Trojaner-Board - GVU Trojaner - unter Quarantäne, wirklich weg?

Hallo,

ich habe mir vor ein paar Tagen den GVU Trojaner eingefangen. Er hat zwar meinen Computer nicht gesperrt aber die Internetverbindung blockiert.
Ich habe ihn mit Hilfe von MalwarebytesAntiMalware unter Quarantäne gestellt, aber ich bin mir nicht sicher ob er damit jetzt komplett entfernt ist.

Folgende Schritte habe ich ausgeführt:

1) AntiVir Scan: hat zwei infizierte Dateien gefunden und unter Quarantäne gestellt, aber das Problem selbst nicht behoben

TR/Dldr.Zamelcat.A.21
EXP/2008-5353.AK.1

2) ctfmon.exe aus dem Autostartmenü gelöscht: Blockierung der Internetverbindung wurde aufgehoben

3) MBAM-Scan: Trojaner unter Quarantäne gestellt

Da ich nicht weiß, ob mein Computer wirklich sauber ist, würde ich mich über Hilfe freuen :)

Vielen Dank schon mal im Voraus!

Grüße

Hier die Logs:

OTL

Code:

OTL logfile created on: 02.09.2012 20:29:30 - Run 3

OTL by OldTimer - Version 3.2.59.1     Folder = C:\Dokumente und Einstellungen\was_\Desktop

Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.18702)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

1022,48 Mb Total Physical Memory | 602,03 Mb Available Physical Memory | 58,88% Memory free

2,40 Gb Paging File | 2,05 Gb Available in Paging File | 85,28% Paging File free

Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme

Drive C: | 29,68 Gb Total Space | 4,01 Gb Free Space | 13,50% Space Free | Partition Type: NTFS

Drive E: | 33,90 Gb Total Space | 4,70 Gb Free Space | 13,86% Space Free | Partition Type: NTFS

 

Computer Name: ***** | User Name: was_ | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2012.09.02 17:24:41 | 000,598,528 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\was_\Desktop\OTL.exe

PRC - [2012.08.08 09:40:09 | 000,348,664 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe

PRC - [2012.05.02 01:42:28 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\sched.exe

PRC - [2012.05.02 00:34:34 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe

PRC - [2012.04.24 02:11:55 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe

PRC - [2011.07.12 16:16:32 | 000,175,104 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\WINDOWS\system32\spool\drivers\w32x86\3\NetFaxServer.exe

PRC - [2009.08.28 20:42:54 | 000,144,672 | ---- | M] (Apple Inc.) -- C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

PRC - [2008.04.14 04:22:45 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe

PRC - [2005.12.22 09:57:10 | 000,405,504 | ---- | M] (Hewlett-Packard ) -- C:\Programme\HPQ\Quick Launch Buttons\eabservr.exe

PRC - [2004.12.23 12:07:30 | 000,569,405 | ---- | M] (Broadcom Corporation.) -- C:\Programme\WIDCOMM\Bluetooth Software\BTTray.exe

 

 
 ========== Modules (No Company Name) ==========

 

MOD - [2012.04.16 23:11:02 | 000,398,288 | ---- | M] () -- C:\Programme\Avira\AntiVir Desktop\sqlite3.dll

MOD - [2011.04.11 07:26:33 | 000,024,064 | ---- | M] () -- C:\WINDOWS\system32\spd__l.dll

MOD - [2008.11.12 06:22:18 | 000,026,624 | ---- | M] () -- C:\WINDOWS\system32\sso2ml3.dll

MOD - [2007.10.12 18:26:00 | 000,061,440 | ---- | M] () -- C:\Programme\LitexMedia\All To MP3 Converter\MP3ShellExt.dll

MOD - [2007.09.20 19:34:58 | 000,129,024 | ---- | M] () -- C:\Programme\WinRAR\RarExt.dll

MOD - [2005.06.02 12:40:42 | 000,014,336 | ---- | M] () -- C:\WINDOWS\system32\vsmon1.dll

MOD - [2005.01.06 18:33:30 | 000,116,224 | ---- | M] () -- C:\WINDOWS\system32\redmonnt.dll

MOD - [2004.12.23 12:08:26 | 000,053,248 | ---- | M] () -- C:\Programme\WIDCOMM\Bluetooth Software\BTKeyInd.dll

MOD - [2001.10.28 18:42:30 | 000,116,224 | ---- | M] () -- C:\WINDOWS\system32\pdfcmnnt.dll

 

