        MESSAGE        IP Protection stopped
2012/08/17 22:58:02 +0200        GERRIT-PC        Gerrit        MESSAGE        Database refreshed successfully
2012/08/17 22:58:02 +0200        GERRIT-PC        Gerrit        MESSAGE        Starting IP protection
2012/08/17 22:58:06 +0200        GERRIT-PC        Gerrit        MESSAGE        IP Protection started successfully
2012/08/17 23:04:04 +0200        GERRIT-PC        Gerrit        MESSAGE        Starting protection
2012/08/17 23:04:08 +0200        GERRIT-PC        Gerrit        MESSAGE        Protection started successfully
2012/08/17 23:04:11 +0200        GERRIT-PC        Gerrit        MESSAGE        Starting IP protection
2012/08/17 23:04:14 +0200        GERRIT-PC        Gerrit        MESSAGE        IP Protection started successfully
2012/08/17 23:13:55 +0200        GERRIT-PC        Gerrit        MESSAGE        Stopping IP protection
2012/08/17 23:13:57 +0200        GERRIT-PC        Gerrit        MESSAGE        IP Protection stopped
5. protection log:
Code:
2012/08/18 01:37:39 +0200        GERRIT-PC        Gerrit        MESSAGE        Starting protection
2012/08/18 01:37:42 +0200        GERRIT-PC        Gerrit        MESSAGE        Protection started successfully
2012/08/18 01:37:45 +0200        GERRIT-PC        Gerrit        MESSAGE        Starting IP protection
2012/08/18 01:37:48 +0200        GERRIT-PC        Gerrit        MESSAGE        IP Protection started successfully
...ich vermute fast, die protection logs brauchst du gar nicht?

ESET-log:
Code:
ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
# version=7
# iexplore.exe=9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=d9f70cbada8f204687b945fe232116fa
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-08-17 11:18:50
# local_time=2012-08-18 01:18:50 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode=1792 16777215 100 0 1918396 1918396 0 0
# compatibility_mode=5892 16776573 100 100 570 182771422 0 0
# compatibility_mode=8192 67108863 100 0 177 177 0 0
# scanned=176550
# found=7
# cleaned=0
# scan_time=6836
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3S9VIRQ7\CreativeHandler[1].htm        HTML/ScrInject.B.Gen virus (unable to clean)        00000000000000000000000000000000        I
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3S9VIRQ7\JDownloaderSetup_CH4[1].exe        a variant of Win32/InstallCore.AL application (unable to clean)        00000000000000000000000000000000        I
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IPPJNAHC\CreativeHandler[1].htm        HTML/ScrInject.B.Gen virus (unable to clean)        00000000000000000000000000000000        I
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IPPJNAHC\finish[1].htm        HTML/ScrInject.B.Gen virus (unable to clean)        00000000000000000000000000000000        I
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\V015TM4T\offer[1].htm        HTML/ScrInject.B.Gen virus (unable to clean)        00000000000000000000000000000000        I
C:\Users\Gerrit\AppData\Local\Temp\Low\V.class        a variant of Java/Exploit.CVE-2011-3544.BQ trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Gerrit\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\23\50d1dd7-61e5f91d        a variant of Java/Exploit.CVE-2012-1723.AL trojan (unable to clean)        00000000000000000000000000000000        I
Habe noch einen weiteren Speicherort einer 2. Installation von malwarebytes gefunden mit 3 weiteren logs. Wusste gar nicht, dass zwei Installationen von malwarebytes auf einem Rechner laufen können...

Code:
Malwarebytes Anti-Malware (Test) 1.62.0.1300
www.malwarebytes.org

Datenbank Version: v2012.07.03.05

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
Admin :: GERRIT-PC [Administrator]

Schutz: Deaktiviert

12.08.2012 15:01:10
mbam-log-2012-08-12 (15-01-10).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 409669
Laufzeit: 1 Stunde(n), 38 Minute(n), 10 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Video Downloader (PUP.BundleInstaller.VG) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 1
C:\Program Files\vGrabber-software\Uninstall.exe (PUP.BundleInstaller.VG) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)
Code:
Malwarebytes Anti-Malware (Test) 1.62.0.1300
www.malwarebytes.org

Datenbank Version: v2012.08.17.06

Windows Vista Service Pack 2 x86 NTFS (Abgesichertenmodus/Netzwerkfähig)
Internet Explorer 9.0.8112.16421
Admin :: GERRIT-PC [Administrator]

Schutz: Deaktiviert

17.08.2012 18:57:31
mbam-log-2012-08-17 (18-57-31).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 229066
Laufzeit: 3 Minute(n), 46 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 2
C:\Users\Gerrit\AppData\Local\Temp\update00.b.exe (Trojan.Inject) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Gerrit\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk (Trojan.Ransom.Gen) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)
Code:
Malwarebytes Anti-Malware (Test) 1.62.0.1300
www.malwarebytes.org

Datenbank Version: v2012.08.17.06

Windows Vista Service Pack 2 x86 NTFS (Abgesichertenmodus/Netzwerkfähig)
Internet Explorer 9.0.8112.16421
Admin :: GERRIT-PC [Administrator]

Schutz: Deaktiviert

17.08.2012 19:35:04
mbam-log-2012-08-17 (19-35-04).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 395104
Laufzeit: 51 Minute(n), 38 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 2
C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS001FD.log (Extension.Mismatch) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS001FE.log (Extension.Mismatch) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)

cosinus 19.08.2012 18:09
adwCleaner - Toolbars und ungewollte Start-/Suchseiten aufspüren

Downloade Dir bitte AdwCleaner auf deinen Desktop.
  • Starte die adwcleaner.exe mit einem Doppelklick.
  • Klicke auf Search.
  • Nach Ende des Suchlaufs öffnet sich eine Textdatei.
  • Poste mir den Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner[R1].txt.

IamShine 19.08.2012 20:02
Hallo cosinus, hier das adwcleaner-log:
Code:
# AdwCleaner v1.801 - Logfile created 08/19/2012 at 20:59:13
# Updated 14/08/2012 by Xplode
# Operating system : Windows Vista (TM) Home Premium Service Pack 2 (32 bits)
# User : Admin - GERRIT-PC
# Boot Mode : Normal
# Running from : C:\Users\Gerrit\Desktop\adwcleaner.exe
# Option [Search]


***** [Services] *****

Found : WajamUpdater

***** [Files / Folders] *****

Folder Found : C:\Users\Admin\AppData\Local\Conduit
Folder Found : C:\Users\Admin\AppData\Local\Wajam
Folder Found : C:\Users\Gerrit\AppData\LocalLow\Conduit
Folder Found : C:\Users\Gerrit\AppData\LocalLow\DVDVideoSoftTB_DE
Folder Found : C:\Users\Gerrit\AppData\LocalLow\PriceGong
Folder Found : C:\Users\Admin\AppData\LocalLow\DVDVideoSoftTB_DE
Folder Found : C:\Users\Admin\AppData\LocalLow\PriceGong
Folder Found : C:\Program Files\Conduit
Folder Found : C:\Program Files\DVDVideoSoftTB_DE
Folder Found : C:\Program Files\Wajam
File Found : C:\Users\Admin\AppData\Local\Temp\Uninstall.exe

***** [Registry] *****
[*] Key Found : HKLM\SOFTWARE\Classes\Toolbar.CT2625848
Key Found : HKCU\Software\AppDataLow\Software\Conduit
Key Found : HKCU\Software\AppDataLow\Software\PriceGong
Key Found : HKCU\Software\Wajam
Key Found : HKLM\SOFTWARE\Classes\wajam.WajamBHO
Key Found : HKLM\SOFTWARE\Classes\wajam.WajamBHO.1
Key Found : HKLM\SOFTWARE\Classes\wajam.WajamDownloader
Key Found : HKLM\SOFTWARE\Classes\wajam.WajamDownloader.1
Key Found : HKLM\SOFTWARE\Conduit
Key Found : HKLM\SOFTWARE\DVDVideoSoftTB_DE
Key Found : HKLM\SOFTWARE\Google\Chrome\Extensions\jpmbfleldcgkldadpdinhjjopdfpjfjp
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DVDVideoSoftTB_DE Toolbar
Key Found : HKLM\SOFTWARE\Software
Key Found : HKLM\SOFTWARE\Wajam

***** [Registre - GUID] *****

Key Found : HKLM\SOFTWARE\Classes\AppID\{1FAEE6D5-34F4-42AA-8025-3FD8F3EC4634}
Key Found : HKLM\SOFTWARE\Classes\AppID\{D616A4A2-7B38-4DBC-9093-6FE7A4A21B17}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{431532BD-0AE1-4ABC-BE8C-919F3D1332E2}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{0027DA2D-C9F2-4B0B-AE05-E2CD1BDB6CFF}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{457EF9F0-0A7C-4302-B47B-C207A8DE8598}
Key Found : HKLM\SOFTWARE\Classes\Interface\{431532BD-0AE1-4ABC-BE8C-919F3D1332E2}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{095BFD3C-4602-4FE1-96F1-AEFAFBFD067D}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1AA251B0-F6F1-402F-AA9D-8038D60CC893}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F842528F-E054-49AC-BD24-8FA4F43DF24E}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0027DA2D-C9F2-4B0B-AE05-E2CD1BDB6CFF}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{457EF9F0-0A7C-4302-B47B-C207A8DE8598}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{0027DA2D-C9F2-4B0B-AE05-E2CD1BDB6CFF}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{0027DA2D-C9F2-4B0B-AE05-E2CD1BDB6CFF}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{457EF9F0-0A7C-4302-B47B-C207A8DE8598}
Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{0027DA2D-C9F2-4B0B-AE05-E2CD1BDB6CFF}]
Value Found : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{0027DA2D-C9F2-4B0B-AE05-E2CD1BDB6CFF}]
Value Found : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{0027DA2D-C9F2-4B0B-AE05-E2CD1BDB6CFF}]
Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{0027DA2D-C9F2-4B0B-AE05-E2CD1BDB6CFF}]

***** [Internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16421

[OK] Registry is clean.

*************************

AdwCleaner[R1].txt - [4282 octets] - [19/08/2012 20:59:13]

########## EOF - C:\AdwCleaner[R1].txt - [4410 octets] ##########

cosinus 20.08.2012 21:34
adwCleaner - Toolbars und ungewollte Start-/Suchseiten entfernen
  • Schließe alle offenen Programme und Browser.
  • Starte die adwcleaner.exe mit einem Doppelklick.
  • Klicke auf Delete.
  • Bestätige jeweils mit Ok.
  • Dein Rechner wird neu gestartet. Nach dem Neustart öffnet sich eine Textdatei.
  • Poste mir den Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner[S1].txt.

IamShine 20.08.2012 22:22
Hier das log:
Code:
# AdwCleaner v1.801 - Logfile created 08/20/2012 at 23:15:34
# Updated 14/08/2012 by Xplode
# Operating system : Windows Vista (TM) Home Premium Service Pack 2 (32 bits)
# User : Admin - GERRIT-PC
# Boot Mode : Normal
# Running from : C:\Users\Gerrit\Desktop\adwcleaner.exe
# Option [Delete]


***** [Services] *****

Stopped & Deleted : WajamUpdater

***** [Files / Folders] *****

Folder Deleted : C:\Users\Admin\AppData\Local\Conduit
Folder Deleted : C:\Users\Admin\AppData\Local\Wajam
Folder Deleted : C:\Users\Gerrit\AppData\LocalLow\Conduit
Folder Deleted : C:\Users\Gerrit\AppData\LocalLow\DVDVideoSoftTB_DE
Folder Deleted : C:\Users\Gerrit\AppData\LocalLow\PriceGong
Folder Deleted : C:\Users\Admin\AppData\LocalLow\DVDVideoSoftTB_DE
Folder Deleted : C:\Users\Admin\AppData\LocalLow\PriceGong
Folder Deleted : C:\Program Files\Conduit
Folder Deleted : C:\Program Files\DVDVideoSoftTB_DE
Folder Deleted : C:\Program Files\Wajam
Deleted on reboot : C:\Users\Admin\AppData\Local\TempC:\Program Files\Software

***** [Registry] *****
[*] Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT2625848
Key Deleted : HKCU\Software\AppDataLow\Software\Conduit
Key Deleted : HKCU\Software\AppDataLow\Software\PriceGong
Key Deleted : HKCU\Software\Wajam
Key Deleted : HKLM\SOFTWARE\Classes\wajam.WajamBHO
Key Deleted : HKLM\SOFTWARE\Classes\wajam.WajamBHO.1
Key Deleted : HKLM\SOFTWARE\Classes\wajam.WajamDownloader
Key Deleted : HKLM\SOFTWARE\Classes\wajam.WajamDownloader.1
Key Deleted : HKLM\SOFTWARE\Conduit
Key Deleted : HKLM\SOFTWARE\DVDVideoSoftTB_DE
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\jpmbfleldcgkldadpdinhjjopdfpjfjp
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DVDVideoSoftTB_DE Toolbar
Key Deleted : HKLM\SOFTWARE\Software
Key Deleted : HKLM\SOFTWARE\Wajam

***** [Registre - GUID] *****

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{1FAEE6D5-34F4-42AA-8025-3FD8F3EC4634}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{D616A4A2-7B38-4DBC-9093-6FE7A4A21B17}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{431532BD-0AE1-4ABC-BE8C-919F3D1332E2}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{0027DA2D-C9F2-4B0B-AE05-E2CD1BDB6CFF}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{457EF9F0-0A7C-4302-B47B-C207A8DE8598}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{431532BD-0AE1-4ABC-BE8C-919F3D1332E2}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{095BFD3C-4602-4FE1-96F1-AEFAFBFD067D}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1AA251B0-F6F1-402F-AA9D-8038D60CC893}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F842528F-E054-49AC-BD24-8FA4F43DF24E}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0027DA2D-C9F2-4B0B-AE05-E2CD1BDB6CFF}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{457EF9F0-0A7C-4302-B47B-C207A8DE8598}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{0027DA2D-C9F2-4B0B-AE05-E2CD1BDB6CFF}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{0027DA2D-C9F2-4B0B-AE05-E2CD1BDB6CFF}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{457EF9F0-0A7C-4302-B47B-C207A8DE8598}
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{0027DA2D-C9F2-4B0B-AE05-E2CD1BDB6CFF}]
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{0027DA2D-C9F2-4B0B-AE05-E2CD1BDB6CFF}]
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{0027DA2D-C9F2-4B0B-AE05-E2CD1BDB6CFF}]
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{0027DA2D-C9F2-4B0B-AE05-E2CD1BDB6CFF}]

***** [Internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16421

[OK] Registry is clean.

*************************

AdwCleaner[R1].txt - [4411 octets] - [19/08/2012 20:59:13]
AdwCleaner[S1].txt - [4466 octets] - [20/08/2012 23:15:34]

########## EOF - C:\AdwCleaner[S1].txt - [4594 octets] ##########
Schönen Urlaub!

cosinus 21.08.2012 13:12
Hätte da mal zwei Fragen bevor es weiter geht

1.) Geht der normale Modus von Windows (wieder) uneingeschränkt?
2.) Vermisst du irgendwas im Startmenü? Sind da leere Ordner unter alle Programme oder ist alles vorhanden?

IamShine 21.08.2012 21:27
Ja, normaler Modus geht mit einer Einschränkung (arbeite auch schon seit einiger Zeit in dem Modus): habe java 7 heute installiert via Systemsteuerung -> Programme und Funktionen, wollte 2 alte java-Versionen deinstallieren, hat aber nur bei einer geklappt. Bei der zweiten alten Version kam die Meldung: "Auf den Windows Installer Dienst konnte nicht zugegriffen werden. Dies kann auftreten, wenn der Installer Dienst nicht richtig installiert wurde. Wenden Sie sich an den Support...". Habe es bisher nicht geschafft, den Windosw Installer zu reparieren/neu zu installieren (habe Vista SP2)...??? Kann ich eigentlich ESET und Malwarebytes wieder deinstallieren?

cosinus 30.08.2012 12:43
Mach bitte ein neues OTL-Log. Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:
hier steht das Log
CustomScan mit OTL

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop. Falls schon vorhanden, bitte die ältere vorhandene Datei durch die neu heruntergeladene Datei ersetzen, damit du auch wirklich mit einer aktuellen Version von OTL arbeitest.
Code:
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT

IamShine 01.09.2012 10:36
Hallo cosinus,

hier das aktuelle OTL-log:
OTL Logfile:
Code:
OTL logfile created on: 01.09.2012 10:51:04 - Run 5
OTL by OldTimer - Version 3.2.59.1    Folder = C:\Users\Gerrit\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,25 Gb Total Physical Memory | 1,27 Gb Available Physical Memory | 56,44% Memory free
4,72 Gb Paging File | 3,34 Gb Available in Paging File | 70,77% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 282,27 Gb Total Space | 184,27 Gb Free Space | 65,28% Space Free | Partition Type: NTFS
Drive D: | 15,81 Gb Total Space | 4,68 Gb Free Space | 29,63% Space Free | Partition Type: FAT32
 
Computer Name: GERRIT-PC | User Name: Admin | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.09.01 10:42:04 | 000,598,528 | ---- | M] (OldTimer Tools) -- C:\Users\Gerrit\Desktop\OTL.exe
PRC - [2012.08.08 09:01:07 | 000,348,664 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe
PRC - [2012.07.27 22:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2012.07.05 18:41:46 | 003,048,136 | ---- | M] (Skype Technologies S.A.) -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
PRC - [2012.07.03 13:46:44 | 000,655,944 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2012.05.21 15:42:44 | 000,050,176 | ---- | M] () -- C:\Programme\Freemium\SystemStore\Freemium.SystemStore.WindowsService.exe
PRC - [2012.05.02 01:42:28 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\sched.exe
PRC - [2012.05.02 00:34:34 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe
PRC - [2012.04.24 02:11:55 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe
PRC - [2010.09.21 15:03:14 | 001,710,464 | ---- | M] (Microsoft Corp.) -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
PRC - [2010.09.21 15:03:14 | 000,193,408 | ---- | M] (Microsoft Corp.) -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
PRC - [2010.01.12 09:01:00 | 000,201,216 | ---- | M] (SEIKO EPSON CORPORATION) -- C:\Windows\System32\spool\drivers\w32x86\3\E_FATIGYE.EXE
PRC - [2009.05.14 18:07:14 | 000,759,048 | ---- | M] (ABBYY) -- C:\Programme\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe
PRC - [2009.04.11 08:28:03 | 001,233,920 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Sidebar\sidebar.exe
PRC - [2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2008.09.18 19:00:10 | 006,294,048 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe
PRC - [2008.01.21 04:25:33 | 000,896,512 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe
PRC - [2008.01.21 04:25:33 | 000,202,240 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnscfg.exe
PRC - [2007.06.05 13:20:32 | 000,177,704 | ---- | M] () -- C:\Windows\System32\PSIService.exe
PRC - [2001.11.12 13:31:48 | 000,020,480 | ---- | M] (X10) -- C:\Programme\Common Files\X10\Common\X10nets.exe
 
 
========== Modules (No Company Name) ==========
 
 
========== Services (SafeList) ==========
 
SRV - [2012.07.27 22:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2012.07.13 13:28:36 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Programme\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012.07.05 18:41:46 | 003,048,136 | ---- | M] (Skype Technologies S.A.) [Auto | Running] -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe -- (Skype C2C Service)
SRV - [2012.07.03 13:46:44 | 000,655,944 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2012.05.21 15:42:44 | 000,050,176 | ---- | M] () [Auto | Running] -- C:\Programme\Freemium\SystemStore\Freemium.SystemStore.WindowsService.exe -- (SystemStore)
SRV - [2012.05.02 01:42:28 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012.05.02 00:34:34 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2010.09.23 01:21:24 | 001,493,352 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Live\Family Safety\fsssvc.exe -- (fsssvc)
SRV - [2010.09.22 17:33:04 | 000,051,040 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Programme\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)
SRV - [2010.09.21 15:03:14 | 001,710,464 | ---- | M] (Microsoft Corp.) [Auto | Running] -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)
SRV - [2009.05.14 18:07:14 | 000,759,048 | ---- | M] (ABBYY) [Auto | Running] -- C:\Programme\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe -- (ABBYY.Licensing.FineReader.Sprint.9.0)
SRV - [2008.01.21 04:25:33 | 000,896,512 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)
SRV - [2008.01.21 04:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007.06.05 13:20:32 | 000,177,704 | ---- | M] () [Auto | Running] -- C:\Windows\System32\PSIService.exe -- (ProtexisLicensing)
SRV - [2001.11.12 13:31:48 | 000,020,480 | ---- | M] (X10) [Auto | Running] -- C:\Programme\Common Files\X10\Common\X10nets.exe -- (x10nets)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp)
DRV - [2012.07.03 13:46:44 | 000,022,344 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2012.04.27 10:20:04 | 000,137,928 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2012.04.25 00:32:27 | 000,083,392 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2012.04.16 21:17:40 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr)
DRV - [2010.08.12 13:07:50 | 000,292,712 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvmfdx32.sys -- (NVNET)
DRV - [2010.08.12 13:07:50 | 000,292,712 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nvmfdx32.sys -- (NVENETFD)
DRV - [2010.06.17 15:14:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2010.05.31 02:54:30 | 000,064,512 | ---- | M] (ASIX Electronics Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ax88772.sys -- (AX88772)
DRV - [2009.09.05 15:25:36 | 001,183,744 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr)
DRV - [2008.09.29 22:29:00 | 007,593,120 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2008.09.25 09:28:06 | 001,332,576 | ---- | M] (NXP Semiconductors Germany GmbH) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\NxpCap.sys -- (NxpCap)
DRV - [2008.09.05 13:20:20 | 000,045,600 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvhda32v.sys -- (NVHDA)
DRV - [2008.08.25 03:22:52 | 000,015,872 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvsmu.sys -- (nvsmu)
DRV - [2008.08.18 18:58:16 | 000,145,952 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\nvstor32.sys -- (nvstor32)
DRV - [2007.07.31 11:58:18 | 000,908,896 | ---- | M] (NXP Semiconductors Germany GmbH) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\PhilCap.sys -- (PhilCap)
DRV - [2006.11.30 15:18:18 | 000,027,416 | ---- | M] (X10 Wireless Technology, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\x10ufx2.sys -- (XUIF)
DRV - [2006.11.17 10:31:04 | 000,013,976 | ---- | M] (X10 Wireless Technology, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\x10hid.sys -- (X10Hid)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.aldi.com/
IE - HKLM\..\SearchScopes,DefaultScope = {67A2568C-7A0A-4EED-AECC-B5405DE63B64}
IE - HKLM\..\SearchScopes,DefaultScope /d {67A2568C-7A0A-4EED-AECC-B5405DE63B64} /f >Nul 2>Nul =
IE - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7MEDA
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
IE - HKU\S-1-5-21-2799112012-1549174850-2009520858-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.aldi.com/
IE - HKU\S-1-5-21-2799112012-1549174850-2009520858-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKU\S-1-5-21-2799112012-1549174850-2009520858-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-2799112012-1549174850-2009520858-1000\..\SearchScopes,DefaultScope = {67A2568C-7A0A-4EED-AECC-B5405DE63B64}
IE - HKU\S-1-5-21-2799112012-1549174850-2009520858-1000\..\SearchScopes,DefaultScope /d {67A2568C-7A0A-4EED-AECC-B5405DE63B64} /f >Nul 2>Nul =
IE - HKU\S-1-5-21-2799112012-1549174850-2009520858-1000\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7MEDA_de
IE - HKU\S-1-5-21-2799112012-1549174850-2009520858-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-21-2799112012-1549174850-2009520858-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.aldi.com/
IE - HKU\S-1-5-21-2799112012-1549174850-2009520858-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/
IE - HKU\S-1-5-21-2799112012-1549174850-2009520858-1001\..\SearchScopes,DefaultScope = {67A2568C-7A0A-4EED-AECC-B5405DE63B64}
IE - HKU\S-1-5-21-2799112012-1549174850-2009520858-1001\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7MEDA_deDE414
IE - HKU\S-1-5-21-2799112012-1549174850-2009520858-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
========== FireFox ==========
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.6.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.6.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
 
 
O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: ::1            localhost
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2 - BHO: (Easy Photo Print) - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Programme\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
O2 - BHO: (Windows Live Messenger Companion Helper) - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Programme\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5805.1910\swg.dll File not found
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (Easy Photo Print) - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Programme\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
O3 - HKU\S-1-5-21-2799112012-1549174850-2009520858-1000\..\Toolbar\WebBrowser: (no name) - {0027DA2D-C9F2-4B0B-AE05-E2CD1BDB6CFF} - No CLSID value found.
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-21-2799112012-1549174850-2009520858-1000..\Run: [EPSON PX720WD Series] C:\Windows\System32\spool\DRIVERS\W32X86\3\E_FATIGYE.EXE (SEIKO EPSON CORPORATION)
O4 - HKU\S-1-5-21-2799112012-1549174850-2009520858-1000..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" File not found
O4 - HKU\S-1-5-21-2799112012-1549174850-2009520858-1000..\Run: [WMPNSCFG] C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-2799112012-1549174850-2009520858-1001..\Run: [EPSON PX720WD Series] C:\Windows\System32\spool\DRIVERS\W32X86\3\E_FATIGYE.EXE (SEIKO EPSON CORPORATION)
O4 - Startup: C:\Users\Gerrit\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 2.2.lnk = C:\Programme\OpenOffice.org 2.2\program\quickstart.exe ()
O8 - Extra context menu item: Free YouTube Download - C:\Users\Admin\AppData\Roaming\DVDVideoSoftIEHelpers\freeytvdownloader.htm File not found
O8 - Extra context menu item: Google Sidewiki... - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll (Google Inc.)
O9 - Extra Button: @C:\Program Files\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Programme\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
O9 - Extra Button: eBay - Der weltweite Online-Marktplatz - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-25/4 File not found
O9 - Extra 'Tools' menuitem : eBay - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-25/4 File not found
O9 - Extra Button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O13 - gopher Prefix: missing
O15 - HKU\S-1-5-21-2799112012-1549174850-2009520858-1000\..Trusted Domains: fritz.box ([]* in Local intranet)
O15 - HKU\S-1-5-21-2799112012-1549174850-2009520858-1000\..Trusted Ranges: Range1 ([*] in Local intranet)
O15 - HKU\S-1-5-21-2799112012-1549174850-2009520858-1001\..Trusted Domains: fritz.box ([]* in Local intranet)
O15 - HKU\S-1-5-21-2799112012-1549174850-2009520858-1001\..Trusted Ranges: GD ([http] in Local intranet)
O15 - HKU\S-1-5-21-2799112012-1549174850-2009520858-1001\..Trusted Ranges: Range1 ([*] in Local intranet)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_05-windows-i586.cab (Reg Error: Value error.)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0017-0000-0005-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_05-windows-i586.cab (Java Plug-in 1.7.0_05)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 10.6.2)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F601577A-DCC5-4A71-819A-37B3068B271B}: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Programme\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O18 - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Programme\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img24.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img24.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2008.08.21 11:50:32 | 000,000,672 | RH-- | M] () - D:\AUTOEXEC.BAT -- [ FAT32 ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
MsConfig - StartUpFolder: C:^Users^Admin^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 2.2.lnk - C:\Programme\OpenOffice.org 2.2\program\quickstart.exe - ()
MsConfig - StartUpReg: Adobe ARM - hkey= - key= - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
MsConfig - StartUpReg: EEventManager - hkey= - key= - C:\Program Files\Epson Software\Event Manager\EEventManager.exe (SEIKO EPSON CORPORATION)
MsConfig - StartUpReg: LanguageShortcut - hkey= - key= - C:\Program Files\HomeCinema\PowerDVD\Language\Language.exe ()
MsConfig - StartUpReg: RemoteControl - hkey= - key= - C:\Program Files\HomeCinema\PowerDVD\PDVDServ.exe (Cyberlink Corp.)
MsConfig - StartUpReg: Sidebar - hkey= - key= - C:\Program Files\Windows Sidebar\sidebar.exe (Microsoft Corporation)
MsConfig - StartUpReg: Skype - hkey= - key= - C:\Program Files\Skype\Phone\Skype.exe (Skype Technologies S.A.)
MsConfig - StartUpReg: swg - hkey= - key= -  File not found
MsConfig - StartUpReg: toolbar_eula_launcher - hkey= - key= - C:\Programme\GoogleEULA\EULALauncher.exe ( )
MsConfig - StartUpReg: UCam_Menu - hkey= - key= - C:\Program Files\HomeCinema\YouCam\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
MsConfig - State: "startup" - 2
 
SafeBootMin: AppMgmt - Service
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: NTDS -  File not found
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet: AppMgmt - Service
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: NTDS -  File not found
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootNet: WudfPf - Driver
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} -
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0
ActiveX: {233C1507-6A77-46A4-9443-F871F945D258} - Adobe Shockwave Director 11.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2A202491-F00D-11cf-87CC-0020AFEECF20} - Adobe Shockwave Director 11.0
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} -
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.08.21 21:31:52 | 000,000,000 | ---D | C] -- C:\perflogs
[2012.08.21 15:11:29 | 000,000,000 | ---D | C] -- C:\Windows\pss
[2012.08.21 00:21:07 | 000,000,000 | ---D | C] -- C:\Program Files\Adobe
[2012.08.20 23:44:30 | 000,000,000 | ---D | C] -- C:\Program Files\Oracle
[2012.08.20 23:41:19 | 000,000,000 | ---D | C] -- C:\Sun
[2012.08.19 13:52:18 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Skype
[2012.08.19 13:48:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Sun
[2012.08.17 23:21:57 | 000,000,000 | ---D | C] -- C:\Program Files\ESET
[2012.08.12 11:55:56 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Malwarebytes
[2012.08.12 11:55:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.08.12 11:55:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.08.12 11:55:34 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2012.08.12 11:55:34 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012.08.10 02:14:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
[2012.08.05 21:45:37 | 000,000,000 | ---D | C] -- C:\Program Files\JDownloader
[2012.08.05 21:24:29 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Video Downloader
[2012.08.05 21:23:51 | 000,000,000 | ---D | C] -- C:\Program Files\vGrabber-software
 
========== Files - Modified Within 30 Days ==========
 
[2012.09.01 10:42:40 | 000,595,996 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.09.01 10:42:39 | 000,628,742 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.09.01 10:42:39 | 000,126,454 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.09.01 10:42:39 | 000,104,070 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.09.01 10:36:55 | 000,070,975 | ---- | M] () -- C:\ProgramData\nvModes.001
[2012.09.01 10:36:36 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.09.01 10:36:22 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012.09.01 10:36:22 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012.09.01 10:36:15 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.09.01 10:36:09 | 2414,092,288 | -HS- | M] () -- C:\hiberfil.sys
[2012.09.01 10:32:59 | 000,001,098 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.08.31 08:53:13 | 000,000,680 | ---- | M] () -- C:\Users\Admin\AppData\Local\d3d9caps.dat
[2012.08.30 14:38:29 | 000,076,014 | ---- | M] () -- C:\Users\Admin\Documents\Aototüren.xps
[2012.08.30 14:30:57 | 000,013,565 | ---- | M] () -- C:\Users\Admin\Documents\Jürgen Autotür.odt
[2012.08.30 14:15:20 | 000,070,975 | ---- | M] () -- C:\ProgramData\nvModes.dat
[2012.08.21 00:27:14 | 000,007,118 | ---- | M] () -- C:\Users\Admin\Desktop\plugincheck-seite.odt
[2012.08.18 01:34:19 | 000,684,112 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2012.08.12 23:15:48 | 000,000,000 | ---- | M] () -- C:\Users\Admin\defogger_reenable
[2012.08.12 15:00:32 | 000,000,910 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.08.05 21:26:36 | 000,001,788 | ---- | M] () -- C:\Users\Admin\Desktop\Video Downloader.lnk
 
========== Files Created - No Company Name ==========
 
[2012.08.30 14:38:28 | 000,076,014 | ---- | C] () -- C:\Users\Admin\Documents\Aototüren.xps
[2012.08.30 14:30:56 | 000,013,565 | ---- | C] () -- C:\Users\Admin\Documents\Jürgen Autotür.odt
[2012.08.21 00:27:13 | 000,007,118 | ---- | C] () -- C:\Users\Admin\Desktop\plugincheck-seite.odt
[2012.08.21 00:21:43 | 000,001,804 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
[2012.08.17 22:52:29 | 2414,092,288 | -HS- | C] () -- C:\hiberfil.sys
[2012.08.12 23:15:48 | 000,000,000 | ---- | C] () -- C:\Users\Admin\defogger_reenable
[2012.08.12 11:55:36 | 000,000,910 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.08.05 21:24:28 | 000,001,788 | ---- | C] () -- C:\Users\Admin\Desktop\Video Downloader.lnk
[2012.01.24 11:14:07 | 000,000,680 | ---- | C] () -- C:\Users\Admin\AppData\Local\d3d9caps.dat
[2011.10.28 14:43:00 | 000,022,016 | ---- | C] () -- C:\Users\Admin\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.11.13 20:58:03 | 000,000,299 | ---- | C] () -- C:\Windows\PRELUDE.INI
[2010.10.23 14:43:35 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2010.10.23 14:43:35 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2010.10.23 14:42:51 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2008.10.24 02:18:46 | 000,070,975 | ---- | C] () -- C:\ProgramData\nvModes.001
[2008.10.24 02:14:59 | 000,070,975 | ---- | C] () -- C:\ProgramData\nvModes.dat
 
========== LOP Check ==========
 
[2012.07.19 12:04:27 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\DVDVideoSoft
[2011.01.16 00:30:14 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Epson
[2012.07.23 09:30:24 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Freemium
[2011.06.19 10:47:09 | 000,000,000 | ---D | M] -- C:\Users\Gast\AppData\Roaming\Epson
[2012.07.19 12:04:59 | 000,000,000 | ---D | M] -- C:\Users\Gerrit\AppData\Roaming\DVDVideoSoft
[2011.12.04 17:38:08 | 000,000,000 | ---D | M] -- C:\Users\Gerrit\AppData\Roaming\Epson
[2012.07.23 09:35:36 | 000,000,000 | ---D | M] -- C:\Users\Gerrit\AppData\Roaming\Freemium
[2012.08.21 22:20:11 | 000,032,554 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2011.01.17 15:20:54 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Adobe
[2012.07.17 02:37:12 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Avira
[2012.07.19 12:04:27 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\DVDVideoSoft
[2011.01.16 00:30:14 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Epson
[2012.07.23 09:30:24 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Freemium
[2011.01.16 01:13:41 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Google
[2011.01.16 00:29:40 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Identities
[2012.07.17 13:36:13 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Macromedia
[2012.08.12 11:55:56 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Malwarebytes
[2006.11.02 14:37:34 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Media Center Programs
[2011.10.31 23:25:33 | 000,000,000 | --SD | M] -- C:\Users\Admin\AppData\Roaming\Microsoft
[2011.10.28 14:48:24 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Nero
[2012.08.30 14:51:21 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\OpenOffice.org2
[2012.08.21 12:52:33 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Skype
 
< %APPDATA%\*.exe /s >
[2011.04.05 20:19:51 | 000,000,766 | R--- | M] () -- C:\Users\Admin\AppData\Roaming\Microsoft\Installer\{C142994B-B3B0-4195-845B-629E20774EDC}\ARPPRODUCTICON.exe
[2011.04.05 20:19:51 | 000,040,960 | R--- | M] (InstallShield Software Corp.) -- C:\Users\Admin\AppData\Roaming\Microsoft\Installer\{C142994B-B3B0-4195-845B-629E20774EDC}\NewShortcut1_C142994BB3B04195845B629E20774EDC.exe
[2011.04.05 20:19:51 | 000,040,960 | R--- | M] (InstallShield Software Corp.) -- C:\Users\Admin\AppData\Roaming\Microsoft\Installer\{C142994B-B3B0-4195-845B-629E20774EDC}\NewShortcut2_C142994BB3B04195845B629E20774EDC.exe
[2011.04.05 20:19:51 | 000,008,854 | R--- | M] () -- C:\Users\Admin\AppData\Roaming\Microsoft\Installer\{C142994B-B3B0-4195-845B-629E20774EDC}\Uninstall_SON_test_C142994BB3B04195845B629E20774EDC.exe
 
< %SYSTEMDRIVE%\*.exe >
 
< MD5 for: AGP440.SYS  >
[2008.01.21 04:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\drivers\AGP440.sys
[2008.01.21 04:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_51b95d75\AGP440.sys
[2008.01.21 04:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys
[2008.01.21 04:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys
[2008.01.21 04:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_bbfe6647bbd2a4c6\AGP440.sys
[2008.05.10 05:22:58 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=961859CA0A8D18B4242EF222092D337D -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_31486222\AGP440.sys
[2008.05.10 05:22:58 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=961859CA0A8D18B4242EF222092D337D -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.22176_none_ba56dc4ed801d4e5\AGP440.sys
[2008.05.10 05:14:24 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=EB0082AE6173905ADBDB2D19AEEA976A -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_7997c13a\AGP440.sys
[2008.05.10 05:14:24 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=EB0082AE6173905ADBDB2D19AEEA976A -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6000.20832_none_b897de16dabe6bfb\AGP440.sys
[2006.11.02 11:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2008.08.13 13:05:25 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=0D83C87A801A3DFCD1BF73893FE7518C -- C:\Windows\System32\drivers\atapi.sys
[2008.08.13 13:05:25 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=0D83C87A801A3DFCD1BF73893FE7518C -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_4c9c5a00\atapi.sys
[2008.08.13 13:05:25 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=0D83C87A801A3DFCD1BF73893FE7518C -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18034_none_dd1bb97e219e87cb\atapi.sys
[2009.04.11 08:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_b12d8e84\atapi.sys
[2009.04.11 08:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys
[2008.01.21 04:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys
[2008.01.21 04:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys
[2006.11.02 11:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys
[2008.08.13 13:05:25 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=96DC4E1A9F90CCD489950A8935425C59 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.22134_none_dda556493abc2795\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll
[2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll
 
< MD5 for: EVENTLOG.DLL  >
[2007.05.17 21:34:04 | 000,007,216 | ---- | M] () MD5=C2A279A458A06DE2C83D842AA042B5A8 -- C:\Program Files\HomeCinema\PowerDirector\EventLog.dll
 
< MD5 for: IASTORV.SYS  >
[2008.01.21 04:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\drivers\iaStorV.sys
[2008.01.21 04:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_c9df7691\iaStorV.sys
[2008.01.21 04:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys
[2006.11.02 11:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2009.04.11 08:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\System32\netlogon.dll
[2009.04.11 08:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_ffa3304f351bb3a3\netlogon.dll
[2008.01.21 04:24:05 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2006.11.02 11:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys
[2008.01.21 04:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\drivers\nvstor.sys
[2008.01.21 04:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys
[2008.01.21 04:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys
 
< MD5 for: NVSTOR32.SYS  >
[2008.08.18 18:58:16 | 000,145,952 | ---- | M] (NVIDIA Corporation) MD5=8EE374B6FB3CB2BB8D70395218B464A5 -- C:\Windows\System32\drivers\nvstor32.sys
[2008.08.18 18:58:16 | 000,145,952 | ---- | M] (NVIDIA Corporation) MD5=8EE374B6FB3CB2BB8D70395218B464A5 -- C:\Windows\System32\DriverStore\FileRepository\nvstor32.inf_de3b0723\nvstor32.sys
 
< MD5 for: SCECLI.DLL  >
[2008.01.21 04:24:50 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll
[2009.04.11 08:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\System32\scecli.dll
[2009.04.11 08:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e\scecli.dll
 
< MD5 for: USER32.DLL  >
[2008.01.21 04:24:21 | 000,627,200 | ---- | M] (Microsoft Corporation) MD5=B974D9F06DC7D1908E825DC201681269 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_cd386c416d5c7f32\user32.dll
[2009.04.11 08:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\user32.dll
[2009.04.11 08:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6002.18005_none_cf23e54d6a7e4a7e\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2008.01.21 04:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe
[2008.01.21 04:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe
 
< MD5 for: WININIT.EXE  >
[2008.01.21 04:23:42 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\System32\wininit.exe
[2008.01.21 04:23:42 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6001.18000_none_30f2b8cf0450a6a2\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2009.04.11 08:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\System32\winlogon.exe
[2009.04.11 08:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe
[2012.07.03 13:46:42 | 000,217,672 | ---- | M] () MD5=8A7F34F0BBD076EC3815680A7309114F -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2008.01.21 04:24:49 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2008.01.21 04:24:47 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\System32\drivers\ws2ifsl.sys
[2008.01.21 04:24:47 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6001.18000_none_4f86a0d4c7cda641\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
[2008.01.21 05:14:18 | 016,846,848 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV
[2008.01.21 05:14:08 | 000,106,496 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV
[2008.01.21 05:14:18 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV
[2006.11.02 12:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV
[2006.11.02 12:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
 
<          >

< End of report >
--- --- ---

cosinus 01.09.2012 12:19
Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:
:OTL
O3 - HKU\S-1-5-21-2799112012-1549174850-2009520858-1000\..\Toolbar\WebBrowser: (no name) - {0027DA2D-C9F2-4B0B-AE05-E2CD1BDB6CFF} - No CLSID value found.
O4 - HKU\S-1-5-21-2799112012-1549174850-2009520858-1000..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" File not found
O8 - Extra context menu item: Free YouTube Download - C:\Users\Admin\AppData\Roaming\DVDVideoSoftIEHelpers\freeytvdownloader.htm File not found
O9 - Extra Button: eBay - Der weltweite Online-Marktplatz - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - http://rover.ebay.com/rover/1/707-37276-17534-25/4 File not found
O9 - Extra 'Tools' menuitem : eBay - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - http://rover.ebay.com/rover/1/707-37276-17534-25/4 File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2008.08.21 11:50:32 | 000,000,672 | RH-- | M] () - D:\AUTOEXEC.BAT -- [ FAT32 ]
:Files
C:\Users\Gerrit\AppData\LocalLow\Sun\Java\Deployment\cache
ipconfig /flushdns /c
:Commands
[purity]
[emptytemp]
[emptyflash]
[resethosts]
Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

IamShine 01.09.2012 12:46
Hier das OTL-fix-log. Habe rebooted, muss danach OTL neu starten, dann hat sich das log automatisch geöffnet:
Code:
All processes killed
========== OTL ==========
Registry value HKEY_USERS\S-1-5-21-2799112012-1549174850-2009520858-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{0027DA2D-C9F2-4B0B-AE05-E2CD1BDB6CFF} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0027DA2D-C9F2-4B0B-AE05-E2CD1BDB6CFF}\ not found.
Registry value HKEY_USERS\S-1-5-21-2799112012-1549174850-2009520858-1000\Software\Microsoft\Windows\CurrentVersion\Run\\swg deleted successfully.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Free YouTube Download\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{0B65DCC9-1740-43dc-B19C-4F309FB6A6CA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0B65DCC9-1740-43dc-B19C-4F309FB6A6CA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{0B65DCC9-1740-43dc-B19C-4F309FB6A6CA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0B65DCC9-1740-43dc-B19C-4F309FB6A6CA}\ not found.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
C:\autoexec.bat moved successfully.
D:\AUTOEXEC.BAT moved successfully.
========== FILES ==========
C:\Users\Gerrit\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\tmp folder moved successfully.
C:\Users\Gerrit\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\muffin folder moved successfully.
C:\Users\Gerrit\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host folder moved successfully.
C:\Users\Gerrit\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\9 folder moved successfully.
C:\Users\Gerrit\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\8 folder moved successfully.
C:\Users\Gerrit\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\7 folder moved successfully.
C:\Users\Gerrit\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\63 folder moved successfully.
C:\Users\Gerrit\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\62 folder moved successfully.
C:\Users\Gerrit\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\61 folder moved successfully.
C:\Users\Gerrit\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\60 folder moved successfully.
C:\Users\Gerrit\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\6 folder moved successfully.
C:\Users\Gerrit\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\59 folder moved successfully.
C:\Users\Gerrit\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\58 folder moved successfully.
C:\Users\Gerrit\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\57 folder moved successfully.
C:\Users\Gerrit\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\56 folder moved successfully.
C:\Users\Gerrit\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\55 folder moved successfully.
C:\Users\Gerrit\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\54 folder moved successfully.
C:\Users\Gerrit\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\53 folder moved successfully.
C:\Users\Gerrit\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\52 folder moved successfully.
C:\Users\Gerrit\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\51 folder moved successfully.
C:\Users\Gerrit\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\50 folder moved successfully.
C:\Users\Gerrit\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\5 folder moved successfully.
C:\Users\Gerrit\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\49 folder moved successfully.
C:\Users\Gerrit\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\48 folder moved successfully.
C:\Users\Gerrit\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\47 folder moved successfully.
C:\Users\Gerrit\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\46 folder moved successfully.
C:\Users\Gerrit\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\45 folder moved successfully.
C:\Users\Gerrit\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\44 folder moved successfully.
C:\Users\Gerrit\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\43 folder moved successfully.
C:\Users\Gerrit\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\42 folder moved successfully.
C:\Users\Gerrit\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\41 folder moved successfully.
C:\Users\Gerrit\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\40 folder moved successfully.
C:\Users\Gerrit\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\4 folder moved successfully.
C:\Users\Gerrit\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\39 folder moved successfully.
C:\Users\Gerrit\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\38 folder moved successfully.
C:\Users\Gerrit\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\37 folder moved successfully.
C:\Users\Gerrit\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\36 folder moved successfully.
C:\Users\Gerrit\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\35 folder moved successfully.
C:\Users\Gerrit\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\34 folder moved successfully.
C:\Users\Gerrit\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\33 folder moved successfully.
C:\Users\Gerrit\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\32 folder moved successfully.
C:\Users\Gerrit\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\31 folder moved successfully.
C:\Users\Gerrit\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\30 folder moved successfully.
C:\Users\Gerrit\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\3 folder moved successfully.
C:\Users\Gerrit\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\29 folder moved successfully.
C:\Users\Gerrit\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\28 folder moved successfully.
C:\Users\Gerrit\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\27 folder moved successfully.
C:\Users\Gerrit\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\26 folder moved successfully.
C:\Users\Gerrit\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\25 folder moved successfully.
C:\Users\Gerrit\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\24 folder moved successfully.
C:\Users\Gerrit\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\23 folder moved successfully.
C:\Users\Gerrit\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\22 folder moved successfully.
C:\Users\Gerrit\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\21 folder moved successfully.
C:\Users\Gerrit\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\20 folder moved successfully.
C:\Users\Gerrit\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\2 folder moved successfully.
C:\Users\Gerrit\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\19 folder moved successfully.
C:\Users\Gerrit\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\18 folder moved successfully.
C:\Users\Gerrit\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\17 folder moved successfully.
C:\Users\Gerrit\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\16 folder moved successfully.
C:\Users\Gerrit\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\15 folder moved successfully.
C:\Users\Gerrit\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\14 folder moved successfully.
C:\Users\Gerrit\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\13 folder moved successfully.
C:\Users\Gerrit\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\12 folder moved successfully.
C:\Users\Gerrit\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\11 folder moved successfully.
C:\Users\Gerrit\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\10 folder moved successfully.
C:\Users\Gerrit\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\1 folder moved successfully.
C:\Users\Gerrit\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\0 folder moved successfully.
C:\Users\Gerrit\AppData\LocalLow\Sun\Java\Deployment\cache\6.0 folder moved successfully.
C:\Users\Gerrit\AppData\LocalLow\Sun\Java\Deployment\cache folder moved successfully.
< ipconfig /flushdns /c >
Windows-IP-Konfiguration
Der DNS-Aufl”sungscache wurde geleert.
C:\Users\Gerrit\Desktop\cmd.bat deleted successfully.
C:\Users\Gerrit\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: Admin
->Temp folder emptied: 34751981 bytes
->Temporary Internet Files folder emptied: 51396184 bytes
->Java cache emptied: 5330 bytes
->Flash cache emptied: 1057 bytes
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 17730126 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Gast
->Temp folder emptied: 120287 bytes
->Temporary Internet Files folder emptied: 19803843 bytes
 
User: Gerrit
->Temp folder emptied: 4371365103 bytes
->Temporary Internet Files folder emptied: 711603460 bytes
->Flash cache emptied: 29618 bytes
 
User: Public
 
User: TEMP
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 200648499 bytes
RecycleBin emptied: 16567135 bytes
 
Total Files Cleaned = 5.173,00 mb
 
 
[EMPTYFLASH]
 
User: Admin
->Flash cache emptied: 0 bytes
 
User: All Users
 
User: Default
 
User: Default User
 
User: Gast
 
User: Gerrit
->Flash cache emptied: 0 bytes
 
User: Public
 
User: TEMP
 
Total Flash Files Cleaned = 0,00 mb
 
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
OTL by OldTimer - Version 3.2.59.1 log created on 09012012_132913

Files\Folders moved on Reboot...

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

cosinus 01.09.2012 12:54
Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten Anleitung und Downloadlink hier => http://www.trojaner-board.de/82358-t...entfernen.html

Hinweis: Bitte den Virenscanner abstellen bevor du den TDSS-Killer ausführst, denn v.a. Avira meldet im TDSS-Tool oft einen Fehalalrm!

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.
Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition (meistens Laufwerk C:) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtkwmtcxexhp/setting...8_16-25-18.jpg

IamShine 01.09.2012 13:30
Hier das TDSS-Killer-log. Mausrechtsklick kopieren des Logs ging übrigens nicht, aber einfach mit Markieren und Ctrl-C:
Code:
14:17:20.0326 3988  TDSS rootkit removing tool 2.8.8.0 Aug 24 2012 13:27:48
14:17:20.0389 3988  ============================================================
14:17:20.0389 3988  Current date / time: 2012/09/01 14:17:20.0389
14:17:20.0389 3988  SystemInfo:
14:17:20.0389 3988 
14:17:20.0389 3988  OS Version: 6.0.6002 ServicePack: 2.0
14:17:20.0389 3988  Product type: Workstation
14:17:20.0389 3988  ComputerName: GERRIT-PC
14:17:20.0389 3988  UserName: Admin
14:17:20.0389 3988  Windows directory: C:\Windows
14:17:20.0389 3988  System windows directory: C:\Windows
14:17:20.0389 3988  Processor architecture: Intel x86
14:17:20.0389 3988  Number of processors: 2
14:17:20.0389 3988  Page size: 0x1000
14:17:20.0389 3988  Boot type: Normal boot
14:17:20.0389 3988  ============================================================
14:17:20.0887 3988  Drive \Device\Harddisk0\DR0 - Size: 0x4A85D56000 (298.09 Gb), SectorSize: 0x200, Cylinders: 0x9801, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050
14:17:20.0889 3988  ============================================================
14:17:20.0889 3988  \Device\Harddisk0\DR0:
14:17:20.0890 3988  MBR partitions:
14:17:20.0890 3988  \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x23488000
14:17:20.0890 3988  \Device\Harddisk0\DR0\Partition2: MBR, Type 0xC, StartLBA 0x23488800, BlocksNum 0x1FA5800
14:17:20.0890 3988  ============================================================
14:17:20.0961 3988  C: <-> \Device\Harddisk0\DR0\Partition1
14:17:20.0995 3988  D: <-> \Device\Harddisk0\DR0\Partition2
14:17:20.0995 3988  ============================================================
14:17:20.0995 3988  Initialize success
14:17:20.0995 3988  ============================================================
14:19:08.0486 3200  ============================================================
14:19:08.0486 3200  Scan started
14:19:08.0486 3200  Mode: Manual; SigCheck; TDLFS;
14:19:08.0486 3200  ============================================================
14:19:09.0036 3200  ================ Scan services =============================
14:19:09.0309 3200  [ B33CF4DE909A5B30F526D82053A63C8E ] ABBYY.Licensing.FineReader.Sprint.9.0 C:\Program Files\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe
14:19:09.0575 3200  ABBYY.Licensing.FineReader.Sprint.9.0 - ok
14:19:10.0044 3200  [ 82B296AE1892FE3DBEE00C9CF92F8AC7 ] ACPI            C:\Windows\system32\drivers\acpi.sys
14:19:10.0079 3200  ACPI - ok
14:19:10.0158 3200  [ D19C4EE2AC7C47B8F5F84FFF1A789D8A ] AdobeARMservice C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
14:19:10.0179 3200  AdobeARMservice - ok
14:19:10.0297 3200  [ 04F0FCAC69C7C71A3AC4EB97FAFC8303 ] adp94xx        C:\Windows\system32\drivers\adp94xx.sys
14:19:10.0359 3200  adp94xx - ok
14:19:10.0391 3200  [ 60505E0041F7751BDBB80F88BF45C2CE ] adpahci        C:\Windows\system32\drivers\adpahci.sys
14:19:10.0423 3200  adpahci - ok
14:19:10.0560 3200  [ 8A42779B02AEC986EAB64ECFC98F8BD7 ] adpu160m        C:\Windows\system32\drivers\adpu160m.sys
14:19:10.0585 3200  adpu160m - ok
14:19:10.0644 3200  [ 241C9E37F8CE45EF51C3DE27515CA4E5 ] adpu320        C:\Windows\system32\drivers\adpu320.sys
14:19:10.0670 3200  adpu320 - ok
14:19:10.0726 3200  [ 9D1FDA9E086BA64E3C93C9DE32461BCF ] AeLookupSvc    C:\Windows\System32\aelupsvc.dll
14:19:10.0852 3200  AeLookupSvc - ok
14:19:10.0969 3200  [ 3911B972B55FEA0478476B2E777B29FA ] AFD            C:\Windows\system32\drivers\afd.sys
14:19:11.0088 3200  AFD - ok
14:19:11.0144 3200  [ 13F9E33747E6B41A3FF305C37DB0D360 ] agp440          C:\Windows\system32\drivers\agp440.sys
14:19:11.0167 3200  agp440 - ok
14:19:11.0241 3200  [ AE1FDF7BF7BB6C6A70F67699D880592A ] aic78xx        C:\Windows\system32\drivers\djsvs.sys
14:19:11.0313 3200  aic78xx - ok
14:19:11.0370 3200  [ A1545B731579895D8CC44FC0481C1192 ] ALG            C:\Windows\System32\alg.exe
14:19:11.0428 3200  ALG - ok
14:19:11.0485 3200  [ 9EAEF5FC9B8E351AFA7E78A6FAE91F91 ] aliide          C:\Windows\system32\drivers\aliide.sys
14:19:11.0551 3200  aliide - ok
14:19:11.0616 3200  [ C47344BC706E5F0B9DCE369516661578 ] amdagp          C:\Windows\system32\drivers\amdagp.sys
14:19:11.0639 3200  amdagp - ok
14:19:11.0671 3200  [ 9B78A39A4C173FDBC1321E0DD659B34C ] amdide          C:\Windows\system32\drivers\amdide.sys
14:19:11.0694 3200  amdide - ok
14:19:11.0723 3200  [ 18F29B49AD23ECEE3D2A826C725C8D48 ] AmdK7          C:\Windows\system32\drivers\amdk7.sys
14:19:11.0789 3200  AmdK7 - ok
14:19:11.0824 3200  [ 93AE7F7DD54AB986A6F1A1B37BE7442D ] AmdK8          C:\Windows\system32\drivers\amdk8.sys
14:19:11.0886 3200  AmdK8 - ok
14:19:12.0023 3200  [ 466A0D95960DAD3222C896D2CEA99993 ] AntiVirSchedulerService C:\Program Files\Avira\AntiVir Desktop\sched.exe
14:19:12.0045 3200  AntiVirSchedulerService - ok
14:19:12.0075 3200  [ A489BE6BB0AA1FF406B488B60542314B ] AntiVirService  C:\Program Files\Avira\AntiVir Desktop\avguard.exe
14:19:12.0094 3200  AntiVirService - ok
14:19:12.0138 3200  [ C6D704C7F0434DC791AAC37CAC4B6E14 ] Appinfo        C:\Windows\System32\appinfo.dll
14:19:12.0228 3200  Appinfo - ok
14:19:12.0305 3200  [ 5D2888182FB46632511ACEE92FDAD522 ] arc            C:\Windows\system32\drivers\arc.sys
14:19:12.0381 3200  arc - ok
14:19:12.0425 3200  [ 5E2A321BD7C8B3624E41FDEC3E244945 ] arcsas          C:\Windows\system32\drivers\arcsas.sys
14:19:12.0448 3200  arcsas - ok
14:19:12.0513 3200  [ 53B202ABEE6455406254444303E87BE1 ] AsyncMac        C:\Windows\system32\DRIVERS\asyncmac.sys
14:19:12.0585 3200  AsyncMac - ok
14:19:12.0671 3200  [ 0D83C87A801A3DFCD1BF73893FE7518C ] atapi          C:\Windows\system32\drivers\atapi.sys
14:19:12.0747 3200  atapi - ok
14:19:12.0873 3200  [ 2846F5EE802889D500FCF5CC48B28381 ] athr            C:\Windows\system32\DRIVERS\athr.sys
14:19:13.0016 3200  athr - ok
14:19:13.0112 3200  [ 68E2A1A0407A66CF50DA0300852424AB ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
14:19:13.0198 3200  AudioEndpointBuilder - ok
14:19:13.0336 3200  [ 68E2A1A0407A66CF50DA0300852424AB ] Audiosrv        C:\Windows\System32\Audiosrv.dll
14:19:13.0374 3200  Audiosrv - ok
14:19:13.0404 3200  [ D5541F0AFB767E85FC412FC609D96A74 ] avgntflt        C:\Windows\system32\DRIVERS\avgntflt.sys
14:19:13.0438 3200  avgntflt - ok
14:19:13.0598 3200  [ 7D967A682D4694DF7FA57D63A2DB01FE ] avipbb          C:\Windows\system32\DRIVERS\avipbb.sys
14:19:13.0614 3200  avipbb - ok
14:19:13.0653 3200  [ 53E56450DA16A1A7F0D002F511113F67 ] avkmgr          C:\Windows\system32\DRIVERS\avkmgr.sys
14:19:13.0667 3200  avkmgr - ok
14:19:13.0715 3200  [ 7B9FFD0BD8C782D46860DCB754AADFDA ] AX88772        C:\Windows\system32\DRIVERS\ax88772.sys
14:19:13.0784 3200  AX88772 - ok
14:19:13.0843 3200  [ 67E506B75BD5326A3EC7B70BD014DFB6 ] Beep            C:\Windows\system32\drivers\Beep.sys
14:19:13.0941 3200  Beep - ok
14:19:13.0998 3200  [ C789AF0F724FDA5852FB9A7D3A432381 ] BFE            C:\Windows\System32\bfe.dll
14:19:14.0044 3200  BFE - ok
14:19:14.0218 3200  [ 93952506C6D67330367F7E7934B6A02F ] BITS            C:\Windows\System32\qmgr.dll
14:19:14.0295 3200  BITS - ok
14:19:14.0337 3200  [ D4DF28447741FD3D953526E33A617397 ] blbdrive        C:\Windows\system32\drivers\blbdrive.sys
14:19:14.0415 3200  blbdrive - ok
14:19:14.0517 3200  [ 35F376253F687BDE63976CCB3F2108CA ] bowser          C:\Windows\system32\DRIVERS\bowser.sys
14:19:14.0614 3200  bowser - ok
14:19:14.0669 3200  [ 9F9ACC7F7CCDE8A15C282D3F88B43309 ] BrFiltLo        C:\Windows\system32\drivers\brfiltlo.sys
14:19:14.0708 3200  BrFiltLo - ok
14:19:14.0727 3200  [ 56801AD62213A41F6497F96DEE83755A ] BrFiltUp        C:\Windows\system32\drivers\brfiltup.sys
14:19:14.0830 3200  BrFiltUp - ok
14:19:14.0866 3200  [ A3629A0C4226F9E9C72FAAEEBC3AD33C ] Browser        C:\Windows\System32\browser.dll
14:19:14.0943 3200  Browser - ok
14:19:14.0985 3200  [ B304E75CFF293029EDDF094246747113 ] Brserid        C:\Windows\system32\drivers\brserid.sys
14:19:15.0082 3200  Brserid - ok
14:19:15.0163 3200  [ 203F0B1E73ADADBBB7B7B1FABD901F6B ] BrSerWdm        C:\Windows\system32\drivers\brserwdm.sys
14:19:15.0240 3200  BrSerWdm - ok
14:19:15.0377 3200  [ BD456606156BA17E60A04E18016AE54B ] BrUsbMdm        C:\Windows\system32\drivers\brusbmdm.sys
14:19:15.0455 3200  BrUsbMdm - ok
14:19:15.0565 3200  [ AF72ED54503F717A43268B3CC5FAEC2E ] BrUsbSer        C:\Windows\system32\drivers\brusbser.sys
14:19:15.0716 3200  BrUsbSer - ok
14:19:15.0818 3200  [ AD07C1EC6665B8B35741AB91200C6B68 ] BTHMODEM        C:\Windows\system32\drivers\bthmodem.sys
14:19:15.0911 3200  BTHMODEM - ok
14:19:15.0971 3200  [ 7ADD03E75BEB9E6DD102C3081D29840A ] cdfs            C:\Windows\system32\DRIVERS\cdfs.sys
14:19:16.0012 3200  cdfs - ok
14:19:16.0047 3200  [ 6B4BFFB9BECD728097024276430DB314 ] cdrom          C:\Windows\system32\DRIVERS\cdrom.sys
14:19:16.0081 3200  cdrom - ok
14:19:16.0129 3200  [ 312EC3E37A0A1F2006534913E37B4423 ] CertPropSvc    C:\Windows\System32\certprop.dll
14:19:16.0164 3200  CertPropSvc - ok
14:19:16.0193 3200  [ E5D4133F37219DBCFE102BC61072589D ] circlass        C:\Windows\system32\drivers\circlass.sys
14:19:16.0266 3200  circlass - ok
14:19:16.0412 3200  [ D7659D3B5B92C31E84E53C1431F35132 ] CLFS            C:\Windows\system32\CLFS.sys
14:19:16.0436 3200  CLFS - ok
14:19:16.0667 3200  [ 8EE772032E2FE80A924F3B8DD5082194 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
14:19:16.0689 3200  clr_optimization_v2.0.50727_32 - ok
14:19:16.0835 3200  [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
14:19:16.0909 3200  clr_optimization_v4.0.30319_32 - ok
14:19:16.0970 3200  [ 99AFC3795B58CC478FBBBCDC658FCB56 ] CmBatt          C:\Windows\system32\DRIVERS\CmBatt.sys
14:19:17.0023 3200  CmBatt - ok
14:19:17.0164 3200  [ 0CA25E686A4928484E9FDABD168AB629 ] cmdide          C:\Windows\system32\drivers\cmdide.sys
14:19:17.0220 3200  cmdide - ok
14:19:17.0249 3200  [ 6AFEF0B60FA25DE07C0968983EE4F60A ] Compbatt        C:\Windows\system32\DRIVERS\compbatt.sys
14:19:17.0271 3200  Compbatt - ok
14:19:17.0281 3200  COMSysApp - ok
14:19:17.0314 3200  [ 741E9DFF4F42D2D8477D0FC1DC0DF871 ] crcdisk        C:\Windows\system32\drivers\crcdisk.sys
14:19:17.0335 3200  crcdisk - ok
14:19:17.0363 3200  [ 1F07BECDCA750766A96CDA811BA86410 ] Crusoe          C:\Windows\system32\drivers\crusoe.sys
14:19:17.0441 3200  Crusoe - ok
14:19:17.0493 3200  [ 75C6A297E364014840B48ECCD7525E30 ] CryptSvc        C:\Windows\system32\cryptsvc.dll
14:19:17.0571 3200  CryptSvc - ok
14:19:17.0628 3200  [ 3B5B4D53FEC14F7476CA29A20CC31AC9 ] DcomLaunch      C:\Windows\system32\rpcss.dll
14:19:17.0733 3200  DcomLaunch - ok
14:19:17.0854 3200  [ 622C41A07CA7E6DD91770F50D532CB6C ] DfsC            C:\Windows\system32\Drivers\dfsc.sys
14:19:17.0901 3200  DfsC - ok
14:19:18.0156 3200  [ 2CC3DCFB533A1035B13DCAB6160AB38B ] DFSR            C:\Windows\system32\DFSR.exe
14:19:18.0313 3200  DFSR - ok
14:19:18.0373 3200  [ 9028559C132146FB75EB7ACF384B086A ] Dhcp            C:\Windows\System32\dhcpcsvc.dll
14:19:18.0422 3200  Dhcp - ok
14:19:18.0470 3200  [ 5D4AEFC3386920236A548271F8F1AF6A ] disk            C:\Windows\system32\drivers\disk.sys
14:19:18.0493 3200  disk - ok
14:19:18.0536 3200  [ 57D762F6F5974AF0DA2BE88A3349BAAA ] Dnscache        C:\Windows\System32\dnsrslvr.dll
14:19:18.0591 3200  Dnscache - ok
14:19:18.0620 3200  [ 324FD74686B1EF5E7C19A8AF49E748F6 ] dot3svc        C:\Windows\System32\dot3svc.dll
14:19:18.0717 3200  dot3svc - ok
14:19:18.0815 3200  [ A622E888F8AA2F6B49E9BC466F0E5DEF ] DPS            C:\Windows\system32\dps.dll
14:19:18.0886 3200  DPS - ok
14:19:18.0945 3200  [ 97FEF831AB90BEE128C9AF390E243F80 ] drmkaud        C:\Windows\system32\drivers\drmkaud.sys
14:19:19.0033 3200  drmkaud - ok
14:19:19.0178 3200  [ C68AC676B0EF30CFBB1080ADCE49EB1F ] DXGKrnl        C:\Windows\System32\drivers\dxgkrnl.sys
14:19:19.0233 3200  DXGKrnl - ok
14:19:19.0313 3200  [ 5425F74AC0C1DBD96A1E04F17D63F94C ] E1G60          C:\Windows\system32\DRIVERS\E1G60I32.sys
14:19:19.0416 3200  E1G60 - ok
14:19:19.0462 3200  [ C0B95E40D85CD807D614E264248A45B9 ] EapHost        C:\Windows\System32\eapsvc.dll
14:19:19.0516 3200  EapHost - ok
14:19:19.0569 3200  [ 7F64EA048DCFAC7ACF8B4D7B4E6FE371 ] Ecache          C:\Windows\system32\drivers\ecache.sys
14:19:19.0595 3200  Ecache - ok
14:19:19.0784 3200  [ 9BE3744D295A7701EB425332014F0797 ] ehRecvr        C:\Windows\ehome\ehRecvr.exe
14:19:19.0992 3200  ehRecvr - ok
14:19:20.0144 3200  [ AD1870C8E5D6DD340C829E6074BF3C3F ] ehSched        C:\Windows\ehome\ehsched.exe
14:19:20.0259 3200  ehSched - ok
14:19:20.0300 3200  [ C27C4EE8926E74AA72EFCAB24C5242C3 ] ehstart        C:\Windows\ehome\ehstart.dll
14:19:20.0375 3200  ehstart - ok
14:19:20.0436 3200  [ 23B62471681A124889978F6295B3F4C6 ] elxstor        C:\Windows\system32\drivers\elxstor.sys
14:19:20.0471 3200  elxstor - ok
14:19:20.0588 3200  [ 4E6B23DFC917EA39306B529B773950F4 ] EMDMgmt        C:\Windows\system32\emdmgmt.dll
14:19:20.0733 3200  EMDMgmt - ok
14:19:20.0758 3200  [ 3DB974F3935483555D7148663F726C61 ] ErrDev          C:\Windows\system32\drivers\errdev.sys
14:19:20.0823 3200  ErrDev - ok
14:19:21.0056 3200  [ 67058C46504BC12D821F38CF99B7B28F ] EventSystem    C:\Windows\system32\es.dll
14:19:21.0175 3200  EventSystem - ok
14:19:21.0276 3200  [ 22B408651F9123527BCEE54B4F6C5CAE ] exfat          C:\Windows\system32\drivers\exfat.sys
14:19:21.0365 3200  exfat - ok
14:19:21.0559 3200  [ 1E9B9A70D332103C52995E957DC09EF8 ] fastfat        C:\Windows\system32\drivers\fastfat.sys
14:19:21.0619 3200  fastfat - ok
14:19:21.0702 3200  [ AFE1E8B9782A0DD7FB46BBD88E43F89A ] fdc            C:\Windows\system32\DRIVERS\fdc.sys
14:19:21.0766 3200  fdc - ok
14:19:21.0818 3200  [ 6629B5F0E98151F4AFDD87567EA32BA3 ] fdPHost        C:\Windows\system32\fdPHost.dll
14:19:21.0860 3200  fdPHost - ok
14:19:21.0943 3200  [ 89ED56DCE8E47AF40892778A5BD31FD2 ] FDResPub        C:\Windows\system32\fdrespub.dll
14:19:22.0092 3200  FDResPub - ok
14:19:22.0143 3200  [ A8C0139A884861E3AAE9CFE73B208A9F ] FileInfo        C:\Windows\system32\drivers\fileinfo.sys
14:19:22.0197 3200  FileInfo - ok
14:19:22.0220 3200  [ 0AE429A696AECBC5970E3CF2C62635AE ] Filetrace      C:\Windows\system32\drivers\filetrace.sys
14:19:22.0279 3200  Filetrace - ok
14:19:22.0395 3200  [ 85B7CF99D532820495D68D747FDA9EBD ] flpydisk        C:\Windows\system32\DRIVERS\flpydisk.sys
14:19:22.0480 3200  flpydisk - ok
14:19:22.0588 3200  [ 01334F9EA68E6877C4EF05D3EA8ABB05 ] FltMgr          C:\Windows\system32\drivers\fltmgr.sys
14:19:22.0616 3200  FltMgr - ok
14:19:22.0712 3200  [ 8CE364388C8ECA59B14B539179276D44 ] FontCache      C:\Windows\system32\FntCache.dll
14:19:22.0852 3200  FontCache - ok
14:19:23.0122 3200  [ C7FBDD1ED42F82BFA35167A5C9803EA3 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
14:19:23.0174 3200  FontCache3.0.0.0 - ok
14:19:23.0256 3200  [ D909075FA72C090F27AA926C32CB4612 ] fssfltr        C:\Windows\system32\DRIVERS\fssfltr.sys
14:19:23.0276 3200  fssfltr - ok
14:19:23.0493 3200  [ 4CE9DAC1518FF7E77BD213E6394B9D77 ] fsssvc          C:\Program Files\Windows Live\Family Safety\fsssvc.exe
14:19:23.0638 3200  fsssvc - ok
14:19:23.0714 3200  [ B972A66758577E0BFD1DE0F91AAA27B5 ] Fs_Rec          C:\Windows\system32\drivers\Fs_Rec.sys
14:19:23.0825 3200  Fs_Rec - ok
14:19:23.0913 3200  [ 34582A6E6573D54A07ECE5FE24A126B5 ] gagp30kx        C:\Windows\system32\drivers\gagp30kx.sys
14:19:23.0979 3200  gagp30kx - ok
14:19:24.0201 3200  [ CD5D0AEEE35DFD4E986A5AA1500A6E66 ] gpsvc          C:\Windows\System32\gpsvc.dll
14:19:24.0271 3200  gpsvc - ok
14:19:24.0432 3200  [ 8F0DE4FEF8201E306F9938B0905AC96A ] gupdate        C:\Program Files\Google\Update\GoogleUpdate.exe
14:19:24.0450 3200  gupdate - ok
14:19:24.0520 3200  [ 8F0DE4FEF8201E306F9938B0905AC96A ] gupdatem        C:\Program Files\Google\Update\GoogleUpdate.exe
14:19:24.0537 3200  gupdatem - ok
14:19:24.0630 3200  [ CC839E8D766CC31A7710C9F38CF3E375 ] gusvc          C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
14:19:24.0652 3200  gusvc - ok
14:19:24.0763 3200  [ CB04C744BE0A61B1D648FAED182C3B59 ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys
14:19:24.0860 3200  HdAudAddService - ok
14:19:25.0096 3200  [ 062452B7FFD68C8C042A6261FE8DFF4A ] HDAudBus        C:\Windows\system32\DRIVERS\HDAudBus.sys
14:19:25.0244 3200  HDAudBus - ok
14:19:25.0318 3200  [ 1338520E78D90154ED6BE8F84DE5FCEB ] HidBth          C:\Windows\system32\drivers\hidbth.sys
14:19:25.0469 3200  HidBth - ok
14:19:25.0605 3200  [ FF3160C3A2445128C5A6D9B076DA519E ] HidIr          C:\Windows\system32\drivers\hidir.sys
14:19:25.0713 3200  HidIr - ok
14:19:25.0841 3200  [ 84067081F3318162797385E11A8F0582 ] hidserv        C:\Windows\system32\hidserv.dll
14:19:25.0895 3200  hidserv - ok
14:19:25.0958 3200  [ CCA4B519B17E23A00B826C55716809CC ] HidUsb          C:\Windows\system32\DRIVERS\hidusb.sys
14:19:26.0061 3200  HidUsb - ok
14:19:26.0156 3200  [ D8AD255B37DA92434C26E4876DB7D418 ] hkmsvc          C:\Windows\system32\kmsvc.dll
14:19:26.0211 3200  hkmsvc - ok
14:19:26.0331 3200  [ 16EE7B23A009E00D835CDB79574A91A6 ] HpCISSs        C:\Windows\system32\drivers\hpcisss.sys
14:19:26.0355 3200  HpCISSs - ok
14:19:26.0395 3200  [ F870AA3E254628EBEAFE754108D664DE ] HTTP            C:\Windows\system32\drivers\HTTP.sys
14:19:26.0500 3200  HTTP - ok
14:19:26.0538 3200  [ C6B032D69650985468160FC9937CF5B4 ] i2omp          C:\Windows\system32\drivers\i2omp.sys
14:19:26.0561 3200  i2omp - ok
14:19:26.0627 3200  [ 22D56C8184586B7A1F6FA60BE5F5A2BD ] i8042prt        C:\Windows\system32\DRIVERS\i8042prt.sys
14:19:26.0677 3200  i8042prt - ok
14:19:26.0772 3200  [ 54155EA1B0DF185878E0FC9EC3AC3A14 ] iaStorV        C:\Windows\system32\drivers\iastorv.sys
14:19:26.0800 3200  iaStorV - ok
14:19:26.0997 3200  [ 98477B08E61945F974ED9FDC4CB6BDAB ] idsvc          C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
14:19:27.0111 3200  idsvc - ok
14:19:27.0143 3200  [ 2D077BF86E843F901D8DB709C95B49A5 ] iirsp          C:\Windows\system32\drivers\iirsp.sys
14:19:27.0163 3200  iirsp - ok
14:19:27.0316 3200  [ 9908D8A397B76CD8D31D0D383C5773C9 ] IKEEXT          C:\Windows\System32\ikeext.dll
14:19:27.0392 3200  IKEEXT - ok
14:19:27.0625 3200  [ B8716D9677B04B82FA405C8C54954728 ] IntcAzAudAddService C:\Windows\system32\drivers\RTKVHDA.sys
14:19:27.0797 3200  IntcAzAudAddService - ok
14:19:27.0914 3200  [ 83AA759F3189E6370C30DE5DC5590718 ] intelide        C:\Windows\system32\drivers\intelide.sys
14:19:27.0964 3200  intelide - ok
14:19:28.0006 3200  [ 224191001E78C89DFA78924C3EA595FF ] intelppm        C:\Windows\system32\DRIVERS\intelppm.sys
14:19:28.0062 3200  intelppm - ok
14:19:28.0159 3200  [ 9AC218C6E6105477484C6FDBE7D409A4 ] IPBusEnum      C:\Windows\system32\ipbusenum.dll
14:19:28.0290 3200  IPBusEnum - ok
14:19:28.0331 3200  [ 62C265C38769B864CB25B4BCF62DF6C3 ] IpFilterDriver  C:\Windows\system32\DRIVERS\ipfltdrv.sys
14:19:28.0444 3200  IpFilterDriver - ok
14:19:28.0571 3200  [ 1998BD97F950680BB55F55A7244679C2 ] iphlpsvc        C:\Windows\System32\iphlpsvc.dll
14:19:28.0624 3200  iphlpsvc - ok
14:19:28.0632 3200  IpInIp - ok
14:19:28.0727 3200  [ B25AAF203552B7B3491139D582B39AD1 ] IPMIDRV        C:\Windows\system32\drivers\ipmidrv.sys
14:19:28.0792 3200  IPMIDRV - ok
14:19:28.0827 3200  [ 8793643A67B42CEC66490B2A0CF92D68 ] IPNAT          C:\Windows\system32\DRIVERS\ipnat.sys
14:19:28.0875 3200  IPNAT - ok
14:19:28.0901 3200  [ 109C0DFB82C3632FBD11949B73AEEAC9 ] IRENUM          C:\Windows\system32\drivers\irenum.sys
14:19:28.0975 3200  IRENUM - ok
14:19:29.0027 3200  [ 6C70698A3E5C4376C6AB5C7C17FB0614 ] isapnp          C:\Windows\system32\drivers\isapnp.sys
14:19:29.0079 3200  isapnp - ok
14:19:29.0144 3200  [ 232FA340531D940AAC623B121A595034 ] iScsiPrt        C:\Windows\system32\DRIVERS\msiscsi.sys
14:19:29.0170 3200  iScsiPrt - ok
14:19:29.0205 3200  [ BCED60D16156E428F8DF8CF27B0DF150 ] iteatapi        C:\Windows\system32\drivers\iteatapi.sys
14:19:29.0255 3200  iteatapi - ok
14:19:29.0287 3200  [ 06FA654504A498C30ADCA8BEC4E87E7E ] iteraid        C:\Windows\system32\drivers\iteraid.sys
14:19:29.0308 3200  iteraid - ok
14:19:29.0337 3200  [ 37605E0A8CF00CBBA538E753E4344C6E ] kbdclass        C:\Windows\system32\DRIVERS\kbdclass.sys
14:19:29.0359 3200  kbdclass - ok
14:19:29.0395 3200  [ EDE59EC70E25C24581ADD1FBEC7325F7 ] kbdhid          C:\Windows\system32\DRIVERS\kbdhid.sys
14:19:29.0475 3200  kbdhid - ok
14:19:29.0591 3200  [ A3E186B4B935905B829219502557314E ] KeyIso          C:\Windows\system32\lsass.exe
14:19:29.0646 3200  KeyIso - ok
14:19:29.0823 3200  [ 4A1445EFA932A3BAF5BDB02D7131EE20 ] KSecDD          C:\Windows\system32\Drivers\ksecdd.sys
14:19:29.0862 3200  KSecDD - ok
14:19:30.0030 3200  [ 8078F8F8F7A79E2E6B494523A828C585 ] KtmRm          C:\Windows\system32\msdtckrm.dll
14:19:30.0127 3200  KtmRm - ok
14:19:30.0264 3200  [ 1BF5EEBFD518DD7298434D8C862F825D ] LanmanServer    C:\Windows\system32\srvsvc.dll
14:19:30.0351 3200  LanmanServer - ok
14:19:30.0396 3200  [ 1DB69705B695B987082C8BAEC0C6B34F ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
14:19:30.0463 3200  LanmanWorkstation - ok
14:19:30.0498 3200  [ D1C5883087A0C3F1344D9D55A44901F6 ] lltdio          C:\Windows\system32\DRIVERS\lltdio.sys
14:19:30.0608 3200  lltdio - ok
14:19:30.0685 3200  [ 2D5A428872F1442631D0959A34ABFF63 ] lltdsvc        C:\Windows\System32\lltdsvc.dll
14:19:30.0745 3200  lltdsvc - ok
14:19:30.0842 3200  [ 35D40113E4A5B961B6CE5C5857702518 ] lmhosts        C:\Windows\System32\lmhsvc.dll
14:19:30.0934 3200  lmhosts - ok
14:19:30.0995 3200  [ C7E15E82879BF3235B559563D4185365 ] LSI_FC          C:\Windows\system32\drivers\lsi_fc.sys
14:19:31.0019 3200  LSI_FC - ok
14:19:31.0098 3200  [ EE01EBAE8C9BF0FA072E0FF68718920A ] LSI_SAS        C:\Windows\system32\drivers\lsi_sas.sys
14:19:31.0121 3200  LSI_SAS - ok
14:19:31.0177 3200  [ 912A04696E9CA30146A62AFA1463DD5C ] LSI_SCSI        C:\Windows\system32\drivers\lsi_scsi.sys
14:19:31.0200 3200  LSI_SCSI - ok
14:19:31.0225 3200  [ 8F5C7426567798E62A3B3614965D62CC ] luafv          C:\Windows\system32\drivers\luafv.sys
14:19:31.0314 3200  luafv - ok
14:19:31.0402 3200  [ 6DFE7F2E8E8A337263AA5C92A215F161 ] MBAMProtector  C:\Windows\system32\drivers\mbam.sys
14:19:31.0426 3200  MBAMProtector - ok
14:19:31.0597 3200  [ 43683E970F008C93C9429EF428147A54 ] MBAMService    C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
14:19:31.0648 3200  MBAMService - ok
14:19:31.0808 3200  [ AEF9BABB8A506BC4CE0451A64AADED46 ] Mcx2Svc        C:\Windows\system32\Mcx2Svc.dll
14:19:31.0854 3200  Mcx2Svc - ok
14:19:31.0941 3200  [ 0001CE609D66632FA17B84705F658879 ] megasas        C:\Windows\system32\drivers\megasas.sys
14:19:31.0978 3200  megasas - ok
14:19:32.0005 3200  [ C252F32CD9A49DBFC25ECF26EBD51A99 ] MegaSR          C:\Windows\system32\drivers\megasr.sys
14:19:32.0056 3200  MegaSR - ok
14:19:32.0100 3200  [ 1076FFCFFAAE8385FD62DFCB25AC4708 ] MMCSS          C:\Windows\system32\mmcss.dll
14:19:32.0201 3200  MMCSS - ok
14:19:32.0258 3200  [ E13B5EA0F51BA5B1512EC671393D09BA ] Modem          C:\Windows\system32\drivers\modem.sys
14:19:32.0359 3200  Modem - ok
14:19:32.0386 3200  [ 0A9BB33B56E294F686ABB7C1E4E2D8A8 ] monitor        C:\Windows\system32\DRIVERS\monitor.sys
14:19:32.0429 3200  monitor - ok
14:19:32.0488 3200  [ 5BF6A1326A335C5298477754A506D263 ] mouclass        C:\Windows\system32\DRIVERS\mouclass.sys
14:19:32.0541 3200  mouclass - ok
14:19:32.0577 3200  [ 93B8D4869E12CFBE663915502900876F ] mouhid          C:\Windows\system32\DRIVERS\mouhid.sys
14:19:32.0665 3200  mouhid - ok
14:19:32.0694 3200  [ BDAFC88AA6B92F7842416EA6A48E1600 ] MountMgr        C:\Windows\system32\drivers\mountmgr.sys
14:19:32.0754 3200  MountMgr - ok
14:19:32.0825 3200  [ 511D011289755DD9F9A7579FB0B064E6 ] mpio            C:\Windows\system32\drivers\mpio.sys
14:19:32.0849 3200  mpio - ok
14:19:32.0877 3200  [ 22241FEBA9B2DEFA669C8CB0A8DD7D2E ] mpsdrv          C:\Windows\system32\drivers\mpsdrv.sys
14:19:32.0971 3200  mpsdrv - ok
14:19:33.0074 3200  [ 5DE62C6E9108F14F6794060A9BDECAEC ] MpsSvc          C:\Windows\system32\mpssvc.dll
14:19:33.0160 3200  MpsSvc - ok
14:19:33.0215 3200  [ 4FBBB70D30FD20EC51F80061703B001E ] Mraid35x        C:\Windows\system32\drivers\mraid35x.sys
14:19:33.0235 3200  Mraid35x - ok
14:19:33.0292 3200  [ 82CEA0395524AACFEB58BA1448E8325C ] MRxDAV          C:\Windows\system32\drivers\mrxdav.sys
14:19:33.0329 3200  MRxDAV - ok
14:19:33.0355 3200  [ 1E94971C4B446AB2290DEB71D01CF0C2 ] mrxsmb          C:\Windows\system32\DRIVERS\mrxsmb.sys
14:19:33.0409 3200  mrxsmb - ok
14:19:33.0469 3200  [ 4FCCB34D793B116423209C0F8B7A3B03 ] mrxsmb10        C:\Windows\system32\DRIVERS\mrxsmb10.sys
14:19:33.0516 3200  mrxsmb10 - ok
14:19:33.0549 3200  [ C3CB1B40AD4A0124D617A1199B0B9D7C ] mrxsmb20        C:\Windows\system32\DRIVERS\mrxsmb20.sys
14:19:33.0662 3200  mrxsmb20 - ok
14:19:33.0700 3200  [ F70590424EEFBF5C27A40C67AFDB8383 ] msahci          C:\Windows\system32\drivers\msahci.sys
14:19:33.0744 3200  msahci - ok
14:19:33.0814 3200  [ 4468B0F385A86ECDDAF8D3CA662EC0E7 ] msdsm          C:\Windows\system32\drivers\msdsm.sys
14:19:33.0867 3200  msdsm - ok
14:19:33.0902 3200  [ FD7520CC3A80C5FC8C48852BB24C6DED ] MSDTC          C:\Windows\System32\msdtc.exe
14:19:34.0004 3200  MSDTC - ok
14:19:34.0050 3200  [ A9927F4A46B816C92F461ACB90CF8515 ] Msfs            C:\Windows\system32\drivers\Msfs.sys
14:19:34.0111 3200  Msfs - ok
14:19:34.0200 3200  [ 0F400E306F385C56317357D6DEA56F62 ] msisadrv        C:\Windows\system32\drivers\msisadrv.sys
14:19:34.0222 3200  msisadrv - ok
14:19:34.0289 3200  [ 85466C0757A23D9A9AECDC0755203CB2 ] MSiSCSI        C:\Windows\system32\iscsiexe.dll
14:19:34.0356 3200  MSiSCSI - ok
14:19:34.0363 3200  msiserver - ok
14:19:34.0449 3200  [ D8C63D34D9C9E56C059E24EC7185CC07 ] MSKSSRV        C:\Windows\system32\drivers\MSKSSRV.sys
14:19:34.0506 3200  MSKSSRV - ok
14:19:34.0583 3200  [ 1D373C90D62DDB641D50E55B9E78D65E ] MSPCLOCK        C:\Windows\system32\drivers\MSPCLOCK.sys
14:19:34.0624 3200  MSPCLOCK - ok
14:19:34.0650 3200  [ B572DA05BF4E098D4BBA3A4734FB505B ] MSPQM          C:\Windows\system32\drivers\MSPQM.sys
14:19:34.0719 3200  MSPQM - ok
14:19:34.0845 3200  [ B49456D70555DE905C311BCDA6EC6ADB ] MsRPC          C:\Windows\system32\drivers\MsRPC.sys
14:19:34.0873 3200  MsRPC - ok
14:19:34.0963 3200  [ E384487CB84BE41D09711C30CA79646C ] mssmbios        C:\Windows\system32\DRIVERS\mssmbios.sys
14:19:34.0985 3200  mssmbios - ok
14:19:35.0030 3200  [ 7199C1EEC1E4993CAF96B8C0A26BD58A ] MSTEE          C:\Windows\system32\drivers\MSTEE.sys
14:19:35.0072 3200  MSTEE - ok
14:19:35.0182 3200  [ 6A57B5733D4CB702C8EA4542E836B96C ] Mup            C:\Windows\system32\Drivers\mup.sys
14:19:35.0206 3200  Mup - ok
14:19:35.0324 3200  [ E4EAF0C5C1B41B5C83386CF212CA9584 ] napagent        C:\Windows\system32\qagentRT.dll
14:19:35.0397 3200  napagent - ok
14:19:35.0498 3200  [ 85C44FDFF9CF7E72A40DCB7EC06A4416 ] NativeWifiP    C:\Windows\system32\DRIVERS\nwifi.sys
14:19:35.0526 3200  NativeWifiP - ok
14:19:35.0604 3200  [ 1357274D1883F68300AEADD15D7BBB42 ] NDIS            C:\Windows\system32\drivers\ndis.sys
14:19:35.0642 3200  NDIS - ok
14:19:35.0763 3200  [ 0E186E90404980569FB449BA7519AE61 ] NdisTapi        C:\Windows\system32\DRIVERS\ndistapi.sys
14:19:35.0806 3200  NdisTapi - ok
14:19:35.0882 3200  [ D6973AA34C4D5D76C0430B181C3CD389 ] Ndisuio        C:\Windows\system32\DRIVERS\ndisuio.sys
14:19:35.0959 3200  Ndisuio - ok
14:19:36.0017 3200  [ 818F648618AE34F729FDB47EC68345C3 ] NdisWan        C:\Windows\system32\DRIVERS\ndiswan.sys
14:19:36.0062 3200  NdisWan - ok
14:19:36.0161 3200  [ 71DAB552B41936358F3B541AE5997FB3 ] NDProxy        C:\Windows\system32\drivers\NDProxy.sys
14:19:36.0194 3200  NDProxy - ok
14:19:36.0410 3200  [ 40D7D0A208EE863BCA8D89E299216F15 ] Nero BackItUp Scheduler 3 C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
14:19:36.0505 3200  Nero BackItUp Scheduler 3 - ok
14:19:36.0528 3200  [ BCD093A5A6777CF626434568DC7DBA78 ] NetBIOS        C:\Windows\system32\DRIVERS\netbios.sys
14:19:36.0649 3200  NetBIOS - ok
14:19:36.0730 3200  [ ECD64230A59CBD93C85F1CD1CAB9F3F6 ] netbt          C:\Windows\system32\DRIVERS\netbt.sys
14:19:36.0783 3200  netbt - ok
14:19:36.0840 3200  [ A3E186B4B935905B829219502557314E ] Netlogon        C:\Windows\system32\lsass.exe
14:19:36.0863 3200  Netlogon - ok
14:19:36.0921 3200  [ C8052711DAECC48B982434C5116CA401 ] Netman          C:\Windows\System32\netman.dll
14:19:37.0031 3200  Netman - ok
14:19:37.0104 3200  [ 2EF3BBE22E5A5ACD1428EE387A0D0172 ] netprofm        C:\Windows\System32\netprofm.dll
14:19:37.0193 3200  netprofm - ok
14:19:37.0290 3200  [ D6C4E4A39A36029AC0813D476FBD0248 ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
14:19:37.0311 3200  NetTcpPortSharing - ok
14:19:37.0390 3200  [ 2E7FB731D4790A1BC6270ACCEFACB36E ] nfrd960        C:\Windows\system32\drivers\nfrd960.sys
14:19:37.0434 3200  nfrd960 - ok
14:19:37.0503 3200  [ 2997B15415F9BBE05B5A4C1C85E0C6A2 ] NlaSvc          C:\Windows\System32\nlasvc.dll
14:19:37.0570 3200  NlaSvc - ok
14:19:37.0718 3200  [ EBA1B4BF2E2375ABDADEDB649F283541 ] NMIndexingService C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
14:19:37.0805 3200  NMIndexingService - ok
14:19:37.0918 3200  [ D36F239D7CCE1931598E8FB90A0DBC26 ] Npfs            C:\Windows\system32\drivers\Npfs.sys
14:19:37.0952 3200  Npfs - ok
14:19:38.0070 3200  [ 8BB86F0C7EEA2BDED6FE095D0B4CA9BD ] nsi            C:\Windows\system32\nsisvc.dll
14:19:38.0165 3200  nsi - ok
14:19:38.0266 3200  [ 609773E344A97410CE4EBF74A8914FCF ] nsiproxy        C:\Windows\system32\drivers\nsiproxy.sys
14:19:38.0363 3200  nsiproxy - ok
14:19:38.0493 3200  [ 6A4A98CEE84CF9E99564510DDA4BAA47 ] Ntfs            C:\Windows\system32\drivers\Ntfs.sys
14:19:38.0607 3200  Ntfs - ok
14:19:38.0630 3200  [ E875C093AEC0C978A90F30C9E0DFBB72 ] ntrigdigi      C:\Windows\system32\drivers\ntrigdigi.sys
14:19:38.0761 3200  ntrigdigi - ok
14:19:38.0802 3200  [ C5DBBCDA07D780BDA9B685DF333BB41E ] Null            C:\Windows\system32\drivers\Null.sys
14:19:38.0891 3200  Null - ok
14:19:38.0977 3200  [ 1EFEC38A852AB35883BFFF3427B92B3F ] NVENETFD        C:\Windows\system32\DRIVERS\nvmfdx32.sys
14:19:39.0006 3200  NVENETFD - ok
14:19:39.0066 3200  [ FAA22E6256D9FA2C7F77B67C68CDD749 ] NVHDA          C:\Windows\system32\drivers\nvhda32v.sys
14:19:39.0086 3200  NVHDA - ok
14:19:39.0750 3200  [ CD10CF6C0200A6FE2F9ED9747BA123A1 ] nvlddmkm        C:\Windows\system32\DRIVERS\nvlddmkm.sys
14:19:40.0306 3200  nvlddmkm - ok
14:19:40.0355 3200  [ 1EFEC38A852AB35883BFFF3427B92B3F ] NVNET          C:\Windows\system32\DRIVERS\nvmfdx32.sys
14:19:40.0381 3200  NVNET - ok
14:19:40.0431 3200  [ 2EDF9E7751554B42CBB60116DE727101 ] nvraid          C:\Windows\system32\drivers\nvraid.sys
14:19:40.0455 3200  nvraid - ok
14:19:40.0515 3200  [ AF1BD777AF00E96C45C77192D7453369 ] nvsmu          C:\Windows\system32\DRIVERS\nvsmu.sys
14:19:40.0568 3200  nvsmu - ok
14:19:40.0601 3200  [ ABED0C09758D1D97DB0042DBB2688177 ] nvstor          C:\Windows\system32\drivers\nvstor.sys
14:19:40.0624 3200  nvstor - ok
14:19:40.0658 3200  [ 8EE374B6FB3CB2BB8D70395218B464A5 ] nvstor32        C:\Windows\system32\DRIVERS\nvstor32.sys
14:19:40.0679 3200  nvstor32 - ok
14:19:40.0791 3200  [ 452CE52EF0E2AA7466A2BA0D989184B2 ] nvsvc          C:\Windows\system32\nvvsvc.exe
14:19:40.0818 3200  nvsvc - ok
14:19:40.0867 3200  [ 18BBDF913916B71BD54575BDB6EEAC0B ] nv_agp          C:\Windows\system32\drivers\nv_agp.sys
14:19:40.0892 3200  nv_agp - ok
14:19:40.0909 3200  NwlnkFlt - ok
14:19:40.0919 3200  NwlnkFwd - ok
14:19:41.0067 3200  [ 35EBE490C993F39091CE7BF89E725B0C ] NxpCap          C:\Windows\system32\DRIVERS\NxpCap.sys
14:19:41.0213 3200  NxpCap - ok
14:19:41.0272 3200  [ BE32DA025A0BE1878F0EE8D6D9386CD5 ] ohci1394        C:\Windows\system32\drivers\ohci1394.sys
14:19:41.0367 3200  ohci1394 - ok
14:19:41.0430 3200  [ 0C8E8E61AD1EB0B250B846712C917506 ] p2pimsvc        C:\Windows\system32\p2psvc.dll
14:19:41.0541 3200  p2pimsvc - ok
14:19:41.0559 3200  [ 0C8E8E61AD1EB0B250B846712C917506 ] p2psvc          C:\Windows\system32\p2psvc.dll
14:19:41.0598 3200  p2psvc - ok
14:19:41.0678 3200  [ 0FA9B5055484649D63C303FE404E5F4D ] Parport        C:\Windows\system32\drivers\parport.sys
14:19:41.0751 3200  Parport - ok
14:19:41.0856 3200  [ B9C2B89F08670E159F7181891E449CD9 ] partmgr        C:\Windows\system32\drivers\partmgr.sys
14:19:41.0880 3200  partmgr - ok
14:19:41.0918 3200  [ 4F9A6A8A31413180D0FCB279AD5D8112 ] Parvdm          C:\Windows\system32\drivers\parvdm.sys
14:19:42.0054 3200  Parvdm - ok
14:19:42.0142 3200  [ C6276AD11F4BB49B58AA1ED88537F14A ] PcaSvc          C:\Windows\System32\pcasvc.dll
14:19:42.0210 3200  PcaSvc - ok
14:19:42.0364 3200  [ 941DC1D19E7E8620F40BBC206981EFDB ] pci            C:\Windows\system32\drivers\pci.sys
14:19:42.0391 3200  pci - ok
14:19:42.0409 3200  [ FC175F5DDAB666D7F4D17449A547626F ] pciide          C:\Windows\system32\drivers\pciide.sys
14:19:42.0430 3200  pciide - ok
14:19:42.0519 3200  [ E6F3FB1B86AA519E7698AD05E58B04E5 ] pcmcia          C:\Windows\system32\drivers\pcmcia.sys
14:19:42.0534 3200  pcmcia - ok
14:19:42.0607 3200  [ 6349F6ED9C623B44B52EA3C63C831A92 ] PEAUTH          C:\Windows\system32\drivers\peauth.sys
14:19:42.0695 3200  PEAUTH - ok
14:19:42.0877 3200  [ F433B5AA6DBAC3C8626EEFAF134E4763 ] PhilCap        C:\Windows\system32\DRIVERS\PhilCap.sys
14:19:42.0999 3200  PhilCap - ok
14:19:43.0194 3200  [ B1689DF169143F57053F795390C99DB3 ] pla            C:\Windows\system32\pla.dll
14:19:43.0300 3200  pla - ok
14:19:43.0400 3200  [ 875E4E0661F3A5994DF9E5E3A0A4F96B ] PLFlash DeviceIoControl Service C:\Windows\system32\IoctlSvc.exe
14:19:43.0470 3200  PLFlash DeviceIoControl Service ( UnsignedFile.Multi.Generic ) - warning
14:19:43.0470 3200  PLFlash DeviceIoControl Service - detected UnsignedFile.Multi.Generic (1)
14:19:43.0554 3200  [ C5E7F8A996EC0A82D508FD9064A5569E ] PlugPlay        C:\Windows\system32\umpnpmgr.dll
14:19:43.0594 3200  PlugPlay - ok
14:19:43.0754 3200  [ 0C8E8E61AD1EB0B250B846712C917506 ] PNRPAutoReg    C:\Windows\system32\p2psvc.dll
14:19:43.0793 3200  PNRPAutoReg - ok
14:19:43.0832 3200  [ 0C8E8E61AD1EB0B250B846712C917506 ] PNRPsvc        C:\Windows\system32\p2psvc.dll
14:19:43.0879 3200  PNRPsvc - ok
14:19:43.0965 3200  [ D0494460421A03CD5225CCA0059AA146 ] PolicyAgent    C:\Windows\System32\ipsecsvc.dll
14:19:44.0083 3200  PolicyAgent - ok
14:19:44.0237 3200  [ ECFFFAEC0C1ECD8DBC77F39070EA1DB1 ] PptpMiniport    C:\Windows\system32\DRIVERS\raspptp.sys
14:19:44.0280 3200  PptpMiniport - ok
14:19:44.0319 3200  [ 2027293619DD0F047C584CF2E7DF4FFD ] Processor      C:\Windows\system32\drivers\processr.sys
14:19:44.0362 3200  Processor - ok
14:19:44.0465 3200  [ 0508FAA222D28835310B7BFCA7A77346 ] ProfSvc        C:\Windows\system32\profsvc.dll
14:19:44.0520 3200  ProfSvc - ok
14:19:44.0545 3200  [ A3E186B4B935905B829219502557314E ] ProtectedStorage C:\Windows\system32\lsass.exe
14:19:44.0568 3200  ProtectedStorage - ok
14:19:44.0653 3200  [ F115AF58ABE5605D7D709CBFBD83F418 ] ProtexisLicensing C:\Windows\system32\PSIService.exe
14:19:44.0677 3200  ProtexisLicensing - ok
14:19:44.0713 3200  [ 99514FAA8DF93D34B5589187DB3AA0BA ] PSched          C:\Windows\system32\DRIVERS\pacer.sys
14:19:44.0808 3200  PSched - ok
14:19:45.0019 3200  [ 0A6DB55AFB7820C99AA1F3A1D270F4F6 ] ql2300          C:\Windows\system32\drivers\ql2300.sys
14:19:45.0176 3200  ql2300 - ok
14:19:45.0237 3200  [ 81A7E5C076E59995D54BC1ED3A16E60B ] ql40xx          C:\Windows\system32\drivers\ql40xx.sys
14:19:45.0260 3200  ql40xx - ok
14:19:45.0343 3200  [ E9ECAE663F47E6CB43962D18AB18890F ] QWAVE          C:\Windows\system32\qwave.dll
14:19:45.0407 3200  QWAVE - ok
14:19:45.0438 3200  [ 9F5E0E1926014D17486901C88ECA2DB7 ] QWAVEdrv        C:\Windows\system32\drivers\qwavedrv.sys
14:19:45.0506 3200  QWAVEdrv - ok
14:19:45.0528 3200  [ 147D7F9C556D259924351FEB0DE606C3 ] RasAcd          C:\Windows\system32\DRIVERS\rasacd.sys
14:19:45.0580 3200  RasAcd - ok
14:19:45.0606 3200  [ F6A452EB4CEADBB51C9E0EE6B3ECEF0F ] RasAuto        C:\Windows\System32\rasauto.dll
14:19:45.0667 3200  RasAuto - ok
14:19:45.0830 3200  [ A214ADBAF4CB47DD2728859EF31F26B0 ] Rasl2tp        C:\Windows\system32\DRIVERS\rasl2tp.sys
14:19:45.0875 3200  Rasl2tp - ok
14:19:45.0999 3200  [ 75D47445D70CA6F9F894B032FBC64FCF ] RasMan          C:\Windows\System32\rasmans.dll
14:19:46.0039 3200  RasMan - ok
14:19:46.0095 3200  [ 509A98DD18AF4375E1FC40BC175F1DEF ] RasPppoe        C:\Windows\system32\DRIVERS\raspppoe.sys
14:19:46.0149 3200  RasPppoe - ok
14:19:46.0205 3200  [ 2005F4A1E05FA09389AC85840F0A9E4D ] RasSstp        C:\Windows\system32\DRIVERS\rassstp.sys
14:19:46.0228 3200  RasSstp - ok
14:19:46.0357 3200  [ B14C9D5B9ADD2F84F70570BBBFAA7935 ] rdbss          C:\Windows\system32\DRIVERS\rdbss.sys
14:19:46.0396 3200  rdbss - ok
14:19:46.0477 3200  [ 89E59BE9A564262A3FB6C4F4F1CD9899 ] RDPCDD          C:\Windows\system32\DRIVERS\RDPCDD.sys
14:19:46.0575 3200  RDPCDD - ok
14:19:46.0674 3200  [ FBC0BACD9C3D7F6956853F64A66E252D ] rdpdr          C:\Windows\system32\drivers\rdpdr.sys
14:19:46.0722 3200  rdpdr - ok
14:19:46.0753 3200  [ 9D91FE5286F748862ECFFA05F8A0710C ] RDPENCDD        C:\Windows\system32\drivers\rdpencdd.sys
14:19:46.0848 3200  RDPENCDD - ok
14:19:46.0974 3200  [ C127EBD5AFAB31524662C48DFCEB773A ] RDPWD          C:\Windows\system32\drivers\RDPWD.sys
14:19:47.0030 3200  RDPWD - ok
14:19:47.0123 3200  [ BCDD6B4804D06B1F7EBF29E53A57ECE9 ] RemoteAccess    C:\Windows\System32\mprdim.dll
14:19:47.0169 3200  RemoteAccess - ok
14:19:47.0246 3200  [ 9E6894EA18DAFF37B63E1005F83AE4AB ] RemoteRegistry  C:\Windows\system32\regsvc.dll
14:19:47.0301 3200  RemoteRegistry - ok
14:19:47.0458 3200  [ 805AE1F90C64758D19AAA001CF8CBA12 ] RichVideo      C:\Program Files\CyberLink\Shared Files\RichVideo.exe
14:19:47.0508 3200  RichVideo ( UnsignedFile.Multi.Generic ) - warning
14:19:47.0508 3200  RichVideo - detected UnsignedFile.Multi.Generic (1)
14:19:47.0560 3200  [ 5123F83CBC4349D065534EEB6BBDC42B ] RpcLocator      C:\Windows\system32\locator.exe
14:19:47.0658 3200  RpcLocator - ok
14:19:47.0783 3200  [ 3B5B4D53FEC14F7476CA29A20CC31AC9 ] RpcSs          C:\Windows\system32\rpcss.dll
14:19:47.0830 3200  RpcSs - ok
14:19:47.0952 3200  [ 9C508F4074A39E8B4B31D27198146FAD ] rspndr          C:\Windows\system32\DRIVERS\rspndr.sys
14:19:48.0009 3200  rspndr - ok
14:19:48.0133 3200  [ 8DAB5975B5C7923D61506A48E251DBAD ] RTSTOR          C:\Windows\system32\drivers\RTSTOR.SYS
14:19:48.0184 3200  RTSTOR - ok
14:19:48.0236 3200  [ A3E186B4B935905B829219502557314E ] SamSs          C:\Windows\system32\lsass.exe
14:19:48.0260 3200  SamSs - ok
14:19:48.0280 3200  [ 3CE8F073A557E172B330109436984E30 ] sbp2port        C:\Windows\system32\drivers\sbp2port.sys
14:19:48.0325 3200  sbp2port - ok
14:19:48.0429 3200  [ 77B7A11A0C3D78D3386398FBBEA1B632 ] SCardSvr        C:\Windows\System32\SCardSvr.dll
14:19:48.0466 3200  SCardSvr - ok
14:19:48.0645 3200  [ 1A58069DB21D05EB2AB58EE5753EBE8D ] Schedule        C:\Windows\system32\schedsvc.dll
14:19:48.0727 3200  Schedule - ok
14:19:48.0773 3200  [ 312EC3E37A0A1F2006534913E37B4423 ] SCPolicySvc    C:\Windows\System32\certprop.dll
14:19:48.0806 3200  SCPolicySvc - ok
14:19:48.0905 3200  [ 716313D9F6B0529D03F726D5AAF6F191 ] SDRSVC          C:\Windows\System32\SDRSVC.dll
14:19:48.0964 3200  SDRSVC - ok
14:19:49.0063 3200  [ 90A3935D05B494A5A39D37E71F09A677 ] secdrv          C:\Windows\system32\drivers\secdrv.sys
14:19:49.0205 3200  secdrv - ok
14:19:49.0273 3200  [ FD5199D4D8A521005E4B5EE7FE00FA9B ] seclogon        C:\Windows\system32\seclogon.dll
14:19:49.0318 3200  seclogon - ok
14:19:49.0414 3200  [ A9BBAB5759771E523F55563D6CBE140F ] SENS            C:\Windows\System32\sens.dll
14:19:49.0475 3200  SENS - ok
14:19:49.0495 3200  [ 68E44E331D46F0FB38F0863A84CD1A31 ] Serenum        C:\Windows\system32\drivers\serenum.sys
14:19:49.0606 3200  Serenum - ok
14:19:49.0653 3200  [ C70D69A918B178D3C3B06339B40C2E1B ] Serial          C:\Windows\system32\drivers\serial.sys
14:19:49.0757 3200  Serial - ok
14:19:49.0807 3200  [ 8AF3D28A879BF75DB53A0EE7A4289624 ] sermouse        C:\Windows\system32\drivers\sermouse.sys
14:19:49.0833 3200  sermouse - ok
14:19:49.0869 3200  [ D2193326F729B163125610DBF3E17D57 ] SessionEnv      C:\Windows\system32\sessenv.dll
14:19:49.0897 3200  SessionEnv - ok
14:19:49.0954 3200  [ 3EFA810BDCA87F6ECC24F9832243FE86 ] sffdisk        C:\Windows\system32\drivers\sffdisk.sys
14:19:49.0979 3200  sffdisk - ok
14:19:50.0013 3200  [ E95D451F7EA3E583AEC75F3B3EE42DC5 ] sffp_mmc        C:\Windows\system32\drivers\sffp_mmc.sys
14:19:50.0110 3200  sffp_mmc - ok
14:19:50.0128 3200  [ 3D0EA348784B7AC9EA9BD9F317980979 ] sffp_sd        C:\Windows\system32\drivers\sffp_sd.sys
14:19:50.0197 3200  sffp_sd - ok
14:19:50.0224 3200  [ 46ED8E91793B2E6F848015445A0AC188 ] sfloppy        C:\Windows\system32\drivers\sfloppy.sys
14:19:50.0328 3200  sfloppy - ok
14:19:50.0403 3200  [ E1499BD0FF76B1B2FBBF1AF339D91165 ] SharedAccess    C:\Windows\System32\ipnathlp.dll
14:19:50.0456 3200  SharedAccess - ok
14:19:50.0587 3200  [ C7230FBEE14437716701C15BE02C27B8 ] ShellHWDetection C:\Windows\System32\shsvcs.dll
14:19:50.0663 3200  ShellHWDetection - ok
14:19:50.0679 3200  [ 1D76624A09A054F682D746B924E2DBC3 ] sisagp          C:\Windows\system32\drivers\sisagp.sys
14:19:50.0702 3200  sisagp - ok
14:19:50.0792 3200  [ 43CB7AA756C7DB280D01DA9B676CFDE2 ] SiSRaid2        C:\Windows\system32\drivers\sisraid2.sys
14:19:50.0814 3200  SiSRaid2 - ok
14:19:50.0842 3200  [ A99C6C8B0BAA970D8AA59DDC50B57F94 ] SiSRaid4        C:\Windows\system32\drivers\sisraid4.sys
14:19:50.0866 3200  SiSRaid4 - ok
14:19:51.0451 3200  [ 0F97E7A47A52F4A36969F0FC319654C2 ] Skype C2C Service C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
14:19:51.0647 3200  Skype C2C Service - ok
14:19:51.0759 3200  [ F07AF60B152221472FBDB2FECEC4896D ] SkypeUpdate    C:\Program Files\Skype\Updater\Updater.exe
14:19:51.0778 3200  SkypeUpdate - ok
14:19:52.0111 3200  [ 862BB4CBC05D80C5B45BE430E5EF872F ] slsvc          C:\Windows\system32\SLsvc.exe
14:19:52.0386 3200  slsvc - ok
14:19:52.0471 3200  [ 6EDC422215CD78AA8A9CDE6B30ABBD35 ] SLUINotify      C:\Windows\system32\SLUINotify.dll
14:19:52.0578 3200  SLUINotify - ok
14:19:52.0640 3200  [ 7B75299A4D201D6A6533603D6914AB04 ] Smb            C:\Windows\system32\DRIVERS\smb.sys
14:19:52.0717 3200  Smb - ok
14:19:52.0852 3200  [ 2A146A055B4401C16EE62D18B8E2A032 ] SNMPTRAP        C:\Windows\System32\snmptrap.exe
14:19:52.0867 3200  SNMPTRAP - ok
14:19:52.0993 3200  [ 7AEBDEEF071FE28B0EEF2CDD69102BFF ] spldr          C:\Windows\system32\drivers\spldr.sys
14:19:53.0042 3200  spldr - ok
14:19:53.0182 3200  [ 8554097E5136C3BF9F69FE578A1B35F4 ] Spooler        C:\Windows\System32\spoolsv.exe
14:19:53.0238 3200  Spooler - ok
14:19:53.0380 3200  [ 41987F9FC0E61ADF54F581E15029AD91 ] srv            C:\Windows\system32\DRIVERS\srv.sys
14:19:53.0442 3200  srv - ok
14:19:53.0513 3200  [ FF33AFF99564B1AA534F58868CBE41EF ] srv2            C:\Windows\system32\DRIVERS\srv2.sys
14:19:53.0598 3200  srv2 - ok
14:19:53.0637 3200  [ 7605C0E1D01A08F3ECD743F38B834A44 ] srvnet          C:\Windows\system32\DRIVERS\srvnet.sys
14:19:53.0663 3200  srvnet - ok
14:19:53.0709 3200  [ 03D50B37234967433A5EA5BA72BC0B62 ] SSDPSRV        C:\Windows\System32\ssdpsrv.dll
14:19:53.0774 3200  SSDPSRV - ok
14:19:53.0854 3200  [ A36EE93698802CD899F98BFD553D8185 ] ssmdrv          C:\Windows\system32\DRIVERS\ssmdrv.sys
14:19:53.0870 3200  ssmdrv - ok
14:19:53.0925 3200  [ 6F1A32E7B7B30F004D9A20AFADB14944 ] SstpSvc        C:\Windows\system32\sstpsvc.dll
14:19:53.0952 3200  SstpSvc - ok
14:19:54.0004 3200  [ 5DE7D67E49B88F5F07F3E53C4B92A352 ] stisvc          C:\Windows\System32\wiaservc.dll
14:19:54.0097 3200  stisvc - ok
14:19:54.0129 3200  [ 7BA58ECF0C0A9A69D44B3DCA62BECF56 ] swenum          C:\Windows\system32\DRIVERS\swenum.sys
14:19:54.0178 3200  swenum - ok
14:19:54.0312 3200  [ F21FD248040681CCA1FB6C9A03AAA93D ] swprv          C:\Windows\System32\swprv.dll
14:19:54.0381 3200  swprv - ok
14:19:54.0499 3200  [ 192AA3AC01DF071B541094F251DEED10 ] Symc8xx        C:\Windows\system32\drivers\symc8xx.sys
14:19:54.0520 3200  Symc8xx - ok
14:19:54.0545 3200  [ 8C8EB8C76736EBAF3B13B633B2E64125 ] Sym_hi          C:\Windows\system32\drivers\sym_hi.sys
14:19:54.0565 3200  Sym_hi - ok
14:19:54.0582 3200  [ 8072AF52B5FD103BBBA387A1E49F62CB ] Sym_u3          C:\Windows\system32\drivers\sym_u3.sys
14:19:54.0603 3200  Sym_u3 - ok
14:19:54.0649 3200  [ 4351EC1757F4BEC35F635F6AC995C060 ] SynTP          C:\Windows\system32\DRIVERS\SynTP.sys
14:19:54.0675 3200  SynTP - ok
14:19:54.0784 3200  [ 9A51B04E9886AA4EE90093586B0BA88D ] SysMain        C:\Windows\system32\sysmain.dll
14:19:54.0867 3200  SysMain - ok
14:19:55.0072 3200  [ D7E795032847A6E6E9FBC5E296AE0838 ] SystemStore    C:\Program Files\Freemium\SystemStore\Freemium.SystemStore.WindowsService.exe
14:19:55.0079 3200  SystemStore ( UnsignedFile.Multi.Generic ) - warning
14:19:55.0079 3200  SystemStore - detected UnsignedFile.Multi.Generic (1)
14:19:55.0135 3200  [ 2DCA225EAE15F42C0933E998EE0231C3 ] TabletInputService C:\Windows\System32\TabSvc.dll
14:19:55.0203 3200  TabletInputService - ok
14:19:55.0295 3200  [ D7673E4B38CE21EE54C59EEEB65E2483 ] TapiSrv        C:\Windows\System32\tapisrv.dll
14:19:55.0352 3200  TapiSrv - ok
14:19:55.0379 3200  [ CB05822CD9CC6C688168E113C603DBE7 ] TBS            C:\Windows\System32\tbssvc.dll
14:19:55.0479 3200  TBS - ok
14:19:55.0592 3200  [ 27D470DABC77BC60D0A3B0E4DEB6CB91 ] Tcpip          C:\Windows\system32\drivers\tcpip.sys
14:19:55.0706 3200  Tcpip - ok
14:19:55.0804 3200  [ 27D470DABC77BC60D0A3B0E4DEB6CB91 ] Tcpip6          C:\Windows\system32\DRIVERS\tcpip.sys
14:19:55.0870 3200  Tcpip6 - ok
14:19:55.0964 3200  [ 608C345A255D82A6289C2D468EB41FD7 ] tcpipreg        C:\Windows\system32\drivers\tcpipreg.sys
14:19:56.0047 3200  tcpipreg - ok
14:19:56.0113 3200  [ 5DCF5E267BE67A1AE926F2DF77FBCC56 ] TDPIPE          C:\Windows\system32\drivers\tdpipe.sys
14:19:56.0177 3200  TDPIPE - ok
14:19:56.0231 3200  [ 389C63E32B3CEFED425B61ED92D3F021 ] TDTCP          C:\Windows\system32\drivers\tdtcp.sys
14:19:56.0295 3200  TDTCP - ok
14:19:56.0376 3200  [ 76B06EB8A01FC8624D699E7045303E54 ] tdx            C:\Windows\system32\DRIVERS\tdx.sys
14:19:56.0456 3200  tdx - ok
14:19:56.0515 3200  [ 3CAD38910468EAB9A6479E2F01DB43C7 ] TermDD          C:\Windows\system32\DRIVERS\termdd.sys
14:19:56.0569 3200  TermDD - ok
14:19:56.0734 3200  [ BB95DA09BEF6E7A131BFF3BA5032090D ] TermService    C:\Windows\System32\termsrv.dll
14:19:56.0807 3200  TermService - ok
14:19:56.0903 3200  [ C7230FBEE14437716701C15BE02C27B8 ] Themes          C:\Windows\system32\shsvcs.dll
14:19:56.0933 3200  Themes - ok
14:19:56.0961 3200  [ 1076FFCFFAAE8385FD62DFCB25AC4708 ] THREADORDER    C:\Windows\system32\mmcss.dll
14:19:57.0004 3200  THREADORDER - ok
14:19:57.0113 3200  [ EC74E77D0EB004BD3A809B5F8FB8C2CE ] TrkWks          C:\Windows\System32\trkwks.dll
14:19:57.0161 3200  TrkWks - ok
14:19:57.0305 3200  [ 97D9D6A04E3AD9B6C626B9931DB78DBA ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
14:19:57.0359 3200  TrustedInstaller - ok
14:19:57.0446 3200  [ DCF0F056A2E4F52287264F5AB29CF206 ] tssecsrv        C:\Windows\system32\DRIVERS\tssecsrv.sys
14:19:57.0546 3200  tssecsrv - ok
14:19:57.0597 3200  [ CAECC0120AC49E3D2F758B9169872D38 ] tunmp          C:\Windows\system32\DRIVERS\tunmp.sys
14:19:57.0638 3200  tunmp - ok
14:19:57.0727 3200  [ 300DB877AC094FEAB0BE7688C3454A9C ] tunnel          C:\Windows\system32\DRIVERS\tunnel.sys
14:19:57.0783 3200  tunnel - ok
14:19:57.0812 3200  [ 7D33C4DB2CE363C8518D2DFCF533941F ] uagp35          C:\Windows\system32\drivers\uagp35.sys
14:19:57.0835 3200  uagp35 - ok
14:19:57.0899 3200  [ D9728AF68C4C7693CB100B8441CBDEC6 ] udfs            C:\Windows\system32\DRIVERS\udfs.sys
14:19:57.0939 3200  udfs - ok
14:19:58.0055 3200  [ ECEF404F62863755951E09C802C94AD5 ] UI0Detect      C:\Windows\system32\UI0Detect.exe
14:19:58.0112 3200  UI0Detect - ok
14:19:58.0202 3200  [ B0ACFDC9E4AF279E9116C03E014B2B27 ] uliagpkx        C:\Windows\system32\drivers\uliagpkx.sys
14:19:58.0224 3200  uliagpkx - ok
14:19:58.0286 3200  [ 9224BB254F591DE4CA8D572A5F0D635C ] uliahci        C:\Windows\system32\drivers\uliahci.sys
14:19:58.0336 3200  uliahci - ok
14:19:58.0358 3200  [ 8514D0E5CD0534467C5FC61BE94A569F ] UlSata          C:\Windows\system32\drivers\ulsata.sys
14:19:58.0413 3200  UlSata - ok
14:19:58.0430 3200  [ 38C3C6E62B157A6BC46594FADA45C62B ] ulsata2        C:\Windows\system32\drivers\ulsata2.sys
14:19:58.0462 3200  ulsata2 - ok
14:19:58.0497 3200  [ 32CFF9F809AE9AED85464492BF3E32D2 ] umbus          C:\Windows\system32\DRIVERS\umbus.sys
14:19:58.0592 3200  umbus - ok
14:19:58.0716 3200  [ 68308183F4AE0BE7BF8ECD07CB297999 ] upnphost        C:\Windows\System32\upnphost.dll
14:19:58.0796 3200  upnphost - ok
14:19:58.0914 3200  [ CAF811AE4C147FFCD5B51750C7F09142 ] usbccgp        C:\Windows\system32\DRIVERS\usbccgp.sys
14:19:58.0994 3200  usbccgp - ok
14:19:59.0013 3200  [ E9476E6C486E76BC4898074768FB7131 ] usbcir          C:\Windows\system32\drivers\usbcir.sys
14:19:59.0108 3200  usbcir - ok
14:19:59.0194 3200  [ 79E96C23A97CE7B8F14D310DA2DB0C9B ] usbehci        C:\Windows\system32\DRIVERS\usbehci.sys
14:19:59.0247 3200  usbehci - ok
14:19:59.0324 3200  [ 4673BBCB006AF60E7ABDDBE7A130BA42 ] usbhub          C:\Windows\system32\DRIVERS\usbhub.sys
14:19:59.0373 3200  usbhub - ok
14:19:59.0475 3200  [ CE697FEE0D479290D89BEC80DFE793B7 ] usbohci        C:\Windows\system32\DRIVERS\usbohci.sys
14:19:59.0523 3200  usbohci - ok
14:19:59.0649 3200  [ E75C4B5269091D15A2E7DC0B6D35F2F5 ] usbprint        C:\Windows\system32\DRIVERS\usbprint.sys
14:19:59.0706 3200  usbprint - ok
14:19:59.0805 3200  [ A508C9BD8724980512136B039BBA65E9 ] usbscan        C:\Windows\system32\DRIVERS\usbscan.sys
14:19:59.0856 3200  usbscan - ok
14:19:59.0928 3200  [ BE3DA31C191BC222D9AD503C5224F2AD ] USBSTOR        C:\Windows\system32\DRIVERS\USBSTOR.SYS
14:19:59.0975 3200  USBSTOR - ok
14:20:00.0034 3200  [ 814D653EFC4D48BE3B04A307ECEFF56F ] usbuhci        C:\Windows\system32\DRIVERS\usbuhci.sys
14:20:00.0095 3200  usbuhci - ok
14:20:00.0135 3200  [ E67998E8F14CB0627A769F6530BCB352 ] usbvideo        C:\Windows\system32\Drivers\usbvideo.sys
14:20:00.0200 3200  usbvideo - ok
14:20:00.0279 3200  [ 1509E705F3AC1D474C92454A5C2DD81F ] UxSms          C:\Windows\System32\uxsms.dll
14:20:00.0348 3200  UxSms - ok
14:20:00.0484 3200  [ CD88D1B7776DC17A119049742EC07EB4 ] vds            C:\Windows\System32\vds.exe
14:20:00.0531 3200  vds - ok
14:20:00.0611 3200  [ 87B06E1F30B749A114F74622D013F8D4 ] vga            C:\Windows\system32\DRIVERS\vgapnp.sys
14:20:00.0653 3200  vga - ok
14:20:00.0713 3200  [ 2E93AC0A1D8C79D019DB6C51F036636C ] VgaSave        C:\Windows\System32\drivers\vga.sys
14:20:00.0809 3200  VgaSave - ok
14:20:00.0870 3200  [ 5D7159DEF58A800D5781BA3A879627BC ] viaagp          C:\Windows\system32\drivers\viaagp.sys
14:20:00.0894 3200  viaagp - ok
14:20:00.0923 3200  [ C4F3A691B5BAD343E6249BD8C2D45DEE ] ViaC7          C:\Windows\system32\drivers\viac7.sys
14:20:00.0989 3200  ViaC7 - ok
14:20:01.0008 3200  [ AADF5587A4063F52C2C3FED7887426FC ] viaide          C:\Windows\system32\drivers\viaide.sys
14:20:01.0030 3200  viaide - ok
14:20:01.0067 3200  [ 69503668AC66C77C6CD7AF86FBDF8C43 ] volmgr          C:\Windows\system32\drivers\volmgr.sys
14:20:01.0081 3200  volmgr - ok
14:20:01.0114 3200  [ 23E41B834759917BFD6B9A0D625D0C28 ] volmgrx        C:\Windows\system32\drivers\volmgrx.sys
14:20:01.0164 3200  volmgrx - ok
14:20:01.0268 3200  [ 147281C01FCB1DF9252DE2A10D5E7093 ] volsnap        C:\Windows\system32\drivers\volsnap.sys
14:20:01.0316 3200  volsnap - ok
14:20:01.0370 3200  [ 587253E09325E6BF226B299774B728A9 ] vsmraid        C:\Windows\system32\drivers\vsmraid.sys
14:20:01.0389 3200  vsmraid - ok
14:20:01.0479 3200  [ DB3D19F850C6EB32BDCB9BC0836ACDDB ] VSS            C:\Windows\system32\vssvc.exe
14:20:01.0600 3200  VSS - ok
14:20:01.0747 3200  [ 96EA68B9EB310A69C25EBB0282B2B9DE ] W32Time        C:\Windows\system32\w32time.dll
14:20:01.0780 3200  W32Time - ok
14:20:01.0809 3200  [ 48DFEE8F1AF7C8235D4E626F0C4FE031 ] WacomPen        C:\Windows\system32\drivers\wacompen.sys
14:20:01.0935 3200  WacomPen - ok
14:20:01.0971 3200  [ 55201897378CCA7AF8B5EFD874374A26 ] Wanarp          C:\Windows\system32\DRIVERS\wanarp.sys
14:20:02.0023 3200  Wanarp - ok
14:20:02.0029 3200  [ 55201897378CCA7AF8B5EFD874374A26 ] Wanarpv6        C:\Windows\system32\DRIVERS\wanarp.sys
14:20:02.0063 3200  Wanarpv6 - ok
14:20:02.0127 3200  [ A3CD60FD826381B49F03832590E069AF ] wcncsvc        C:\Windows\System32\wcncsvc.dll
14:20:02.0163 3200  wcncsvc - ok
14:20:02.0205 3200  [ 11BCB7AFCDD7AADACB5746F544D3A9C7 ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
14:20:02.0241 3200  WcsPlugInService - ok
14:20:02.0316 3200  [ 78FE9542363F297B18C027B2D7E7C07F ] Wd              C:\Windows\system32\drivers\wd.sys
14:20:02.0329 3200  Wd - ok
14:20:02.0428 3200  [ B6F0A7AD6D4BD325FBCD8BAC96CD8D96 ] Wdf01000        C:\Windows\system32\drivers\Wdf01000.sys
14:20:02.0480 3200  Wdf01000 - ok
14:20:02.0513 3200  [ ABFC76B48BB6C96E3338D8943C5D93B5 ] WdiServiceHost  C:\Windows\system32\wdi.dll
14:20:02.0617 3200  WdiServiceHost - ok
14:20:02.0622 3200  [ ABFC76B48BB6C96E3338D8943C5D93B5 ] WdiSystemHost  C:\Windows\system32\wdi.dll
14:20:02.0652 3200  WdiSystemHost - ok
14:20:02.0707 3200  [ 04C37D8107320312FBAE09926103D5E2 ] WebClient      C:\Windows\System32\webclnt.dll
14:20:02.0742 3200  WebClient - ok
14:20:02.0871 3200  [ AE3736E7E8892241C23E4EBBB7453B60 ] Wecsvc          C:\Windows\system32\wecsvc.dll
14:20:02.0938 3200  Wecsvc - ok
14:20:03.0045 3200  [ 670FF720071ED741206D69BD995EA453 ] wercplsupport  C:\Windows\System32\wercplsupport.dll
14:20:03.0130 3200  wercplsupport - ok
14:20:03.0238 3200  [ 32B88481D3B326DA6DEB07B1D03481E7 ] WerSvc          C:\Windows\System32\WerSvc.dll
14:20:03.0285 3200  WerSvc - ok
14:20:03.0399 3200  [ 4575AA12561C5648483403541D0D7F2B ] WinDefend      C:\Program Files\Windows Defender\mpsvc.dll
14:20:03.0430 3200  WinDefend - ok
14:20:03.0440 3200  WinHttpAutoProxySvc - ok
14:20:03.0584 3200  [ 6B2A1D0E80110E3D04E6863C6E62FD8A ] Winmgmt        C:\Windows\system32\wbem\WMIsvc.dll
14:20:03.0619 3200  Winmgmt - ok
14:20:03.0773 3200  [ 7CFE68BDC065E55AA5E8421607037511 ] WinRM          C:\Windows\system32\WsmSvc.dll
14:20:03.0882 3200  WinRM - ok
14:20:04.0023 3200  [ C008405E4FEEB069E30DA1D823910234 ] Wlansvc        C:\Windows\System32\wlansvc.dll
14:20:04.0162 3200  Wlansvc - ok
14:20:04.0325 3200  [ 6067ACEF367E79914AF628FA1E9B5330 ] wlcrasvc        C:\Program Files\Windows Live\Mesh\wlcrasvc.exe
14:20:04.0344 3200  wlcrasvc - ok
14:20:04.0584 3200  [ 0A70F4022EC2E14C159EFC4F69AA2477 ] wlidsvc        C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
14:20:04.0762 3200  wlidsvc - ok
14:20:04.0841 3200  [ 2E7255D172DF0B8283CDFB7B433B864E ] WmiAcpi        C:\Windows\system32\drivers\wmiacpi.sys
14:20:04.0885 3200  WmiAcpi - ok
14:20:05.0004 3200  [ 43BE3875207DCB62A85C8C49970B66CC ] wmiApSrv        C:\Windows\system32\wbem\WmiApSrv.exe
14:20:05.0039 3200  wmiApSrv - ok
14:20:05.0247 3200  [ 3978704576A121A9204F8CC49A301A9B ] WMPNetworkSvc  C:\Program Files\Windows Media Player\wmpnetwk.exe
14:20:05.0379 3200  WMPNetworkSvc - ok
14:20:05.0467 3200  [ CFC5A04558F5070CEE3E3A7809F3FF52 ] WPCSvc          C:\Windows\System32\wpcsvc.dll
14:20:05.0544 3200  WPCSvc - ok
14:20:05.0611 3200  [ 801FBDB89D472B3C467EB112A0FC9246 ] WPDBusEnum      C:\Windows\system32\wpdbusenum.dll
14:20:05.0710 3200  WPDBusEnum - ok
14:20:05.0789 3200  [ DE9D36F91A4DF3D911626643DEBF11EA ] WpdUsb          C:\Windows\system32\DRIVERS\wpdusb.sys
14:20:05.0812 3200  WpdUsb - ok
14:20:06.0046 3200  [ DCF3E3EDF5109EE8BC02FE6E1F045795 ] WPFFontCache_v0400 C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
14:20:06.0099 3200  WPFFontCache_v0400 - ok
14:20:06.0233 3200  [ E3A3CB253C0EC2494D4A61F5E43A389C ] ws2ifsl        C:\Windows\system32\drivers\ws2ifsl.sys
14:20:06.0291 3200  ws2ifsl - ok
14:20:06.0433 3200  [ 1CA6C40261DDC0425987980D0CD2AAAB ] wscsvc          C:\Windows\System32\wscsvc.dll
14:20:06.0475 3200  wscsvc - ok
14:20:06.0483 3200  WSearch - ok
14:20:06.0680 3200  [ FC3EC24FCE372C89423E015A2AC1A31E ] wuauserv        C:\Windows\system32\wuaueng.dll
14:20:06.0862 3200  wuauserv - ok
14:20:06.0951 3200  [ AC13CB789D93412106B0FB6C7EB2BCB6 ] WUDFRd          C:\Windows\system32\DRIVERS\WUDFRd.sys
14:20:07.0010 3200  WUDFRd - ok
14:20:07.0123 3200  [ 575A4190D989F64732119E4114045A4F ] wudfsvc        C:\Windows\System32\WUDFSvc.dll
14:20:07.0179 3200  wudfsvc - ok
14:20:07.0281 3200  [ AB2D77BF7222B007717ABB61B15F9AE2 ] X10Hid          C:\Windows\system32\Drivers\x10hid.sys
14:20:07.0303 3200  X10Hid - ok
14:20:07.0446 3200  [ 5A0C788C5BC5F2C993CB60940ADCF95E ] x10nets        C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
14:20:07.0452 3200  x10nets ( UnsignedFile.Multi.Generic ) - warning
14:20:07.0453 3200  x10nets - detected UnsignedFile.Multi.Generic (1)
14:20:07.0523 3200  [ 6BBF7A3BAB8FFDCCF82057FA2AAE2B7B ] XUIF            C:\Windows\system32\Drivers\x10ufx2.sys
14:20:07.0543 3200  XUIF - ok
14:20:07.0637 3200  ================ Scan global ===============================
14:20:07.0664 3200  [ F31EEBC1A1C81FD04005489CC3DCDFE7 ] C:\Windows\system32\basesrv.dll
14:20:07.0696 3200  [ D2293B069E4B63DC17B2F08D45E71124 ] C:\Windows\system32\winsrv.dll
14:20:07.0737 3200  [ D2293B069E4B63DC17B2F08D45E71124 ] C:\Windows\system32\winsrv.dll
14:20:07.0856 3200  [ D4E6D91C1349B7BFB3599A6ADA56851B ] C:\Windows\system32\services.exe
14:20:07.0865 3200  [Global] - ok
14:20:07.0866 3200  ================ Scan MBR ==================================
14:20:07.0911 3200  [ 5C616939100B85E558DA92B899A0FC36 ] \Device\Harddisk0\DR0
14:20:08.0770 3200  \Device\Harddisk0\DR0 - ok
14:20:08.0771 3200  ================ Scan VBR ==================================
14:20:08.0803 3200  [ DFD3C39AAA55E25F422FD8D64DC05F97 ] \Device\Harddisk0\DR0\Partition1
14:20:08.0805 3200  \Device\Harddisk0\DR0\Partition1 - ok
14:20:08.0852 3200  [ 05CB141FB8B664262775783C1EDB5310 ] \Device\Harddisk0\DR0\Partition2
14:20:08.0892 3200  \Device\Harddisk0\DR0\Partition2 - ok
14:20:08.0892 3200  ============================================================
14:20:08.0892 3200  Scan finished
14:20:08.0892 3200  ============================================================
14:20:08.0915 4800  Detected object count: 4
14:20:08.0915 4800  Actual detected object count: 4
14:20:40.0747 4800  PLFlash DeviceIoControl Service ( UnsignedFile.Multi.Generic ) - skipped by user
14:20:40.0747 4800  PLFlash DeviceIoControl Service ( UnsignedFile.Multi.Generic ) - User select action: Skip
14:20:40.0750 4800  RichVideo ( UnsignedFile.Multi.Generic ) - skipped by user
14:20:40.0751 4800  RichVideo ( UnsignedFile.Multi.Generic ) - User select action: Skip
14:20:40.0754 4800  SystemStore ( UnsignedFile.Multi.Generic ) - skipped by user
14:20:40.0754 4800  SystemStore ( UnsignedFile.Multi.Generic ) - User select action: Skip
14:20:40.0757 4800  x10nets ( UnsignedFile.Multi.Generic ) - skipped by user
14:20:40.0757 4800  x10nets ( UnsignedFile.Multi.Generic ) - User select action: Skip

cosinus 01.09.2012 13:49
Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte combofix.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

IamShine 01.09.2012 14:49
Hier das combo-fix-log:
[code]
Combofix Logfile:
Code:
ComboFix 12-08-31.08 - Admin 01.09.2012  15:27:38.1.2 - x86
Microsoft® Windows Vista™ Home Premium  6.0.6002.2.1252.49.1031.18.2301.1239 [GMT 2:00]
ausgeführt von:: c:\users\Admin\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((  Dateien erstellt von 2012-08-01 bis 2012-09-01  ))))))))))))))))))))))))))))))
.
.
2012-09-01 13:34 . 2012-09-01 13:35        --------        d-----w-        c:\users\Admin\AppData\Local\temp
2012-09-01 13:34 . 2012-09-01 13:34        --------        d-----w-        c:\users\Gerrit\AppData\Local\temp
2012-09-01 13:34 . 2012-09-01 13:34        --------        d-----w-        c:\users\Gast\AppData\Local\temp
2012-09-01 13:34 . 2012-09-01 13:34        --------        d-----w-        c:\users\Default\AppData\Local\temp
2012-09-01 13:13 . 2012-09-01 13:13        93672        ----a-w-        c:\windows\system32\WindowsAccessBridge.dll
2012-08-17 23:28 . 2012-06-29 00:00        2382848        ----a-w-        c:\windows\system32\mshtml.tlb
2012-08-17 23:27 . 2012-07-04 14:02        2047488        ----a-w-        c:\windows\system32\win32k.sys
2012-08-17 21:21 . 2012-08-17 21:21        --------        d-----w-        c:\program files\ESET
2012-08-17 21:15 . 2012-05-11 15:57        623616        ----a-w-        c:\windows\system32\localspl.dll
2012-08-12 09:59 . 2012-08-12 09:59        --------        d-----w-        c:\users\Gerrit\AppData\Roaming\Malwarebytes
2012-08-12 09:55 . 2012-08-12 09:55        --------        d-----w-        c:\users\Admin\AppData\Roaming\Malwarebytes
2012-08-12 09:55 . 2012-08-12 13:00        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware
2012-08-12 09:55 . 2012-07-03 11:46        22344        ----a-w-        c:\windows\system32\drivers\mbam.sys
2012-08-05 19:45 . 2012-08-20 21:48        --------        d-----w-        c:\program files\JDownloader
2012-08-05 19:23 . 2012-08-12 16:11        --------        d-----w-        c:\program files\vGrabber-software
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-08-17 20:56 . 2012-07-17 11:35        70344        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl
2012-08-17 20:56 . 2012-07-17 11:35        426184        ----a-w-        c:\windows\system32\FlashPlayerApp.exe
2012-08-01 22:51 . 2008-10-20 02:48        7023536        ----a-w-        c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll        ERROR(0x00000005)
2012-06-05 16:47 . 2012-07-17 00:48        1401856        ----a-w-        c:\windows\system32\msxml6.dll
2012-06-05 16:47 . 2012-07-17 00:48        1248768        ----a-w-        c:\windows\system32\msxml3.dll
2012-06-04 15:26 . 2012-07-17 00:50        440704        ----a-w-        c:\windows\system32\drivers\ksecdd.sys
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="RtHDVCpl.exe" [2008-09-18 6294048]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-01-04 1033512]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-09-04 417792]
"Skytel"="Skytel.exe" [2008-09-18 1833504]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-09-29 13560352]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-09-29 92704]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2012-08-08 348664]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-07-03 462920]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]
.
c:\users\Gerrit\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 2.2.lnk - c:\program files\OpenOffice.org 2.2\program\quickstart.exe [2007-2-2 393216]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKLM\~\startupfolder\C:^Users^Admin^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 2.2.lnk]
path=c:\users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 2.2.lnk
backup=c:\windows\pss\OpenOffice.org 2.2.lnk.Startup
backupExtension=.Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2012-07-27 20:51        919008        ----a-w-        c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EEventManager]
2009-12-03 09:12        976320        ----a-w-        c:\program files\Epson Software\Event Manager\EEventManager.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut]
2007-01-08 20:17        52256        ----a-w-        c:\program files\HomeCinema\PowerDVD\Language\Language.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
2007-02-09 18:51        71216        ----a-w-        c:\program files\HomeCinema\PowerDVD\PDVDServ.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sidebar]
2009-04-11 06:28        1233920        ----a-w-        c:\program files\Windows Sidebar\sidebar.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2012-07-13 11:33        17418928        ----a-r-        c:\program files\Skype\Phone\Skype.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\toolbar_eula_launcher]
2007-02-09 14:54        16896        ----a-w-        c:\program files\GoogleEULA\EULALauncher.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UCam_Menu]
2008-06-13 16:11        210216        ------w-        c:\program files\HomeCinema\YouCam\MUITransfer\MUIStartMenu.exe
.
S2 ABBYY.Licensing.FineReader.Sprint.9.0;ABBYY FineReader 9.0 Sprint Licensing Service;c:\program files\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [x]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation        REG_MULTI_SZ          FontCache
.
Inhalt des "geplante Tasks" Ordners
.
2012-09-01 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-08-19 11:30]
.
2012-09-01 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-08-19 11:30]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.com/
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll/cmsidewiki.html
TCP: DhcpNameServer = 192.168.2.1
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
MSConfigStartUp-swg - c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
AddRemove-_{ADDBE07D-95B8-4789-9C76-187FFF9624B4} - c:\program files\Corel\CorelDRAW Essential Edition 3\Programs\MSILauncher {ADDBE07D-95B8-4789-9C76-187FFF9624B4}
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2012-09-01 15:35
Windows 6.0.6002 Service Pack 2 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'Explorer.exe'(1328)
c:\windows\system32\NVSVC.DLL
.
Zeit der Fertigstellung: 2012-09-01  15:38:26
ComboFix-quarantined-files.txt  2012-09-01 13:38
.
Vor Suchlauf: 11 Verzeichnis(se), 200.034.861.056 Bytes frei
Nach Suchlauf: 14 Verzeichnis(se), 200.137.728.000 Bytes frei
.
- - End Of File - - 89927A88C063E9DBC9F77246F7D8B577
--- --- ---

cosinus 02.09.2012 20:51
Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM!

Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.
  • Starte die aswMBR.exe - (aswMBR.exe Anleitung)
    Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten".
  • Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
    Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
  • Klicke auf Scan.
  • Warte bitte bis Scan finished successfully im DOS-Fenster steht.
  • Drücke auf Save Log und speichere diese auf dem Desktop.
Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).



Noch ein Hinweis: Sollte aswMBR abstürzen und es kommt eine Meldung wie "aswMBR.exe funktioniert nicht mehr, dann mach Folgendes:
Starte aswMBR neu, wähle unten links im Drop-Down-Menü (unten links im Fenster von aswMBR) bei "AV scan" (none) aus und klick nochmal auf den Scan-Button.

IamShine 04.09.2012 20:55
Hier das GMER-log:
[code]
GMER Logfile:
Code:
GMER 1.0.15.15641 - hxxp://www.gmer.net
Rootkit scan 2012-09-04 21:52:20
Windows 6.0.6002 Service Pack 2 Harddisk0\DR0 -> \Device\00000058 WDC_WD32 rev.11.0
Running: bsj2vwtl.exe; Driver: C:\Users\Admin\AppData\Local\Temp\pwdiapob.sys


---- Kernel code sections - GMER 1.0.15 ----

.text          C:\Windows\system32\DRIVERS\nvlddmkm.sys                                                                  section is writeable [0x8C600320, 0x3F7257, 0xE8000020]

---- User IAT/EAT - GMER 1.0.15 ----

IAT            C:\Windows\Explorer.EXE[4760] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusShutdown]                      [73CC7817] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18581_none_9e591052ca1013d0\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT            C:\Windows\Explorer.EXE[4760] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCloneImage]                      [73D0B4E9] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18581_none_9e591052ca1013d0\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT            C:\Windows\Explorer.EXE[4760] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDrawImageRectI]                  [73CCBB22] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18581_none_9e591052ca1013d0\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT            C:\Windows\Explorer.EXE[4760] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetInterpolationMode]            [73CBF695] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18581_none_9e591052ca1013d0\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT            C:\Windows\Explorer.EXE[4760] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusStartup]                      [73CC75E9] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18581_none_9e591052ca1013d0\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT            C:\Windows\Explorer.EXE[4760] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateFromHDC]                    [73CBE7CA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18581_none_9e591052ca1013d0\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT            C:\Windows\Explorer.EXE[4760] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStreamICM]        [73CF73F5] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18581_none_9e591052ca1013d0\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT            C:\Windows\Explorer.EXE[4760] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStream]          [73CCDA60] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18581_none_9e591052ca1013d0\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT            C:\Windows\Explorer.EXE[4760] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageHeight]                  [73CBFFFA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18581_none_9e591052ca1013d0\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT            C:\Windows\Explorer.EXE[4760] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageWidth]                    [73CBFF61] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18581_none_9e591052ca1013d0\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT            C:\Windows\Explorer.EXE[4760] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDisposeImage]                    [73CB71CF] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18581_none_9e591052ca1013d0\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT            C:\Windows\Explorer.EXE[4760] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFileICM]            [73D4CAE2] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18581_none_9e591052ca1013d0\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT            C:\Windows\Explorer.EXE[4760] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFile]                [73CEC8D8] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18581_none_9e591052ca1013d0\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT            C:\Windows\Explorer.EXE[4760] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDeleteGraphics]                  [73CBD968] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18581_none_9e591052ca1013d0\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT            C:\Windows\Explorer.EXE[4760] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipFree]                            [73CB6853] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18581_none_9e591052ca1013d0\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT            C:\Windows\Explorer.EXE[4760] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipAlloc]                            [73CB687E] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18581_none_9e591052ca1013d0\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT            C:\Windows\Explorer.EXE[4760] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetCompositingMode]              [73CC2AD1] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18581_none_9e591052ca1013d0\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

---- Devices - GMER 1.0.15 ----

AttachedDevice  \Driver\kbdclass \Device\KeyboardClass0                                                                    Wdf01000.sys (WDF Dynamic/Microsoft Corporation)
AttachedDevice  \FileSystem\fastfat \Fat                                                                                  fltmgr.sys (Microsoft Dateisystem-Filter-Manager/Microsoft Corporation)

---- Registry - GMER 1.0.15 ----

Reg            HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Media Center\Service\Scheduler@Heartbeat                    0x0F 0x0A 0x22 0x7A ...
Reg            HKLM\SOFTWARE\Classes\CLSID\{B6A930A0-A4F5-43A5-9B4E-6189A6C2B9E8}@{!s!\30!r!{!`!t!c!i!\24!t!j!s!y!s!\24!  19583823

---- EOF - GMER 1.0.15 ----
--- --- ---


...und das OSAM-log, da lustigerweise auf dem Desktop unsichtbar war, nur im OSAM-Fenster "Speichern unter" sichtbar, das aber beim 2. Durchlauf unter C: speicherbar und sichtbar war:
Code:
OSAM Logfile:

       
Code:

       
Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 22:15:49 on 04.09.2012

OS: Windows Vista Home Premium Edition Service Pack 2 (Build 6002), 32-bit
Default Browser: Microsoft Corporation Internet Explorer 9.00.8112.16421

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries


[Common]
-----( %SystemRoot%\Tasks )-----
"GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe

[Control Panel Objects]
-----( %SystemRoot%\system32 )-----
"FlashPlayerCPLApp.cpl" - "Adobe Systems Incorporated" - C:\Windows\system32\FlashPlayerCPLApp.cpl
"ISUSPM.cpl" - "Macrovision Corporation" - C:\Windows\system32\ISUSPM.cpl
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"Nero BurnRights" - "Nero AG" - C:\Program Files\Nero\Nero8\Nero Toolkit\NeroBurnRights.cpl
"QuickTime" - "Apple Inc." - C:\Program Files\QuickTime\QTSystem\QuickTime.cpl

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"avgntflt" (avgntflt) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avgntflt.sys
"avipbb" (avipbb) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avipbb.sys
"avkmgr" (avkmgr) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avkmgr.sys
"catchme" (catchme) - ? - C:\Users\Admin\AppData\Local\Temp\catchme.sys  (File not found)
"FssFltr" (fssfltr) - "Microsoft Corporation" - C:\Windows\System32\DRIVERS\fssfltr.sys
"IP in IP Tunnel Driver" (IpInIp) - ? - C:\Windows\System32\DRIVERS\ipinip.sys  (File not found)
"IPX Traffic Filter Driver" (NwlnkFlt) - ? - C:\Windows\System32\DRIVERS\nwlnkflt.sys  (File not found)
"IPX Traffic Forwarder Driver" (NwlnkFwd) - ? - C:\Windows\System32\DRIVERS\nwlnkfwd.sys  (File not found)
"MBAMProtector" (MBAMProtector) - "Malwarebytes Corporation" - C:\Windows\system32\drivers\mbam.sys
"NXP service" (PhilCap) - "NXP Semiconductors Germany GmbH" - C:\Windows\System32\DRIVERS\PhilCap.sys
"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\Windows\System32\DRIVERS\ssmdrv.sys

[Explorer]
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
-----( HKLM\Software\Classes\Protocols\Handler )-----
{E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} "Album Download IE Asynchronous Pluggable Protocol Interface" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
{828030A1-22C1-4009-854F-8E305202313F} "livecall" - "Microsoft Corporation" - C:\Program Files\Windows Live\Messenger\msgrapp.dll
{0A9007C0-4076-11D3-8789-0000F8105754} "Microsoft Infotech Storage Protocol for IE 4.0" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll
{828030A1-22C1-4009-854F-8E305202313F} "msnim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Messenger\msgrapp.dll
{91774881-D725-4E58-B298-07617B9B86A8} "Skype IE add-on Pluggable Protocol" - "Skype Technologies S.A." - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
{03C514A3-1EFB-4856-9F99-10D7BE1653C0} "Windows Live Mail HTML Asynchronous Pluggable Protocol Handler" - "Microsoft Corporation" - C:\Program Files\Windows Live\Mail\mailcomm.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{911051fa-c21c-4246-b470-070cd8df6dc4} ".cab or .zip files" - ? -   (File not found | COM-object registry key not found)
{1b24a030-9b20-49bc-97ac-1be4426f9e59} "ActiveDirectory Folder" - ? -   (File not found | COM-object registry key not found)
{34449847-FD14-4fc8-A75A-7432F5181EFB} "ActiveDirectory Folder" - ? -   (File not found | COM-object registry key not found)
{0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48} "Contacts folder" - ? -   (File not found | COM-object registry key not found)
{2C2577C2-63A7-40e3-9B7F-586602617ECB} "Explorer Query Band" - ? -   (File not found | COM-object registry key not found)
{FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75} "IE User Assist" - ? -   (File not found | COM-object registry key not found)
{00020d75-0000-0000-c000-000000000046} "lnkfile" - ? -   (File not found | COM-object registry key not found)
{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
{97F68CE3-7146-45FF-BE24-D9A7DD7CB8A2} "NeroCoverEdLiveIcons Class" - "Nero AG" - C:\Program Files\Nero\Nero8\Nero CoverDesigner\CoverEdExtension.dll
{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "OpenOffice.org Column Handler" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{087B3AE3-E237-4467-B8DB-5A38AB959AC9} "OpenOffice.org Infotip Handler" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{AE424E85-F6DF-4910-A6A9-438797986431} "OpenOffice.org Property Handler" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\propertyhdl.dll
{63542C48-9552-494A-84F7-73AA6A7C99C1} "OpenOffice.org Property Sheet Handler" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{3B092F0C-7696-40E3-A80F-68D74DA84210} "OpenOffice.org Thumbnail Viewer" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{C8494E42-ACDD-4739-B0FB-217361E4894F} "Sam Account Folder" - ? -   (File not found | COM-object registry key not found)
{E29F9716-5C08-4FCD-955A-119FDB5A522D} "Sam Account Folder" - ? -   (File not found | COM-object registry key not found)
{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira Operations GmbH & Co. KG" - C:\Program Files\Avira\AntiVir Desktop\shlext.dll
{6F5C0F40-1419-4DC8-8D2F-D5EC5FCF07AB} "Sprint.ExplorerIntegration.9" - "ABBYY" - C:\Program Files\Common Files\ABBYY\FineReaderSprint\9.00\Integration\SprintIntegration.dll
{2BE99FD4-A181-4996-BFA9-58C5FFD11F6C} "Windows Live Photo Gallery Autoplay Drop Target" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoGallery.exe
{00F30F64-AC33-42F5-8FD1-5DC2D3FDE06C} "Windows Live Photo Gallery Editor Drop Target" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoGallery.exe
{00F3712A-CA79-45B4-9E4D-D7891E7F8B9D} "Windows Live Photo Gallery Editor Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll
{00F30F90-3E96-453B-AFCD-D71989ECC2C7} "Windows Live Photo Gallery Viewer Autoplay Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll
{00F33137-EE26-412F-8D71-F84E4C2C6625} "Windows Live Photo Gallery Viewer Autoplay Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll
{00F374B7-B390-4884-B372-2FC349F2172B} "Windows Live Photo Gallery Viewer Drop Target" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoGallery.exe
{00F346CB-35A4-465B-8B8F-65A29DBAB1F6} "Windows Live Photo Gallery Viewer Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll
{da67b8ad-e81b-4c70-9b91b417b5e33527} "Windows Search Shell Service" - ? -   (File not found | COM-object registry key not found)
{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - "Alexander Roshal" - C:\Program Files\WinRAR\rarext.dll
{0563DB41-F538-4B37-A92D-4659049B7766} "WLMD Message Handler" - ? -   (File not found | COM-object registry key not found)
{06A2568A-CED6-4187-BB20-400B8C02BE5A} "{06A2568A-CED6-4187-BB20-400B8C02BE5A}" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoAcquireWizard.exe

[Internet Explorer]
-----( HKCU\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
"eBay - Der weltweite Online-Marktplatz" - ? - hxxp://rover.ebay.com/rover/1/707-37276-17534-15/4  (HTTP value)
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
<binary data> "Google Toolbar" - "Google Inc." - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
ITBar7Height "ITBar7Height" - ? -   (File not found | COM-object registry key not found)
<binary data> "ITBar7Layout" - ? -   (File not found | COM-object registry key not found)
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} "Java Plug-in 1.6.0_07" - "Oracle Corporation" - C:\Program Files\Java\jre7\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
{CAFEEFAC-0017-0000-0005-ABCDEFFEDCBA} "Java Plug-in 1.7.0_05" - "Oracle Corporation" - C:\Program Files\Java\jre7\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_05-windows-i586.cab
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 10.7.2" - "Oracle Corporation" - C:\Program Files\Java\jre7\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
{7530BFB8-7293-4D34-9923-61A11451AFC5} "OnlineScanner Control" - "ESET" - C:\PROGRA~1\ESET\ESETON~1\ONLINE~1.OCX / hxxp://download.eset.com/special/eos/OnlineScanner.cab
{8AD9C840-044E-11D1-B3E9-00805F499D93} "{8AD9C840-044E-11D1-B3E9-00805F499D93}" - "Oracle Corporation" - C:\Program Files\Java\jre7\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_05-windows-i586.cab
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
{B63DBA5F-523F-4B9C-A43D-65DF1977EAD3} "@C:\Program Files\Windows Live\Companion\companionlang.dll,-600" - "Microsoft Corporation" - C:\Program Files\Windows Live\Companion\companioncore.dll
{5F7B1267-94A9-47F5-98DB-E99415F33AEC} "@C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004" - "Microsoft Corporation" - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
{898EA8C8-E7FF-479B-8935-AEC46303B9E5} "Skype Click to Call" - "Skype Technologies S.A." - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----
{9421DD08-935F-4701-A9CA-22DF90AC4EA6} "Easy Photo Print" - "SEIKO EPSON CORPORATION / CyCom Technology Corp." - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll
<binary data> "Google Toolbar" - "Google Inc." - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
{9421DD08-935F-4701-A9CA-22DF90AC4EA6} "Easy Photo Print" - "SEIKO EPSON CORPORATION / CyCom Technology Corp." - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll
{AA58ED58-01DD-4d91-8333-CF10577473F7} "Google Toolbar Helper" - "Google Inc." - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
{AF69DE43-7D58-4638-B6FA-CE66B5AD205D} "Google Toolbar Notifier BHO" - ? - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5805.1910\swg.dll  (File not found)
{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Oracle Corporation" - C:\Program Files\Java\jre7\bin\jp2ssv.dll
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} "Java(tm) Plug-In SSV Helper" - "Oracle Corporation" - C:\Program Files\Java\jre7\bin\ssv.dll
{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} "Skype Browser Helper" - "Skype Technologies S.A." - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
{9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live ID Sign-in Helper" - "Microsoft Corp." - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
{9FDDE16B-836F-4806-AB1F-1455CBEFF289} "Windows Live Messenger Companion Helper" - "Microsoft Corporation" - C:\Program Files\Windows Live\Companion\companioncore.dll

[Logon]
-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----
"StartupPrograms" - ? - rdpclip  (File not found)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"avgnt" - "Avira Operations GmbH & Co. KG" - "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
"Malwarebytes' Anti-Malware" - "Malwarebytes Corporation" - "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
"QuickTime Task" - "Apple Inc." - "C:\Program Files\QuickTime\QTTask.exe" -atboottime
"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Program Files\Common Files\Java\Java Update\jusched.exe"

[Print Monitors]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----
"Canon BJ Language Monitor iP4500 series" - "CANON INC." - C:\Windows\system32\CNMLM92.DLL
"EpsonNet Print Port" - "SEIKO EPSON CORPORATION" - C:\Windows\system32\enppmon.dll

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"@c:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe,-100" (WPFFontCache_v0400) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
"ABBYY FineReader 9.0 Sprint Licensing Service" (ABBYY.Licensing.FineReader.Sprint.9.0) - "ABBYY" - C:\Program Files\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe
"Adobe Acrobat Update Service" (AdobeARMservice) - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
"Avira Echtzeit Scanner" (AntiVirService) - "Avira Operations GmbH & Co. KG" - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
"Avira Planer" (AntiVirSchedulerService) - "Avira Operations GmbH & Co. KG" - C:\Program Files\Avira\AntiVir Desktop\sched.exe
"Cyberlink RichVideo Service(CRVS)" (RichVideo) - ? - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
"Google Software Updater" (gusvc) - "Google" - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
"Google Update Service (gupdate)" (gupdate) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"Google Update-Dienst (gupdatem)" (gupdatem) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"MBAMService" (MBAMService) - "Malwarebytes Corporation" - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
"Nero BackItUp Scheduler 3" (Nero BackItUp Scheduler 3) - "Nero AG" - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
"NMIndexingService" (NMIndexingService) - "Nero AG" - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
"PLFlash DeviceIoControl Service" (PLFlash DeviceIoControl Service) - "Prolific Technology Inc." - C:\Windows\system32\IoctlSvc.exe
"ProtexisLicensing" (ProtexisLicensing) - ? - C:\Windows\system32\PSIService.exe
"Skype C2C Service" (Skype C2C Service) - "Skype Technologies S.A." - C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
"Skype Updater" (SkypeUpdate) - "Skype Technologies" - C:\Program Files\Skype\Updater\Updater.exe
"System Store" (SystemStore) - ? - C:\Program Files\Freemium\SystemStore\Freemium.SystemStore.WindowsService.exe
"Windows Live Family Safety Service" (fsssvc) - "Microsoft Corporation" - C:\Program Files\Windows Live\Family Safety\fsssvc.exe
"Windows Live ID Sign-in Assistant" (wlidsvc) - "Microsoft Corp." - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
"X10 Device Network Service" (x10nets) - "X10" - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

===[ Logfile end ]=========================================[ Logfile end ]===

--- --- ---

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru
...und hier das aswmbr-log- auch dieses log war erst bei Speicherung auf C: lesbar, nicht aber bei Speicherung auf dem desktop...
Code:
aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-09-04 22:43:25
-----------------------------
22:43:25.301    OS Version: Windows 6.0.6002 Service Pack 2
22:43:25.301    Number of processors: 2 586 0xF0D
22:43:25.302    ComputerName: GERRIT-PC  UserName: Admin
22:44:06.953    Initialize success
22:46:55.082    AVAST engine defs: 12090401
22:47:01.596    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\00000058
22:47:01.600    Disk 0 Vendor: WDC_WD32 11.0 Size: 305245MB BusType: 3
22:47:01.617    Disk 0 MBR read successfully
22:47:01.621    Disk 0 MBR scan
22:47:01.632    Disk 0 Windows VISTA default MBR code
22:47:01.642    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS      289040 MB offset 2048
22:47:01.679    Disk 0 Partition 2 00    0C    FAT32 LBA MSWIN4.1    16203 MB offset 591955968
22:47:01.694    Disk 0 scanning sectors +625139712
22:47:01.777    Disk 0 scanning C:\Windows\system32\drivers
22:47:18.104    Service scanning
22:47:44.360    Modules scanning
22:47:53.826    Disk 0 trace - called modules:
22:47:53.862    ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll storport.sys nvstor32.sys
22:47:53.872    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x85594690]
22:47:53.880    3 CLASSPNP.SYS[889a38b3] -> nt!IofCallDriver -> [0x84637f08]
22:47:53.888    5 acpi.sys[806976bc] -> nt!IofCallDriver -> \Device\00000058[0x8463cc90]
22:47:56.951    AVAST engine scan C:\Windows
22:48:06.279    AVAST engine scan C:\Windows\system32
22:53:30.183    AVAST engine scan C:\Windows\system32\drivers
22:54:03.097    AVAST engine scan C:\Users\Admin
22:55:18.643    AVAST engine scan C:\ProgramData
22:56:17.151    Scan finished successfully
22:57:48.485    Disk 0 MBR has been saved successfully to "C:\Users\Admin\Desktop\MBR.dat"
22:57:48.493    The log file has been saved successfully to "C:\Users\Admin\Desktop\aswMBR.txt"
22:59:07.031    Disk 0 MBR has been saved successfully to "C:\MBR.dat"
22:59:07.039    The log file has been saved successfully to "C:\aswMBR.txt"
Hier nochmal das OSAM-log - das weiter oben hat irgendwie ein unlesbares Format bekommen:
Code:
OSAM Logfile:

       
Code:

       
Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 22:15:49 on 04.09.2012

OS: Windows Vista Home Premium Edition Service Pack 2 (Build 6002), 32-bit
Default Browser: Microsoft Corporation Internet Explorer 9.00.8112.16421

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries


[Common]
-----( %SystemRoot%\Tasks )-----
"GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe

[Control Panel Objects]
-----( %SystemRoot%\system32 )-----
"FlashPlayerCPLApp.cpl" - "Adobe Systems Incorporated" - C:\Windows\system32\FlashPlayerCPLApp.cpl
"ISUSPM.cpl" - "Macrovision Corporation" - C:\Windows\system32\ISUSPM.cpl
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"Nero BurnRights" - "Nero AG" - C:\Program Files\Nero\Nero8\Nero Toolkit\NeroBurnRights.cpl
"QuickTime" - "Apple Inc." - C:\Program Files\QuickTime\QTSystem\QuickTime.cpl

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"avgntflt" (avgntflt) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avgntflt.sys
"avipbb" (avipbb) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avipbb.sys
"avkmgr" (avkmgr) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avkmgr.sys
"catchme" (catchme) - ? - C:\Users\Admin\AppData\Local\Temp\catchme.sys  (File not found)
"FssFltr" (fssfltr) - "Microsoft Corporation" - C:\Windows\System32\DRIVERS\fssfltr.sys
"IP in IP Tunnel Driver" (IpInIp) - ? - C:\Windows\System32\DRIVERS\ipinip.sys  (File not found)
"IPX Traffic Filter Driver" (NwlnkFlt) - ? - C:\Windows\System32\DRIVERS\nwlnkflt.sys  (File not found)
"IPX Traffic Forwarder Driver" (NwlnkFwd) - ? - C:\Windows\System32\DRIVERS\nwlnkfwd.sys  (File not found)
"MBAMProtector" (MBAMProtector) - "Malwarebytes Corporation" - C:\Windows\system32\drivers\mbam.sys
"NXP service" (PhilCap) - "NXP Semiconductors Germany GmbH" - C:\Windows\System32\DRIVERS\PhilCap.sys
"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\Windows\System32\DRIVERS\ssmdrv.sys

[Explorer]
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
-----( HKLM\Software\Classes\Protocols\Handler )-----
{E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} "Album Download IE Asynchronous Pluggable Protocol Interface" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
{828030A1-22C1-4009-854F-8E305202313F} "livecall" - "Microsoft Corporation" - C:\Program Files\Windows Live\Messenger\msgrapp.dll
{0A9007C0-4076-11D3-8789-0000F8105754} "Microsoft Infotech Storage Protocol for IE 4.0" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll
{828030A1-22C1-4009-854F-8E305202313F} "msnim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Messenger\msgrapp.dll
{91774881-D725-4E58-B298-07617B9B86A8} "Skype IE add-on Pluggable Protocol" - "Skype Technologies S.A." - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
{03C514A3-1EFB-4856-9F99-10D7BE1653C0} "Windows Live Mail HTML Asynchronous Pluggable Protocol Handler" - "Microsoft Corporation" - C:\Program Files\Windows Live\Mail\mailcomm.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{911051fa-c21c-4246-b470-070cd8df6dc4} ".cab or .zip files" - ? -   (File not found | COM-object registry key not found)
{1b24a030-9b20-49bc-97ac-1be4426f9e59} "ActiveDirectory Folder" - ? -   (File not found | COM-object registry key not found)
{34449847-FD14-4fc8-A75A-7432F5181EFB} "ActiveDirectory Folder" - ? -   (File not found | COM-object registry key not found)
{0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48} "Contacts folder" - ? -   (File not found | COM-object registry key not found)
{2C2577C2-63A7-40e3-9B7F-586602617ECB} "Explorer Query Band" - ? -   (File not found | COM-object registry key not found)
{FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75} "IE User Assist" - ? -   (File not found | COM-object registry key not found)
{00020d75-0000-0000-c000-000000000046} "lnkfile" - ? -   (File not found | COM-object registry key not found)
{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
{97F68CE3-7146-45FF-BE24-D9A7DD7CB8A2} "NeroCoverEdLiveIcons Class" - "Nero AG" - C:\Program Files\Nero\Nero8\Nero CoverDesigner\CoverEdExtension.dll
{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "OpenOffice.org Column Handler" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{087B3AE3-E237-4467-B8DB-5A38AB959AC9} "OpenOffice.org Infotip Handler" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{AE424E85-F6DF-4910-A6A9-438797986431} "OpenOffice.org Property Handler" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\propertyhdl.dll
{63542C48-9552-494A-84F7-73AA6A7C99C1} "OpenOffice.org Property Sheet Handler" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{3B092F0C-7696-40E3-A80F-68D74DA84210} "OpenOffice.org Thumbnail Viewer" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{C8494E42-ACDD-4739-B0FB-217361E4894F} "Sam Account Folder" - ? -   (File not found | COM-object registry key not found)
{E29F9716-5C08-4FCD-955A-119FDB5A522D} "Sam Account Folder" - ? -   (File not found | COM-object registry key not found)
{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira Operations GmbH & Co. KG" - C:\Program Files\Avira\AntiVir Desktop\shlext.dll
{6F5C0F40-1419-4DC8-8D2F-D5EC5FCF07AB} "Sprint.ExplorerIntegration.9" - "ABBYY" - C:\Program Files\Common Files\ABBYY\FineReaderSprint\9.00\Integration\SprintIntegration.dll
{2BE99FD4-A181-4996-BFA9-58C5FFD11F6C} "Windows Live Photo Gallery Autoplay Drop Target" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoGallery.exe
{00F30F64-AC33-42F5-8FD1-5DC2D3FDE06C} "Windows Live Photo Gallery Editor Drop Target" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoGallery.exe
{00F3712A-CA79-45B4-9E4D-D7891E7F8B9D} "Windows Live Photo Gallery Editor Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll
{00F30F90-3E96-453B-AFCD-D71989ECC2C7} "Windows Live Photo Gallery Viewer Autoplay Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll
{00F33137-EE26-412F-8D71-F84E4C2C6625} "Windows Live Photo Gallery Viewer Autoplay Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll
{00F374B7-B390-4884-B372-2FC349F2172B} "Windows Live Photo Gallery Viewer Drop Target" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoGallery.exe
{00F346CB-35A4-465B-8B8F-65A29DBAB1F6} "Windows Live Photo Gallery Viewer Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll
{da67b8ad-e81b-4c70-9b91b417b5e33527} "Windows Search Shell Service" - ? -   (File not found | COM-object registry key not found)
{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - "Alexander Roshal" - C:\Program Files\WinRAR\rarext.dll
{0563DB41-F538-4B37-A92D-4659049B7766} "WLMD Message Handler" - ? -   (File not found | COM-object registry key not found)
{06A2568A-CED6-4187-BB20-400B8C02BE5A} "{06A2568A-CED6-4187-BB20-400B8C02BE5A}" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoAcquireWizard.exe

[Internet Explorer]
-----( HKCU\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
"eBay - Der weltweite Online-Marktplatz" - ? - hxxp://rover.ebay.com/rover/1/707-37276-17534-15/4  (HTTP value)
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
<binary data> "Google Toolbar" - "Google Inc." - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
ITBar7Height "ITBar7Height" - ? -   (File not found | COM-object registry key not found)
<binary data> "ITBar7Layout" - ? -   (File not found | COM-object registry key not found)
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} "Java Plug-in 1.6.0_07" - "Oracle Corporation" - C:\Program Files\Java\jre7\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
{CAFEEFAC-0017-0000-0005-ABCDEFFEDCBA} "Java Plug-in 1.7.0_05" - "Oracle Corporation" - C:\Program Files\Java\jre7\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_05-windows-i586.cab
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 10.7.2" - "Oracle Corporation" - C:\Program Files\Java\jre7\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
{7530BFB8-7293-4D34-9923-61A11451AFC5} "OnlineScanner Control" - "ESET" - C:\PROGRA~1\ESET\ESETON~1\ONLINE~1.OCX / hxxp://download.eset.com/special/eos/OnlineScanner.cab
{8AD9C840-044E-11D1-B3E9-00805F499D93} "{8AD9C840-044E-11D1-B3E9-00805F499D93}" - "Oracle Corporation" - C:\Program Files\Java\jre7\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_05-windows-i586.cab
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
{B63DBA5F-523F-4B9C-A43D-65DF1977EAD3} "@C:\Program Files\Windows Live\Companion\companionlang.dll,-600" - "Microsoft Corporation" - C:\Program Files\Windows Live\Companion\companioncore.dll
{5F7B1267-94A9-47F5-98DB-E99415F33AEC} "@C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004" - "Microsoft Corporation" - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
{898EA8C8-E7FF-479B-8935-AEC46303B9E5} "Skype Click to Call" - "Skype Technologies S.A." - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----
{9421DD08-935F-4701-A9CA-22DF90AC4EA6} "Easy Photo Print" - "SEIKO EPSON CORPORATION / CyCom Technology Corp." - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll
<binary data> "Google Toolbar" - "Google Inc." - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
{9421DD08-935F-4701-A9CA-22DF90AC4EA6} "Easy Photo Print" - "SEIKO EPSON CORPORATION / CyCom Technology Corp." - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll
{AA58ED58-01DD-4d91-8333-CF10577473F7} "Google Toolbar Helper" - "Google Inc." - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
{AF69DE43-7D58-4638-B6FA-CE66B5AD205D} "Google Toolbar Notifier BHO" - ? - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5805.1910\swg.dll  (File not found)
{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Oracle Corporation" - C:\Program Files\Java\jre7\bin\jp2ssv.dll
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} "Java(tm) Plug-In SSV Helper" - "Oracle Corporation" - C:\Program Files\Java\jre7\bin\ssv.dll
{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} "Skype Browser Helper" - "Skype Technologies S.A." - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
{9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live ID Sign-in Helper" - "Microsoft Corp." - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
{9FDDE16B-836F-4806-AB1F-1455CBEFF289} "Windows Live Messenger Companion Helper" - "Microsoft Corporation" - C:\Program Files\Windows Live\Companion\companioncore.dll

[Logon]
-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----
"StartupPrograms" - ? - rdpclip  (File not found)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"avgnt" - "Avira Operations GmbH & Co. KG" - "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
"Malwarebytes' Anti-Malware" - "Malwarebytes Corporation" - "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
"QuickTime Task" - "Apple Inc." - "C:\Program Files\QuickTime\QTTask.exe" -atboottime
"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Program Files\Common Files\Java\Java Update\jusched.exe"

[Print Monitors]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----
"Canon BJ Language Monitor iP4500 series" - "CANON INC." - C:\Windows\system32\CNMLM92.DLL
"EpsonNet Print Port" - "SEIKO EPSON CORPORATION" - C:\Windows\system32\enppmon.dll

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"@c:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe,-100" (WPFFontCache_v0400) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
"ABBYY FineReader 9.0 Sprint Licensing Service" (ABBYY.Licensing.FineReader.Sprint.9.0) - "ABBYY" - C:\Program Files\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe
"Adobe Acrobat Update Service" (AdobeARMservice) - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
"Avira Echtzeit Scanner" (AntiVirService) - "Avira Operations GmbH & Co. KG" - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
"Avira Planer" (AntiVirSchedulerService) - "Avira Operations GmbH & Co. KG" - C:\Program Files\Avira\AntiVir Desktop\sched.exe
"Cyberlink RichVideo Service(CRVS)" (RichVideo) - ? - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
"Google Software Updater" (gusvc) - "Google" - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
"Google Update Service (gupdate)" (gupdate) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"Google Update-Dienst (gupdatem)" (gupdatem) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"MBAMService" (MBAMService) - "Malwarebytes Corporation" - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
"Nero BackItUp Scheduler 3" (Nero BackItUp Scheduler 3) - "Nero AG" - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
"NMIndexingService" (NMIndexingService) - "Nero AG" - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
"PLFlash DeviceIoControl Service" (PLFlash DeviceIoControl Service) - "Prolific Technology Inc." - C:\Windows\system32\IoctlSvc.exe
"ProtexisLicensing" (ProtexisLicensing) - ? - C:\Windows\system32\PSIService.exe
"Skype C2C Service" (Skype C2C Service) - "Skype Technologies S.A." - C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
"Skype Updater" (SkypeUpdate) - "Skype Technologies" - C:\Program Files\Skype\Updater\Updater.exe
"System Store" (SystemStore) - ? - C:\Program Files\Freemium\SystemStore\Freemium.SystemStore.WindowsService.exe
"Windows Live Family Safety Service" (fsssvc) - "Microsoft Corporation" - C:\Program Files\Windows Live\Family Safety\fsssvc.exe
"Windows Live ID Sign-in Assistant" (wlidsvc) - "Microsoft Corp." - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
"X10 Device Network Service" (x10nets) - "X10" - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

===[ Logfile end ]=========================================[ Logfile end ]===

--- --- ---

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru
...und ich verstehe, die scheinbar nicht lesbaren logs waren auf dem admin-desktop gespeichert, nicht dem user-desktop...

...noch ein Versuch für das hier im thread unlesbar osam-log:

Code:
[Common]
-----( %SystemRoot%\Tasks )-----
"GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe

[Control Panel Objects]
-----( %SystemRoot%\system32 )-----
"FlashPlayerCPLApp.cpl" - "Adobe Systems Incorporated" - C:\Windows\system32\FlashPlayerCPLApp.cpl
"ISUSPM.cpl" - "Macrovision Corporation" - C:\Windows\system32\ISUSPM.cpl
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"Nero BurnRights" - "Nero AG" - C:\Program Files\Nero\Nero8\Nero Toolkit\NeroBurnRights.cpl
"QuickTime" - "Apple Inc." - C:\Program Files\QuickTime\QTSystem\QuickTime.cpl

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"avgntflt" (avgntflt) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avgntflt.sys
"avipbb" (avipbb) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avipbb.sys
"avkmgr" (avkmgr) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avkmgr.sys
"catchme" (catchme) - ? - C:\Users\Admin\AppData\Local\Temp\catchme.sys  (File not found)
"FssFltr" (fssfltr) - "Microsoft Corporation" - C:\Windows\System32\DRIVERS\fssfltr.sys
"IP in IP Tunnel Driver" (IpInIp) - ? - C:\Windows\System32\DRIVERS\ipinip.sys  (File not found)
"IPX Traffic Filter Driver" (NwlnkFlt) - ? - C:\Windows\System32\DRIVERS\nwlnkflt.sys  (File not found)
"IPX Traffic Forwarder Driver" (NwlnkFwd) - ? - C:\Windows\System32\DRIVERS\nwlnkfwd.sys  (File not found)
"MBAMProtector" (MBAMProtector) - "Malwarebytes Corporation" - C:\Windows\system32\drivers\mbam.sys
"NXP service" (PhilCap) - "NXP Semiconductors Germany GmbH" - C:\Windows\System32\DRIVERS\PhilCap.sys
"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\Windows\System32\DRIVERS\ssmdrv.sys

[Explorer]
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
-----( HKLM\Software\Classes\Protocols\Handler )-----
{E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} "Album Download IE Asynchronous Pluggable Protocol Interface" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
{828030A1-22C1-4009-854F-8E305202313F} "livecall" - "Microsoft Corporation" - C:\Program Files\Windows Live\Messenger\msgrapp.dll
{0A9007C0-4076-11D3-8789-0000F8105754} "Microsoft Infotech Storage Protocol for IE 4.0" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll
{828030A1-22C1-4009-854F-8E305202313F} "msnim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Messenger\msgrapp.dll
{91774881-D725-4E58-B298-07617B9B86A8} "Skype IE add-on Pluggable Protocol" - "Skype Technologies S.A." - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
{03C514A3-1EFB-4856-9F99-10D7BE1653C0} "Windows Live Mail HTML Asynchronous Pluggable Protocol Handler" - "Microsoft Corporation" - C:\Program Files\Windows Live\Mail\mailcomm.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{911051fa-c21c-4246-b470-070cd8df6dc4} ".cab or .zip files" - ? -  (File not found | COM-object registry key not found)
{1b24a030-9b20-49bc-97ac-1be4426f9e59} "ActiveDirectory Folder" - ? -  (File not found | COM-object registry key not found)
{34449847-FD14-4fc8-A75A-7432F5181EFB} "ActiveDirectory Folder" - ? -  (File not found | COM-object registry key not found)
{0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48} "Contacts folder" - ? -  (File not found | COM-object registry key not found)
{2C2577C2-63A7-40e3-9B7F-586602617ECB} "Explorer Query Band" - ? -  (File not found | COM-object registry key not found)
{FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75} "IE User Assist" - ? -  (File not found | COM-object registry key not found)
{00020d75-0000-0000-c000-000000000046} "lnkfile" - ? -  (File not found | COM-object registry key not found)
{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
{97F68CE3-7146-45FF-BE24-D9A7DD7CB8A2} "NeroCoverEdLiveIcons Class" - "Nero AG" - C:\Program Files\Nero\Nero8\Nero CoverDesigner\CoverEdExtension.dll
{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "OpenOffice.org Column Handler" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{087B3AE3-E237-4467-B8DB-5A38AB959AC9} "OpenOffice.org Infotip Handler" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{AE424E85-F6DF-4910-A6A9-438797986431} "OpenOffice.org Property Handler" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\propertyhdl.dll
{63542C48-9552-494A-84F7-73AA6A7C99C1} "OpenOffice.org Property Sheet Handler" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{3B092F0C-7696-40E3-A80F-68D74DA84210} "OpenOffice.org Thumbnail Viewer" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{C8494E42-ACDD-4739-B0FB-217361E4894F} "Sam Account Folder" - ? -  (File not found | COM-object registry key not found)
{E29F9716-5C08-4FCD-955A-119FDB5A522D} "Sam Account Folder" - ? -  (File not found | COM-object registry key not found)
{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira Operations GmbH & Co. KG" - C:\Program Files\Avira\AntiVir Desktop\shlext.dll
{6F5C0F40-1419-4DC8-8D2F-D5EC5FCF07AB} "Sprint.ExplorerIntegration.9" - "ABBYY" - C:\Program Files\Common Files\ABBYY\FineReaderSprint\9.00\Integration\SprintIntegration.dll
{2BE99FD4-A181-4996-BFA9-58C5FFD11F6C} "Windows Live Photo Gallery Autoplay Drop Target" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoGallery.exe
{00F30F64-AC33-42F5-8FD1-5DC2D3FDE06C} "Windows Live Photo Gallery Editor Drop Target" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoGallery.exe
{00F3712A-CA79-45B4-9E4D-D7891E7F8B9D} "Windows Live Photo Gallery Editor Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll
{00F30F90-3E96-453B-AFCD-D71989ECC2C7} "Windows Live Photo Gallery Viewer Autoplay Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll
{00F33137-EE26-412F-8D71-F84E4C2C6625} "Windows Live Photo Gallery Viewer Autoplay Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll
{00F374B7-B390-4884-B372-2FC349F2172B} "Windows Live Photo Gallery Viewer Drop Target" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoGallery.exe
{00F346CB-35A4-465B-8B8F-65A29DBAB1F6} "Windows Live Photo Gallery Viewer Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll
{da67b8ad-e81b-4c70-9b91b417b5e33527} "Windows Search Shell Service" - ? -  (File not found | COM-object registry key not found)
{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - "Alexander Roshal" - C:\Program Files\WinRAR\rarext.dll
{0563DB41-F538-4B37-A92D-4659049B7766} "WLMD Message Handler" - ? -  (File not found | COM-object registry key not found)
{06A2568A-CED6-4187-BB20-400B8C02BE5A} "{06A2568A-CED6-4187-BB20-400B8C02BE5A}" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoAcquireWizard.exe

[Internet Explorer]
-----( HKCU\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
"eBay - Der weltweite Online-Marktplatz" - ? - hxxp://rover.ebay.com/rover/1/707-37276-17534-15/4  (HTTP value)
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
<binary data> "Google Toolbar" - "Google Inc." - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
ITBar7Height "ITBar7Height" - ? -  (File not found | COM-object registry key not found)
<binary data> "ITBar7Layout" - ? -  (File not found | COM-object registry key not found)
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} "Java Plug-in 1.6.0_07" - "Oracle Corporation" - C:\Program Files\Java\jre7\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
{CAFEEFAC-0017-0000-0005-ABCDEFFEDCBA} "Java Plug-in 1.7.0_05" - "Oracle Corporation" - C:\Program Files\Java\jre7\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_05-windows-i586.cab
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 10.7.2" - "Oracle Corporation" - C:\Program Files\Java\jre7\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
{7530BFB8-7293-4D34-9923-61A11451AFC5} "OnlineScanner Control" - "ESET" - C:\PROGRA~1\ESET\ESETON~1\ONLINE~1.OCX / hxxp://download.eset.com/special/eos/OnlineScanner.cab
{8AD9C840-044E-11D1-B3E9-00805F499D93} "{8AD9C840-044E-11D1-B3E9-00805F499D93}" - "Oracle Corporation" - C:\Program Files\Java\jre7\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_05-windows-i586.cab
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
{B63DBA5F-523F-4B9C-A43D-65DF1977EAD3} "@C:\Program Files\Windows Live\Companion\companionlang.dll,-600" - "Microsoft Corporation" - C:\Program Files\Windows Live\Companion\companioncore.dll
{5F7B1267-94A9-47F5-98DB-E99415F33AEC} "@C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004" - "Microsoft Corporation" - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
{898EA8C8-E7FF-479B-8935-AEC46303B9E5} "Skype Click to Call" - "Skype Technologies S.A." - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----
{9421DD08-935F-4701-A9CA-22DF90AC4EA6} "Easy Photo Print" - "SEIKO EPSON CORPORATION / CyCom Technology Corp." - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll
<binary data> "Google Toolbar" - "Google Inc." - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
{9421DD08-935F-4701-A9CA-22DF90AC4EA6} "Easy Photo Print" - "SEIKO EPSON CORPORATION / CyCom Technology Corp." - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll
{AA58ED58-01DD-4d91-8333-CF10577473F7} "Google Toolbar Helper" - "Google Inc." - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
{AF69DE43-7D58-4638-B6FA-CE66B5AD205D} "Google Toolbar Notifier BHO" - ? - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5805.1910\swg.dll  (File not found)
{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Oracle Corporation" - C:\Program Files\Java\jre7\bin\jp2ssv.dll
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} "Java(tm) Plug-In SSV Helper" - "Oracle Corporation" - C:\Program Files\Java\jre7\bin\ssv.dll
{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} "Skype Browser Helper" - "Skype Technologies S.A." - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
{9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live ID Sign-in Helper" - "Microsoft Corp." - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
{9FDDE16B-836F-4806-AB1F-1455CBEFF289} "Windows Live Messenger Companion Helper" - "Microsoft Corporation" - C:\Program Files\Windows Live\Companion\companioncore.dll

[Logon]
-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----
"StartupPrograms" - ? - rdpclip  (File not found)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"avgnt" - "Avira Operations GmbH & Co. KG" - "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
"Malwarebytes' Anti-Malware" - "Malwarebytes Corporation" - "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
"QuickTime Task" - "Apple Inc." - "C:\Program Files\QuickTime\QTTask.exe" -atboottime
"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Program Files\Common Files\Java\Java Update\jusched.exe"

[Print Monitors]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----
"Canon BJ Language Monitor iP4500 series" - "CANON INC." - C:\Windows\system32\CNMLM92.DLL
"EpsonNet Print Port" - "SEIKO EPSON CORPORATION" - C:\Windows\system32\enppmon.dll

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"@c:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe,-100" (WPFFontCache_v0400) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
"ABBYY FineReader 9.0 Sprint Licensing Service" (ABBYY.Licensing.FineReader.Sprint.9.0) - "ABBYY" - C:\Program Files\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe
"Adobe Acrobat Update Service" (AdobeARMservice) - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
"Avira Echtzeit Scanner" (AntiVirService) - "Avira Operations GmbH & Co. KG" - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
"Avira Planer" (AntiVirSchedulerService) - "Avira Operations GmbH & Co. KG" - C:\Program Files\Avira\AntiVir Desktop\sched.exe
"Cyberlink RichVideo Service(CRVS)" (RichVideo) - ? - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
"Google Software Updater" (gusvc) - "Google" - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
"Google Update Service (gupdate)" (gupdate) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"Google Update-Dienst (gupdatem)" (gupdatem) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"MBAMService" (MBAMService) - "Malwarebytes Corporation" - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
"Nero BackItUp Scheduler 3" (Nero BackItUp Scheduler 3) - "Nero AG" - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
"NMIndexingService" (NMIndexingService) - "Nero AG" - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
"PLFlash DeviceIoControl Service" (PLFlash DeviceIoControl Service) - "Prolific Technology Inc." - C:\Windows\system32\IoctlSvc.exe
"ProtexisLicensing" (ProtexisLicensing) - ? - C:\Windows\system32\PSIService.exe
"Skype C2C Service" (Skype C2C Service) - "Skype Technologies S.A." - C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
"Skype Updater" (SkypeUpdate) - "Skype Technologies" - C:\Program Files\Skype\Updater\Updater.exe
"System Store" (SystemStore) - ? - C:\Program Files\Freemium\SystemStore\Freemium.SystemStore.WindowsService.exe
"Windows Live Family Safety Service" (fsssvc) - "Microsoft Corporation" - C:\Program Files\Windows Live\Family Safety\fsssvc.exe
"Windows Live ID Sign-in Assistant" (wlidsvc) - "Microsoft Corp." - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
"X10 Device Network Service" (x10nets) - "X10" - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

===[ Logfile end ]=========================================[ Logfile end ]===

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru

cosinus 05.09.2012 12:15
Da muss noch ein Registry-Key weg!

Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":reg" muss mitkopiert werden!!!)

Code:
:reg
[-HKLM\SOFTWARE\Classes\CLSID\{B6A930A0-A4F5-43A5-9B4E-6189A6C2B9E8}@{!s!]
[-HKLM\SOFTWARE\Classes\CLSID\{B6A930A0-A4F5-43A5-9B4E-6189A6C2B9E8}]
:Files
ipconfig /flushdns /c
:Commands
[purity]
[emptytemp]
[emptyflash]
[resethosts]
Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

IamShine 09.09.2012 08:01
Hallo cosinus,

hier das OTL.fix-log:
Code:
All processes killed
========== REGISTRY ==========
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B6A930A0-A4F5-43A5-9B4E-6189A6C2B9E8}@{!s!\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B6A930A0-A4F5-43A5-9B4E-6189A6C2B9E8}@{!s!\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B6A930A0-A4F5-43A5-9B4E-6189A6C2B9E8}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B6A930A0-A4F5-43A5-9B4E-6189A6C2B9E8}\ not found.
========== FILES ==========
< ipconfig /flushdns /c >
Windows-IP-Konfiguration
Der DNS-Aufl”sungscache wurde geleert.
C:\Users\Gerrit\Desktop\cmd.bat deleted successfully.
C:\Users\Gerrit\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: Admin
->Temp folder emptied: 92862492 bytes
->Temporary Internet Files folder emptied: 223098791 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Gast
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Gerrit
->Temp folder emptied: 56936 bytes
->Temporary Internet Files folder emptied: 228813284 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 2508 bytes
 
User: Public
->Temp folder emptied: 0 bytes
 
User: TEMP
->Temp folder emptied: 0 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 119064985 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 633,00 mb
 
 
[EMPTYFLASH]
 
User: Admin
->Flash cache emptied: 0 bytes
 
User: All Users
 
User: Default
 
User: Default User
 
User: Gast
 
User: Gerrit
->Flash cache emptied: 0 bytes
 
User: Public
 
User: TEMP
 
Total Flash Files Cleaned = 0,00 mb
 
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
OTL by OldTimer - Version 3.2.61.2 log created on 09092012_085254

Files\Folders moved on Reboot...

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

cosinus 10.09.2012 15:46
Sieht ok aus. Wir sollten fast durch sein. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

IamShine 13.09.2012 22:48
Hallo cosinus,

habe nun Firefox installiert und kann mich darüber wieder normal im Board anmelden,und sehe auch die aktuellen Einträge wieder...

Hier das Log zu SUPERAntiSpyware, habe noch nichts gelöscht:
Code:
SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com

Generated 09/13/2012 at 11:35 PM

Application Version : 5.5.1016

Core Rules Database Version : 9223
Trace Rules Database Version: 7035

Scan type      : Complete Scan
Total Scan Time : 02:14:53

Operating System Information
Windows Vista Home Premium 32-bit, Service Pack 2 (Build 6.00.6002)
UAC Off - Administrator (Limited User)

Memory items scanned      : 685
Memory threats detected  : 0
Registry items scanned    : 38119
Registry threats detected : 0
File items scanned        : 164872
File threats detected    : 338

Adware.Tracking Cookie
        C:\Users\Gerrit\AppData\Roaming\Microsoft\Windows\Cookies\gerrit@msnportal.112.2o7[2].txt [ /msnportal.112.2o7 ]
        C:\Users\Gerrit\AppData\Roaming\Microsoft\Windows\Cookies\TVVOGBIS.txt [ /liveperson.net ]
        C:\Users\Gerrit\AppData\Roaming\Microsoft\Windows\Cookies\ZPIMTM6T.txt [ /eas4.emediate.eu ]
        C:\Users\Gerrit\AppData\Roaming\Microsoft\Windows\Cookies\OC780X7J.txt [ /mediaplex.com ]
        C:\Users\Gerrit\AppData\Roaming\Microsoft\Windows\Cookies\ZH9OK866.txt [ /revsci.net ]
        C:\Users\Gerrit\AppData\Roaming\Microsoft\Windows\Cookies\AD8DHEDQ.txt [ /ad4.adfarm1.adition.com ]
        C:\Users\Gerrit\AppData\Roaming\Microsoft\Windows\Cookies\BAXQAQXZ.txt [ /tradetracker.net ]
        C:\Users\Gerrit\AppData\Roaming\Microsoft\Windows\Cookies\VHUCAEBS.txt [ /ads.creative-serving.com ]
        C:\Users\Gerrit\AppData\Roaming\Microsoft\Windows\Cookies\EH5GZR3J.txt [ /ero-advertising.com ]
        C:\Users\Gerrit\AppData\Roaming\Microsoft\Windows\Cookies\P81F3WSB.txt [ /im.banner.t-online.de ]
        C:\Users\Gerrit\AppData\Roaming\Microsoft\Windows\Cookies\0MC22OMO.txt [ /www.zanox-affiliate.de ]
        C:\Users\Gerrit\AppData\Roaming\Microsoft\Windows\Cookies\P6CM4O5G.txt [ /ad2.adfarm1.adition.com ]
        C:\Users\Gerrit\AppData\Roaming\Microsoft\Windows\Cookies\M021MHH8.txt [ /traffic.brand-wall.net ]
        C:\Users\Gerrit\AppData\Roaming\Microsoft\Windows\Cookies\TDJDKWTH.txt [ /doubleclick.net ]
        C:\Users\Gerrit\AppData\Roaming\Microsoft\Windows\Cookies\HO6NONZJ.txt [ /liveperson.net ]
        C:\Users\Gerrit\AppData\Roaming\Microsoft\Windows\Cookies\9BOYGC8N.txt [ /zanox.com ]
        C:\Users\Gerrit\AppData\Roaming\Microsoft\Windows\Cookies\HAUX91C7.txt [ /7.rotator.wigetmedia.com ]
        C:\Users\Gerrit\AppData\Roaming\Microsoft\Windows\Cookies\YISPSJF0.txt [ /zedo.com ]
        C:\Users\Gerrit\AppData\Roaming\Microsoft\Windows\Cookies\U5ZGGDSL.txt [ /webmasterplan.com ]
        C:\Users\Gerrit\AppData\Roaming\Microsoft\Windows\Cookies\PG7MQDK9.txt [ /fastclick.net ]
        C:\Users\Gerrit\AppData\Roaming\Microsoft\Windows\Cookies\Y78QRP9Q.txt [ /tracking.mindshare.de ]
        C:\Users\Gerrit\AppData\Roaming\Microsoft\Windows\Cookies\T4GEPG5B.txt [ /rotator.wigetmedia.com ]
        C:\Users\Gerrit\AppData\Roaming\Microsoft\Windows\Cookies\3HGA5G1L.txt [ /adfarm1.adition.com ]
        C:\Users\Gerrit\AppData\Roaming\Microsoft\Windows\Cookies\NMB2471G.txt [ /smartadserver.com ]
        C:\Users\Gerrit\AppData\Roaming\Microsoft\Windows\Cookies\H283EVTD.txt [ /ad1.adfarm1.adition.com ]
        C:\Users\Gerrit\AppData\Roaming\Microsoft\Windows\Cookies\XCNU5XZH.txt [ /casalemedia.com ]
        C:\Users\Gerrit\AppData\Roaming\Microsoft\Windows\Cookies\GVGR2KM4.txt [ /imrworldwide.com ]
        C:\Users\Gerrit\AppData\Roaming\Microsoft\Windows\Cookies\8XVN81TB.txt [ /bs.serving-sys.com ]
        C:\Users\Gerrit\AppData\Roaming\Microsoft\Windows\Cookies\K5TEIDNO.txt [ /www.googleadservices.com ]
        C:\Users\Gerrit\AppData\Roaming\Microsoft\Windows\Cookies\RZADDTCX.txt [ /adtech.de ]
        C:\Users\Gerrit\AppData\Roaming\Microsoft\Windows\Cookies\E69JGSRY.txt [ /atdmt.com ]
        C:\Users\Gerrit\AppData\Roaming\Microsoft\Windows\Cookies\Z8JVLL3R.txt [ /c.atdmt.com ]
        C:\Users\Gerrit\AppData\Roaming\Microsoft\Windows\Cookies\Y8S9RKQY.txt [ /stat.onestat.com ]
        C:\Users\Gerrit\AppData\Roaming\Microsoft\Windows\Cookies\DXZU5W51.txt [ /zanox-affiliate.de ]
        C:\Users\Gerrit\AppData\Roaming\Microsoft\Windows\Cookies\Q7UFPCON.txt [ /serving-sys.com ]
        C:\Users\Gerrit\AppData\Roaming\Microsoft\Windows\Cookies\ILAV20BJ.txt [ /apmebf.com ]
        C:\Users\Gerrit\AppData\Roaming\Microsoft\Windows\Cookies\1UHJ2TTA.txt [ /ad3.adfarm1.adition.com ]
        C:\Users\Gerrit\AppData\Roaming\Microsoft\Windows\Cookies\SCY0FOM1.txt [ /companyes.solution.weborama.fr ]
        C:\Users\Gerrit\AppData\Roaming\Microsoft\Windows\Cookies\9U7YTYTS.txt [ /adform.net ]
        C:\Users\Gerrit\AppData\Roaming\Microsoft\Windows\Cookies\L2AK5GWT.txt [ /weborama.fr ]
        C:\Users\Gerrit\AppData\Roaming\Microsoft\Windows\Cookies\DU0SQR63.txt [ /kontera.com ]
        C:\Users\Gerrit\AppData\Roaming\Microsoft\Windows\Cookies\D45SGQFV.txt [ /track.adform.net ]
        C:\Users\Gerrit\AppData\Roaming\Microsoft\Windows\Cookies\BRSR943Q.txt [ /tracking.quisma.com ]
        C:\Users\Gerrit\AppData\Roaming\Microsoft\Windows\Cookies\OZL5XJ1R.txt [ /ad.yieldmanager.com ]
        C:\Users\Gerrit\AppData\Roaming\Microsoft\Windows\Cookies\957DN6WE.txt [ /bwincom.122.2o7.net ]
        C:\Users\Gerrit\AppData\Roaming\Microsoft\Windows\Cookies\6NVCV4VR.txt [ /invitemedia.com ]
        C:\Users\Gerrit\AppData\Roaming\Microsoft\Windows\Cookies\C701WIKU.txt [ /tracker.vinsight.de ]
        C:\Users\Gerrit\AppData\Roaming\Microsoft\Windows\Cookies\IVI8Z8O9.txt [ /guj.122.2o7.net ]
        C:\Users\Gerrit\AppData\Roaming\Microsoft\Windows\Cookies\B4F4ZS8O.txt [ /ad.zanox.com ]
        C:\Users\Gerrit\AppData\Roaming\Microsoft\Windows\Cookies\W2U355NZ.txt [ /ad.360yield.com ]
        C:\Users\Gerrit\AppData\Roaming\Microsoft\Windows\Cookies\7UC632QM.txt [ /ad.wsod.com ]
        C:\Users\Gerrit\AppData\Roaming\Microsoft\Windows\Cookies\10FG8XRJ.txt [ /tradedoubler.com ]
        C:\Users\Gerrit\AppData\Roaming\Microsoft\Windows\Cookies\XCEN2Y8Z.txt [ /adbrite.com ]
        C:\Users\Gerrit\AppData\Roaming\Microsoft\Windows\Cookies\0M3ONOKZ.txt [ /ww251.smartadserver.com ]
        C:\USERS\ADMIN\AppData\Roaming\Microsoft\Windows\Cookies\admin@adfarm1.adition[1].txt [ Cookie:admin@adfarm1.adition.com/ ]
        C:\USERS\ADMIN\AppData\Roaming\Microsoft\Windows\Cookies\I6XG7IA3.txt [ Cookie:admin@eset-online-scanner.softonic.de/ ]
        C:\USERS\ADMIN\AppData\Roaming\Microsoft\Windows\Cookies\TJI4N52V.txt [ Cookie:admin@doubleclick.net/ ]
        C:\USERS\ADMIN\AppData\Roaming\Microsoft\Windows\Cookies\M8GGGK9Q.txt [ Cookie:admin@serving-sys.com/ ]
        C:\USERS\ADMIN\AppData\Roaming\Microsoft\Windows\Cookies\admin@ad1.adfarm1.adition[1].txt [ Cookie:admin@ad1.adfarm1.adition.com/ ]
        C:\USERS\ADMIN\AppData\Roaming\Microsoft\Windows\Cookies\Y4I1S4IE.txt [ Cookie:admin@clkads.com/adServe/banners ]
        C:\USERS\ADMIN\AppData\Roaming\Microsoft\Windows\Cookies\admin@mediaplex[2].txt [ Cookie:admin@mediaplex.com/ ]
        C:\USERS\ADMIN\AppData\Roaming\Microsoft\Windows\Cookies\NCESPQ5Q.txt [ Cookie:admin@clkads.com/adServe ]
        C:\USERS\ADMIN\AppData\Roaming\Microsoft\Windows\Cookies\admin@apmebf[2].txt [ Cookie:admin@apmebf.com/ ]
        C:\USERS\ADMIN\AppData\Roaming\Microsoft\Windows\Cookies\F6HH4DCT.txt [ Cookie:admin@ad.yieldmanager.com/ ]
        C:\USERS\ADMIN\AppData\Roaming\Microsoft\Windows\Cookies\Low\0CJEU2K2.txt [ Cookie:admin@ad3.adfarm1.adition.com/ ]
        C:\USERS\ADMIN\AppData\Roaming\Microsoft\Windows\Cookies\Low\VNTDYBM8.txt [ Cookie:admin@revsci.net/ ]
        C:\USERS\ADMIN\AppData\Roaming\Microsoft\Windows\Cookies\Low\QFR3YTF2.txt [ Cookie:admin@adfarm1.adition.com/ ]
        C:\USERS\ADMIN\AppData\Roaming\Microsoft\Windows\Cookies\Low\CX11KTV8.txt [ Cookie:admin@zanox.com/ ]
        C:\USERS\ADMIN\AppData\Roaming\Microsoft\Windows\Cookies\Low\75Y7QENU.txt [ Cookie:admin@doubleclick.net/ ]
        C:\USERS\ADMIN\AppData\Roaming\Microsoft\Windows\Cookies\Low\6UTIMT22.txt [ Cookie:admin@dmtracker.com/ ]
        C:\USERS\ADMIN\AppData\Roaming\Microsoft\Windows\Cookies\Low\L9LT25QY.txt [ Cookie:admin@c1.atdmt.com/ ]
        C:\USERS\ADMIN\AppData\Roaming\Microsoft\Windows\Cookies\Low\10D260BD.txt [ Cookie:admin@kontera.com/ ]
        C:\USERS\ADMIN\AppData\Roaming\Microsoft\Windows\Cookies\Low\8M4V818T.txt [ Cookie:admin@de.sitestat.com/idgcom-de/pcwelt/ ]
        C:\USERS\ADMIN\AppData\Roaming\Microsoft\Windows\Cookies\Low\WTWDRKP7.txt [ Cookie:admin@invitemedia.com/ ]
        C:\USERS\ADMIN\AppData\Roaming\Microsoft\Windows\Cookies\Low\V82FGI7S.txt [ Cookie:admin@adx.chip.de/ ]
        C:\USERS\ADMIN\AppData\Roaming\Microsoft\Windows\Cookies\Low\KFTC4MG0.txt [ Cookie:admin@www.active-tracking.de/ ]
        C:\USERS\ADMIN\AppData\Roaming\Microsoft\Windows\Cookies\Low\R50K75RM.txt [ Cookie:admin@smartadserver.com/ ]
        C:\USERS\ADMIN\AppData\Roaming\Microsoft\Windows\Cookies\Low\4SILZ357.txt [ Cookie:admin@ad2.adfarm1.adition.com/ ]
        C:\USERS\ADMIN\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@ad.yieldmanager[2].txt [ Cookie:admin@ad.yieldmanager.com/ ]
        C:\USERS\ADMIN\AppData\Roaming\Microsoft\Windows\Cookies\Low\AU1PMMTS.txt [ Cookie:admin@apmebf.com/ ]
        C:\USERS\ADMIN\AppData\Roaming\Microsoft\Windows\Cookies\Low\XQ2FHY9Z.txt [ Cookie:admin@www.usenext.de/ ]
        C:\USERS\ADMIN\AppData\Roaming\Microsoft\Windows\Cookies\Low\5T442056.txt [ Cookie:admin@ww251.smartadserver.com/ ]
        C:\USERS\ADMIN\Cookies\admin@adfarm1.adition[1].txt [ Cookie:admin@adfarm1.adition.com/ ]
        C:\USERS\ADMIN\Cookies\I6XG7IA3.txt [ Cookie:admin@eset-online-scanner.softonic.de/ ]
        C:\USERS\ADMIN\Cookies\TJI4N52V.txt [ Cookie:admin@doubleclick.net/ ]
        C:\USERS\ADMIN\Cookies\M8GGGK9Q.txt [ Cookie:admin@serving-sys.com/ ]
        C:\USERS\ADMIN\Cookies\admin@ad1.adfarm1.adition[1].txt [ Cookie:admin@ad1.adfarm1.adition.com/ ]
        C:\USERS\ADMIN\Cookies\Y4I1S4IE.txt [ Cookie:admin@clkads.com/adServe/banners ]
        C:\USERS\ADMIN\Cookies\admin@mediaplex[2].txt [ Cookie:admin@mediaplex.com/ ]
        C:\USERS\ADMIN\Cookies\NCESPQ5Q.txt [ Cookie:admin@clkads.com/adServe ]
        C:\USERS\ADMIN\Cookies\admin@apmebf[2].txt [ Cookie:admin@apmebf.com/ ]
        C:\USERS\ADMIN\Cookies\F6HH4DCT.txt [ Cookie:admin@ad.yieldmanager.com/ ]
        C:\USERS\GERRIT\AppData\Roaming\Microsoft\Windows\Cookies\Low\KI06MV8V.txt [ Cookie:gerrit@im.banner.t-online.de/ ]
        C:\USERS\GERRIT\AppData\Roaming\Microsoft\Windows\Cookies\Low\2Q2UUHVY.txt [ Cookie:gerrit@accounts.google.com/ ]
        C:\USERS\GERRIT\AppData\Roaming\Microsoft\Windows\Cookies\Low\CRI0PQF6.txt [ Cookie:gerrit@www.zanox-affiliate.de/ ]
        C:\USERS\GERRIT\AppData\Roaming\Microsoft\Windows\Cookies\Low\QSYL2OCL.txt [ Cookie:gerrit@specificclick.net/ ]
        C:\USERS\GERRIT\AppData\Roaming\Microsoft\Windows\Cookies\Low\0QKU19Y0.txt [ Cookie:gerrit@statse.webtrendslive.com/ ]
        C:\USERS\GERRIT\AppData\Roaming\Microsoft\Windows\Cookies\Low\90X3YKQI.txt [ Cookie:gerrit@www.unitymedia.de/ ]
        C:\USERS\GERRIT\AppData\Roaming\Microsoft\Windows\Cookies\Low\gerrit@de.sitestat[1].txt [ Cookie:gerrit@de.sitestat.com/idgcom-de/pcwelt/ ]
        C:\USERS\GERRIT\AppData\Roaming\Microsoft\Windows\Cookies\Low\VTLC75MC.txt [ Cookie:gerrit@adx.chip.de/ ]
        C:\USERS\GERRIT\AppData\Roaming\Microsoft\Windows\Cookies\Low\IH30G0MC.txt [ Cookie:gerrit@dealtime.com/ ]
        C:\USERS\GERRIT\AppData\Roaming\Microsoft\Windows\Cookies\Low\gerrit@www.klavier-noten[1].txt [ Cookie:gerrit@www.klavier-noten.com/counter/ ]
        C:\USERS\GERRIT\AppData\Roaming\Microsoft\Windows\Cookies\Low\TCZE184I.txt [ Cookie:gerrit@track.effiliation.com/servlet/ ]
        C:\USERS\GERRIT\AppData\Roaming\Microsoft\Windows\Cookies\Low\LP2TK44H.txt [ Cookie:gerrit@www.googleadservices.com/pagead/conversion/1067350970/ ]
        C:\USERS\GERRIT\AppData\Roaming\Microsoft\Windows\Cookies\Low\LUK1I11W.txt [ Cookie:gerrit@server.adformdsp.net/ ]
        C:\USERS\GERRIT\AppData\Roaming\Microsoft\Windows\Cookies\Low\RKZSKGUP.txt [ Cookie:gerrit@advertising.com/ ]
        C:\USERS\GERRIT\AppData\Roaming\Microsoft\Windows\Cookies\Low\8U00TWRO.txt [ Cookie:gerrit@clkads.com/adServe/banners ]
        C:\USERS\GERRIT\AppData\Roaming\Microsoft\Windows\Cookies\Low\63JNZ2UG.txt [ Cookie:gerrit@adviva.net/ ]
        C:\USERS\GERRIT\AppData\Roaming\Microsoft\Windows\Cookies\Low\VMNWUJ61.txt [ Cookie:gerrit@2o7.net/ ]
        C:\USERS\GERRIT\AppData\Roaming\Microsoft\Windows\Cookies\Low\4EKKBKEA.txt [ Cookie:gerrit@webmasterplan.com/ ]
        C:\USERS\GERRIT\AppData\Roaming\Microsoft\Windows\Cookies\Low\852SXCY7.txt [ Cookie:gerrit@unister-adservices.com/campaign/conversion/22 ]
        C:\USERS\GERRIT\AppData\Roaming\Microsoft\Windows\Cookies\Low\gerrit@tracking.mindshare[1].txt [ Cookie:gerrit@tracking.mindshare.de/ ]
        C:\USERS\GERRIT\AppData\Roaming\Microsoft\Windows\Cookies\Low\gerrit@banner.testberichte[2].txt [ Cookie:gerrit@banner.testberichte.de/ ]
        C:\USERS\GERRIT\AppData\Roaming\Microsoft\Windows\Cookies\Low\NIXZ6YK6.txt [ Cookie:gerrit@e-2dj6wbmyuoazkfp.stats.esomniture.com/ ]
        C:\USERS\GERRIT\AppData\Roaming\Microsoft\Windows\Cookies\Low\EF83DAHR.txt [ Cookie:gerrit@smartadserver.com/ ]
        C:\USERS\GERRIT\AppData\Roaming\Microsoft\Windows\Cookies\Low\K307X6PU.txt [ Cookie:gerrit@ad1.adfarm1.adition.com/ ]
        C:\USERS\GERRIT\AppData\Roaming\Microsoft\Windows\Cookies\Low\9UMN6NNU.txt [ Cookie:gerrit@casalemedia.com/ ]
        C:\USERS\GERRIT\AppData\Roaming\Microsoft\Windows\Cookies\Low\gerrit@imrworldwide[2].txt [ Cookie:gerrit@imrworldwide.com/cgi-bin ]
        C:\USERS\GERRIT\AppData\Roaming\Microsoft\Windows\Cookies\Low\T6QFB6AJ.txt [ Cookie:gerrit@www.googleadservices.com/pagead/conversion/1072259810/ ]
        C:\USERS\GERRIT\AppData\Roaming\Microsoft\Windows\Cookies\Low\940PVR9R.txt [ Cookie:gerrit@bs.serving-sys.com/ ]
        C:\USERS\GERRIT\AppData\Roaming\Microsoft\Windows\Cookies\Low\24W2M4KS.txt [ Cookie:gerrit@satinband-discount.info/ ]
        C:\USERS\GERRIT\AppData\Roaming\Microsoft\Windows\Cookies\Low\68OJ4LGP.txt [ Cookie:gerrit@at.atwola.com/ ]
        C:\USERS\GERRIT\AppData\Roaming\Microsoft\Windows\Cookies\Low\6Z81YD9R.txt [ Cookie:gerrit@mediadeal.de/ ]
        C:\USERS\GERRIT\AppData\Roaming\Microsoft\Windows\Cookies\Low\2BG8OZOF.txt [ Cookie:gerrit@bshg.122.2o7.net/ ]
        C:\USERS\GERRIT\AppData\Roaming\Microsoft\Windows\Cookies\Low\BMWTSA62.txt [ Cookie:gerrit@www.googleadservices.com/pagead/conversion/999317690/ ]
        C:\USERS\GERRIT\AppData\Roaming\Microsoft\Windows\Cookies\Low\HCTYHGNE.txt [ Cookie:gerrit@atdmt.com/ ]
        C:\USERS\GERRIT\AppData\Roaming\Microsoft\Windows\Cookies\Low\OJITJ0B5.txt [ Cookie:gerrit@zanox-affiliate.de/ ]
        C:\USERS\GERRIT\AppData\Roaming\Microsoft\Windows\Cookies\Low\M8XI9DH3.txt [ Cookie:gerrit@tradedoubler.com/ ]
        C:\USERS\GERRIT\AppData\Roaming\Microsoft\Windows\Cookies\Low\gerrit@microsoftwindows.112.2o7[1].txt [ Cookie:gerrit@microsoftwindows.112.2o7.net/ ]
        C:\USERS\GERRIT\AppData\Roaming\Microsoft\Windows\Cookies\Low\I3NR8BRY.txt [ Cookie:gerrit@statcounter.com/ ]
        C:\USERS\GERRIT\AppData\Roaming\Microsoft\Windows\Cookies\Low\gerrit@adserver.adtechus[1].txt [ Cookie:gerrit@adserver.adtechus.com/ ]
        C:\USERS\GERRIT\AppData\Roaming\Microsoft\Windows\Cookies\Low\LAMP0O3T.txt [ Cookie:gerrit@gostats.de/ ]
        C:\USERS\GERRIT\AppData\Roaming\Microsoft\Windows\Cookies\Low\gerrit@stats.canalblog[1].txt [ Cookie:gerrit@stats.canalblog.com/ ]
        C:\USERS\GERRIT\AppData\Roaming\Microsoft\Windows\Cookies\Low\5X84QNFM.txt [ Cookie:gerrit@www.netdebit-counter.de/ ]
        C:\USERS\GERRIT\AppData\Roaming\Microsoft\Windows\Cookies\Low\gerrit@komtrack[2].txt [ Cookie:gerrit@komtrack.com/ ]
        C:\USERS\GERRIT\AppData\Roaming\Microsoft\Windows\Cookies\Low\5UKH4Q5I.txt [ Cookie:gerrit@www.googleadservices.com/pagead/conversion/1053860776/ ]
        C:\USERS\GERRIT\AppData\Roaming\Microsoft\Windows\Cookies\Low\D9JSEK4I.txt [ Cookie:gerrit@apmebf.com/ ]
        C:\USERS\GERRIT\AppData\Roaming\Microsoft\Windows\Cookies\Low\gerrit@stats.leitgab[1].txt [ Cookie:gerrit@stats.leitgab.at/ ]
        C:\USERS\GERRIT\AppData\Roaming\Microsoft\Windows\Cookies\Low\IVAQDNC7.txt [ Cookie:gerrit@nextag.de/ ]
        C:\USERS\GERRIT\AppData\Roaming\Microsoft\Windows\Cookies\Low\8EJYB9GH.txt [ Cookie:gerrit@clicksor.com/ ]
        C:\USERS\GERRIT\AppData\Roaming\Microsoft\Windows\Cookies\Low\6P7LK6GA.txt [ Cookie:gerrit@unister-adservices.com/ ]
        C:\USERS\GERRIT\AppData\Roaming\Microsoft\Windows\Cookies\Low\JS453J05.txt [ Cookie:gerrit@adform.net/ ]
        C:\USERS\GERRIT\AppData\Roaming\Microsoft\Windows\Cookies\Low\gerrit@weborama[1].txt [ Cookie:gerrit@weborama.fr/ ]
        C:\USERS\GERRIT\AppData\Roaming\Microsoft\Windows\Cookies\Low\X3Q7SIB7.txt [ Cookie:gerrit@www.googleadservices.com/pagead/conversion/1026497591/ ]
        C:\USERS\GERRIT\AppData\Roaming\Microsoft\Windows\Cookies\Low\gerrit@track.effiliation[3].txt [ Cookie:gerrit@track.effiliation.com/ ]
        C:\USERS\GERRIT\AppData\Roaming\Microsoft\Windows\Cookies\Low\gerrit@hansenet.122.2o7[1].txt [ Cookie:gerrit@hansenet.122.2o7.net/ ]
        C:\USERS\GERRIT\AppData\Roaming\Microsoft\Windows\Cookies\Low\OODFIOH9.txt [ Cookie:gerrit@track.adform.net/ ]
        C:\USERS\GERRIT\AppData\Roaming\Microsoft\Windows\Cookies\Low\gerrit@content.yieldmanager[2].txt [ Cookie:gerrit@content.yieldmanager.com/ ]
        C:\USERS\GERRIT\AppData\Roaming\Microsoft\Windows\Cookies\Low\gerrit@tracking.hannoversche[1].txt [ Cookie:gerrit@tracking.hannoversche.de/ ]
        C:\USERS\GERRIT\AppData\Roaming\Microsoft\Windows\Cookies\Low\JGX5A1WN.txt [ Cookie:gerrit@adformdsp.net/ ]
        C:\USERS\GERRIT\AppData\Roaming\Microsoft\Windows\Cookies\Low\S8NVD6HS.txt [ Cookie:gerrit@invitemedia.com/ ]
        C:\USERS\GERRIT\AppData\Roaming\Microsoft\Windows\Cookies\Low\SWQ5R87T.txt [ Cookie:gerrit@ad.zanox.com/ ]
        C:\USERS\GERRIT\AppData\Roaming\Microsoft\Windows\Cookies\Low\RN1H2GTX.txt [ Cookie:gerrit@liveperson.net/ ]
        C:\USERS\GERRIT\AppData\Roaming\Microsoft\Windows\Cookies\Low\B3SGPLMH.txt [ Cookie:gerrit@adserver.zenoviaexchange.com/ ]
        C:\USERS\GERRIT\AppData\Roaming\Microsoft\Windows\Cookies\Low\NUB4KYE0.txt [ Cookie:gerrit@unitymedia.de/ ]
        C:\USERS\GERRIT\AppData\Roaming\Microsoft\Windows\Cookies\Low\YR76PHHQ.txt [ Cookie:gerrit@pornme.com/ ]
        C:\USERS\GERRIT\AppData\Roaming\Microsoft\Windows\Cookies\Low\MZ7GLM17.txt [ Cookie:gerrit@clickfuse.com/ ]
        C:\USERS\GERRIT\AppData\Roaming\Microsoft\Windows\Cookies\Low\ZYQ71AT3.txt [ Cookie:gerrit@tomtailor.dyntracker.com/ ]
        C:\USERS\GERRIT\AppData\Roaming\Microsoft\Windows\Cookies\Low\HEBN3DO2.txt [ Cookie:gerrit@e-2dj6wjmieod5gbo.stats.esomniture.com/ ]
        C:\USERS\GERRIT\AppData\Roaming\Microsoft\Windows\Cookies\Low\0V3KKDRG.txt [ Cookie:gerrit@www.googleadservices.com/pagead/conversion/1026153877/ ]
        C:\USERS\GERRIT\AppData\Roaming\Microsoft\Windows\Cookies\Low\1V4N4HM9.txt [ Cookie:gerrit@www.googleadservices.com/pagead/conversion/994536289/ ]
        C:\USERS\GERRIT\AppData\Roaming\Microsoft\Windows\Cookies\Low\KEA9C9TD.txt [ Cookie:gerrit@www.googleadservices.com/pagead/conversion/1063962659/ ]
        C:\USERS\GERRIT\AppData\Roaming\Microsoft\Windows\Cookies\Low\5VNVM7DI.txt [ Cookie:gerrit@tacoda.at.atwola.com/ ]
        C:\USERS\GERRIT\AppData\Roaming\Microsoft\Windows\Cookies\Low\QQZD6UDA.txt [ Cookie:gerrit@collective-media.net/ ]
        C:\USERS\GERRIT\AppData\Roaming\Microsoft\Windows\Cookies\Low\R3Y8EU9J.txt [ Cookie:gerrit@cdate.122.2o7.net/ ]
        C:\USERS\GERRIT\AppData\Roaming\Microsoft\Windows\Cookies\Low\SX8ZBXRQ.txt [ Cookie:gerrit@creativdiscount.de/ ]
        C:\USERS\GERRIT\AppData\Roaming\Microsoft\Windows\Cookies\Low\VHJ5NVUU.txt [ Cookie:gerrit@rotator.wigetmedia.com/servlet/ajrotator/track/pt168325 ]
        C:\USERS\GERRIT\AppData\Roaming\Microsoft\Windows\Cookies\Low\H6UO0TTH.txt [ Cookie:gerrit@clkads.com/adServe ]
        C:\USERS\GERRIT\AppData\Roaming\Microsoft\Windows\Cookies\Low\XDH52QOT.txt [ Cookie:gerrit@a.revenuemax.de/ ]
        C:\USERS\GERRIT\AppData\Roaming\Microsoft\Windows\Cookies\Low\H1VG69CD.txt [ Cookie:gerrit@stat.dealtime.com/ ]
        C:\USERS\GERRIT\AppData\Roaming\Microsoft\Windows\Cookies\Low\HWATJK51.txt [ Cookie:gerrit@myroitracking.com/ ]
        C:\USERS\GERRIT\AppData\Roaming\Microsoft\Windows\Cookies\Low\NH7UQ73A.txt [ Cookie:gerrit@counter2.sexmoney.com/ ]
        C:\USERS\GERRIT\AppData\Roaming\Microsoft\Windows\Cookies\Low\NJPVKOW4.txt [ Cookie:gerrit@fidelity.rotator.hadj7.adjuggler.net/ ]
        C:\USERS\GERRIT\AppData\Roaming\Microsoft\Windows\Cookies\Low\L3OS1YIZ.txt [ Cookie:gerrit@nextag.com/ ]
        C:\USERS\GERRIT\AppData\Roaming\Microsoft\Windows\Cookies\Low\INQ1DM1Z.txt [ Cookie:gerrit@media6degrees.com/ ]
        C:\USERS\GERRIT\AppData\Roaming\Microsoft\Windows\Cookies\Low\H06C7YXT.txt [ Cookie:gerrit@www.googleadservices.com/pagead/conversion/1071907466/ ]
        C:\USERS\GERRIT\AppData\Roaming\Microsoft\Windows\Cookies\Low\3SIKXEU3.txt [ Cookie:gerrit@paypal.112.2o7.net/ ]
        C:\USERS\GERRIT\AppData\Roaming\Microsoft\Windows\Cookies\Low\U53GVPMQ.txt [ Cookie:gerrit@7.rotator.wigetmedia.com/ ]
        C:\USERS\GERRIT\AppData\Roaming\Microsoft\Windows\Cookies\Low\DKXUPHZO.txt [ Cookie:gerrit@www.googleadservices.com/pagead/conversion/1047368155/ ]
        C:\USERS\GERRIT\AppData\Roaming\Microsoft\Windows\Cookies\Low\O2KLKBMP.txt [ Cookie:gerrit@www.etracker.de/ ]
        C:\USERS\GERRIT\Cookies\TVVOGBIS.txt [ Cookie:gerrit@liveperson.net/ ]
        C:\USERS\GERRIT\Cookies\ZPIMTM6T.txt [ Cookie:gerrit@eas4.emediate.eu/ ]
        C:\USERS\GERRIT\Cookies\ZH9OK866.txt [ Cookie:gerrit@revsci.net/ ]
        C:\USERS\GERRIT\Cookies\AD8DHEDQ.txt [ Cookie:gerrit@ad4.adfarm1.adition.com/ ]
        C:\USERS\GERRIT\Cookies\P81F3WSB.txt [ Cookie:gerrit@im.banner.t-online.de/ ]
        C:\USERS\GERRIT\Cookies\0MC22OMO.txt [ Cookie:gerrit@www.zanox-affiliate.de/ ]
        C:\USERS\GERRIT\Cookies\P6CM4O5G.txt [ Cookie:gerrit@ad2.adfarm1.adition.com/ ]
        C:\USERS\GERRIT\Cookies\M021MHH8.txt [ Cookie:gerrit@traffic.brand-wall.net/ ]
        C:\USERS\GERRIT\Cookies\HO6NONZJ.txt [ Cookie:gerrit@liveperson.net/hc/52272769 ]
        C:\USERS\GERRIT\Cookies\HAUX91C7.txt [ Cookie:gerrit@7.rotator.wigetmedia.com/ ]
        C:\USERS\GERRIT\Cookies\U5ZGGDSL.txt [ Cookie:gerrit@webmasterplan.com/ ]
        C:\USERS\GERRIT\Cookies\Y78QRP9Q.txt [ Cookie:gerrit@tracking.mindshare.de/ ]
        C:\USERS\GERRIT\Cookies\T4GEPG5B.txt [ Cookie:gerrit@rotator.wigetmedia.com/servlet/ajrotator/track/pt168325 ]
        C:\USERS\GERRIT\Cookies\NMB2471G.txt [ Cookie:gerrit@smartadserver.com/ ]
        C:\USERS\GERRIT\Cookies\H283EVTD.txt [ Cookie:gerrit@ad1.adfarm1.adition.com/ ]
        C:\USERS\GERRIT\Cookies\XCNU5XZH.txt [ Cookie:gerrit@casalemedia.com/ ]
        C:\USERS\GERRIT\Cookies\GVGR2KM4.txt [ Cookie:gerrit@imrworldwide.com/cgi-bin ]
        C:\USERS\GERRIT\Cookies\8XVN81TB.txt [ Cookie:gerrit@bs.serving-sys.com/ ]
        C:\USERS\GERRIT\Cookies\K5TEIDNO.txt [ Cookie:gerrit@www.googleadservices.com/pagead/conversion/1036980325/ ]
        C:\USERS\GERRIT\Cookies\E69JGSRY.txt [ Cookie:gerrit@atdmt.com/ ]
        C:\USERS\GERRIT\Cookies\Z8JVLL3R.txt [ Cookie:gerrit@c.atdmt.com/ ]
        C:\USERS\GERRIT\Cookies\DXZU5W51.txt [ Cookie:gerrit@zanox-affiliate.de/ ]
        C:\USERS\GERRIT\Cookies\ILAV20BJ.txt [ Cookie:gerrit@apmebf.com/ ]
        C:\USERS\GERRIT\Cookies\SCY0FOM1.txt [ Cookie:gerrit@companyes.solution.weborama.fr/ ]
        C:\USERS\GERRIT\Cookies\9U7YTYTS.txt [ Cookie:gerrit@adform.net/ ]
        C:\USERS\GERRIT\Cookies\L2AK5GWT.txt [ Cookie:gerrit@weborama.fr/ ]
        C:\USERS\GERRIT\Cookies\DU0SQR63.txt [ Cookie:gerrit@kontera.com/ ]
        C:\USERS\GERRIT\Cookies\D45SGQFV.txt [ Cookie:gerrit@track.adform.net/ ]
        C:\USERS\GERRIT\Cookies\BRSR943Q.txt [ Cookie:gerrit@tracking.quisma.com/ ]
        C:\USERS\GERRIT\Cookies\OZL5XJ1R.txt [ Cookie:gerrit@ad.yieldmanager.com/ ]
        C:\USERS\GERRIT\Cookies\6NVCV4VR.txt [ Cookie:gerrit@invitemedia.com/ ]
        C:\USERS\GERRIT\Cookies\B4F4ZS8O.txt [ Cookie:gerrit@ad.zanox.com/ ]
        C:\USERS\GERRIT\Cookies\10FG8XRJ.txt [ Cookie:gerrit@tradedoubler.com/ ]
        C:\USERS\GERRIT\Cookies\0M3ONOKZ.txt [ Cookie:gerrit@ww251.smartadserver.com/ ]
        C:\USERS\ADMIN\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\ADMIN@FASTCLICK[1].TXT [ /FASTCLICK ]
        C:\USERS\ADMIN\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\ADMIN@2O7[2].TXT [ /2O7 ]
        C:\USERS\ADMIN\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\ADMIN@INTERCLICK[1].TXT [ /INTERCLICK ]
        C:\USERS\ADMIN\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\ADMIN@FASTCLICK[1].TXT [ /FASTCLICK ]
        delivery.ibanner.de [ C:\USERS\GERRIT\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\SB47A3BY ]
        C:\USERS\GERRIT\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\GERRIT@ADSERVER1.MOKONO[2].TXT [ /ADSERVER1.MOKONO ]
        C:\USERS\GERRIT\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\GERRIT@INTERCLICK[1].TXT [ /INTERCLICK ]
        C:\USERS\GERRIT\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\GERRIT@ADS.DOODLE[1].TXT [ /ADS.DOODLE ]
        C:\USERS\GERRIT\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\GERRIT@WWW.TRAFFICTRACK[2].TXT [ /WWW.TRAFFICTRACK ]
        C:\USERS\GERRIT\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\GERRIT@M1.WEBSTATS.MOTIGO[2].TXT [ /M1.WEBSTATS.MOTIGO ]
        C:\USERS\GERRIT\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\GERRIT@PEERTRACKING[2].TXT [ /PEERTRACKING ]
        C:\USERS\GERRIT\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\GERRIT@PARTY-DISCOUNT[2].TXT [ /PARTY-DISCOUNT ]
        C:\USERS\GERRIT\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\GERRIT@ADSERVER.YOPI[1].TXT [ /ADSERVER.YOPI ]
        C:\USERS\GERRIT\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\GERRIT@XITI[1].TXT [ /XITI ]
        C:\USERS\GERRIT\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\GERRIT@ADS.MONSTER[2].TXT [ /ADS.MONSTER ]
        C:\USERS\GERRIT\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\GERRIT@GUJ.122.2O7[1].TXT [ /GUJ.122.2O7 ]
        .ww251.smartadserver.com [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .www.zanox-affiliate.de [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .tradedoubler.com [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .tradedoubler.com [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .tradedoubler.com [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .ad3.adfarm1.adition.com [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .bs.serving-sys.com [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .bwincom.122.2o7.net [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .zanox.com [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .adform.net [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .ad4.adfarm1.adition.com [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .ad.zanox.com [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .ad.zanox.com [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .tradetracker.net [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .tracker.vinsight.de [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .track.adform.net [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .track.adform.net [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .kontera.com [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .zanox-affiliate.de [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .atdmt.com [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .atdmt.com [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .ero-advertising.com [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .ero-advertising.com [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .ero-advertising.com [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .ero-advertising.com [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .zanox.com [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .msnportal.112.2o7.net [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .imrworldwide.com [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .imrworldwide.com [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .ad1.adfarm1.adition.com [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .7.rotator.wigetmedia.com [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .7.rotator.wigetmedia.com [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .liveperson.net [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .apmebf.com [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .apmebf.com [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .guj.122.2o7.net [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .www.googleadservices.com [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .weborama.fr [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .traffic.brand-wall.net [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .mediaplex.com [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .mediaplex.com [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .mediaplex.com [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .ad.yieldmanager.com [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .ad.yieldmanager.com [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .ad.yieldmanager.com [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .ad.yieldmanager.com [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .ad.yieldmanager.com [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .ad2.adfarm1.adition.com [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .im.banner.t-online.de [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .fastclick.net [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .companyes.solution.weborama.fr [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .companyes.solution.weborama.fr [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .companyes.solution.weborama.fr [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .companyes.solution.weborama.fr [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .rotator.wigetmedia.com [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .doubleclick.net [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .liveperson.net [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .adbrite.com [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .adbrite.com [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .casalemedia.com [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .casalemedia.com [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .casalemedia.com [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .casalemedia.com [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .tracking.mindshare.de [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .stat.onestat.com [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .stat.onestat.com [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .zedo.com [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .zedo.com [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .zedo.com [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .zedo.com [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .zedo.com [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .c.atdmt.com [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .c.atdmt.com [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .eas4.emediate.eu [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .eas4.emediate.eu [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        statse.webtrendslive.com [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
        .doubleclick.net [ C:\USERS\GERRIT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXUGAA89.DEFAULT\COOKIES.SQLITE ]
...und das Malwarebytes-log:
Code:
Malwarebytes Anti-Malware 1.65.0.1400
www.malwarebytes.org

Datenbank Version: v2012.09.13.10

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
Admin :: GERRIT-PC [Administrator]

14.09.2012 00:02:42
mbam-log-2012-09-14 (00-02-42).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 410467
Laufzeit: 1 Stunde(n), 1 Minute(n), 52 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)

cosinus 14.09.2012 14:23
Sieht ok aus, da wurden nur Cookies gefunden.
Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie )


Wegen Cookies und anderer Dinge im Web: Um die Pest von vornherein zu blocken (also TrackingCookies, Werbebanner etc.) müsstest du dir mal sowas wie MVPS Hosts File anschauen => Blocking Unwanted Parasites with a Hosts File - sinnvollerweise solltest du alle 4 Wochen mal bei MVPS nachsehen, ob er eine neue Hosts Datei herausgebracht hat.

Ansonsten gibt es noch gute Cookiemanager, Erweiterungen für den Firefox zB wäre da CookieCuller http://filepony.de/download-cookie_culler/
Wenn du aber damit leben kannst, dich bei jeder Browsersession überall neu einzuloggen (zB Facebook, Ebay, GMX, oder auch Trojaner-Board) dann stell den Browser einfach so ein, dass einfach alles beim Beenden des Browser inkl. Cookies gelöscht wird.

Ich halte es so, dass ich zum "wilden Surfen" den Opera-Browser oder Chromium unter meinem Linux verwende. Mein Hauptbrowser (Firefox) speichert nur die Cookies von den Sites die ich auch will, alles andere lehne ich manuell ab (der FF fragt mich immer) - die anderen Browser nehmen alles an Cookies zwar an, aber spätestens beim nächsten Start von Opera oder Chromium sind keine Cookies mehr da.

Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?

IamShine 16.09.2012 10:25
Hallo cosinus,

vielen, vielen Dank für deine Hilfe! Eure ehrenamtliche Hilfe ist echt Gold wert.
Das einzige, was nicht funktioniert, aber wahrscheinlich gar nichts mit dem Trojaner zu tun hat, ist die Deinstallation der alten java-Version 6.7 von sun microsystems mit der Fehlermeldung, dass auf den Windows Installer-Dienst nicht zugegriffen werden kann. - Wäre das (bestenfalls) ein Thema für einen anderen Thread?

Nochmals vielen Dank!

cosinus 16.09.2012 18:28
Versuch es damit zu deinstallieren => http://filepony.de/download-revo_uninstaller/

IamShine 19.09.2012 21:46
Hallo cosinus,

vielen Dank, hat geklappt, das System funktioniert einwandfrei. Fall erfolgreich gelöst!

Weiter frohes Schaffen!

cosinus 20.09.2012 14:06
Dann wären wir durch! :abklatsch:

Die Programme, die hier zum Einsatz kamen, können alle wieder runter. Mit Hilfe von OTL kannst du auch viele Tools entfernen:

Starte bitte OTL und klicke auf Bereinigung.
Dies wird die meisten Tools entfernen, die wir zur Bereinigung benötigt haben. Sollte etwas bestehen bleiben, bitte mit Rechtsklick --> Löschen entfernen.


Malwarebytes zu behalten ist zu empfehlen. Kannst ja 1x im Monat damit einen Vollscan machen, aber immer vorher ans Update denken.


Bitte abschließend die Updates prüfen, unten mein Leitfaden dazu. Um in Zukunft die Aktualität der installierten Programme besser im Überblick zu halten, kannst du zB Secunia PSI verwenden.
Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern.


Microsoftupdate

Windows XP: Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.

Windows Vista/7: Anleitung Windows-Update


PDF-Reader aktualisieren
Ein veralteter AdobeReader stellt ein großes Sicherheitsrisiko dar. Du solltest daher besser alte Versionen vom AdobeReader über Systemsteuerung => Software bzw. Programme und Funktionen deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst. (falls du AdobeReader installiert hast)

Ich empfehle einen alternativen PDF-Reader wie PDF Xchange Viewer, SumatraPDF oder Foxit PDF Reader, die sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers:
Prüfen => Adobe - Flash Player
Downloadlinks => Adobe Flash Player Distribution | Adobe

Natürlich auch darauf achten, dass andere installierte Browser wie zB Firefox, Opera oder Chrome aktuell sind.


Java-Update
Veraltete Java-Installationen sind ein Sicherheitsrisiko, daher solltest Du die alten Versionen löschen (falls vorhanden, am besten mit JavaRa) und auf die neuste aktualisieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.

IamShine 25.09.2012 14:41
Vielen Dank, cosinus. Der Rechner schnurrt, habe alle "unsere" Programme deinstalliert außer Malwarebytes, das ich zusammen mit SuperAntiSpyware in Zukunft monatlich mal durchlaufen lassen will (SuperAntiSpyware deinstallier ich natürlich zwischendurch), Secunia ist drauf, habe alle Treiber zusätzlich einzeln (!!!) manuell auf Updates geprüft (weil ich spontan keine vertrauenswürdige Freeware gefunden habe, die das automatisch macht, aber hat sich nicht gelohnt, war alles noch aktuell), zusätzlich die Cleaning Suite von ASCOMP installiert, gedefragmented, den Adobe Reader ausgetauscht, den Firefox so eingestellt, dass alle Cookies beim Beenden gelöscht werden, zusätzlich manuell einiges Alte gelöscht, was der Cleaner drauf gelassen hat, sowie mit Vistas "Leisutngsinformationen und -tools" die Performance (leider nur etwas) verbessert) und in gleicher Weise einen anderen Rechner bearbietet, auf dem sich fast 1G an temporären Internetfiles getummelt hat (ca. 38.000 Files !!!)... Bin jetzt auf den Geschmack gekommen und werde noch weiter im Netz nach einfachen Tuningmöglichkeiten für Vista suchen und mir dabei hoffentlich keinen neuen Trojaner einfangen... Habe euch auch ein bisschen gespendet, danke nochmals!


Alle Zeitangaben in WEZ +1. Es ist jetzt 11:39 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19