 
 ========== Services (SafeList) ==========

 

SRV - [2012.08.15 17:59:46 | 000,250,056 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)

SRV - [2012.07.18 10:12:44 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)

SRV - [2012.05.02 01:42:28 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)

SRV - [2012.05.02 00:34:34 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)

SRV - [2011.07.12 16:16:32 | 000,175,104 | ---- | M] (Samsung Electronics Co., Ltd.) [Auto | Running] -- C:\WINDOWS\system32\spool\drivers\w32x86\3\NetFaxServer.exe -- (Samsung Network Fax Server)

SRV - [2010.03.29 08:53:22 | 000,068,000 | ---- | M] (NOS Microsystems Ltd.) [On_Demand | Stopped] -- C:\Programme\NOS\bin\getPlus_Helper.dll -- (getPlusHelper)

SRV - [2009.08.28 20:42:54 | 000,144,672 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe -- (Apple Mobile Device)

SRV - [2007.11.19 12:16:18 | 000,654,848 | ---- | M] (Macrovision Europe Ltd.) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)

SRV - [2003.07.28 13:28:22 | 000,089,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - File not found [Kernel | On_Demand | Stopped] --  -- (WDICA)

DRV - File not found [Kernel | On_Demand | Unknown] -- C:\DOKUME~1\was_\LOKALE~1\Temp\ugtdqpog.sys -- (ugtdqpog)

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Programme\SiSoftware\SiSoftware Sandra Lite 2012.SP4c\WNt500x86\Sandra.sys -- (SANDRA)

DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDRFRAME)

DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDRELI)

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\PDNSp50.sys -- (PDNSp50)

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\PDNMp50.sys -- (PDNMp50)

DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDFRAME)

DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDCOMP)

DRV - File not found [Kernel | System | Stopped] --  -- (PCIDump)

DRV - File not found [Kernel | System | Stopped] --  -- (lbrtfdc)

DRV - File not found [Kernel | System | Stopped] --  -- (i2omgmt)

DRV - File not found [Kernel | Auto | Stopped] -- C:\WINDOWS\system32\Drivers\DgiVecp.sys -- (DgiVecp)

DRV - File not found [Kernel | System | Stopped] --  -- (Changer)

DRV - File not found [Kernel | On_Demand | Stopped] -- System32\Drivers\camfilt.sys -- (camfilt)

DRV - File not found [Kernel | System | Stopped] --  -- (ASPI32)

DRV - File not found [Kernel | On_Demand | Stopped] -- System32\Drivers\BLvid.sys -- (APL531)

DRV - [2012.04.27 10:20:04 | 000,137,928 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)

DRV - [2012.04.25 00:32:27 | 000,083,392 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)

DRV - [2012.04.16 21:17:40 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avkmgr.sys -- (avkmgr)

DRV - [2011.11.17 15:37:16 | 000,441,608 | ---- | M] (Paragon) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\Uim_IM.sys -- (Uim_IM)

DRV - [2011.11.17 15:37:16 | 000,277,576 | ---- | M] (Paragon) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\Uim_Vim.sys -- (Uim_Vim)

DRV - [2011.11.17 15:37:16 | 000,045,240 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\UimBus.sys -- (UimBus)

DRV - [2011.07.29 13:54:56 | 000,013,192 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\epmntdrv.sys -- (epmntdrv)

DRV - [2011.07.29 13:54:56 | 000,008,456 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\EuGdiDrv.sys -- (EuGdiDrv)

DRV - [2010.08.16 09:56:02 | 000,019,472 | ---- | M] (Oti.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Usbnic.sys -- (Usbnic)

DRV - [2010.06.17 15:14:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)

DRV - [2007.11.19 09:24:11 | 000,639,224 | ---- | M] (Duplex Secure Ltd.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\drivers\sptd.sys -- (sptd)

DRV - [2007.10.12 02:00:44 | 000,041,752 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\LVUSBSta.sys -- (LVUSBSta)

DRV - [2007.10.12 01:56:00 | 001,279,000 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\LV302V32.SYS -- (PID_PEPI)

DRV - [2006.07.24 18:49:48 | 000,089,856 | ---- | M] (USB Generic Camera) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\cam1210.sys -- (CAM1210)

DRV - [2006.06.19 00:38:18 | 000,043,520 | ---- | M] (Advanced Micro Devices) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\AmdK8.sys -- (AmdK8)

DRV - [2005.09.28 17:00:22 | 000,376,320 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\BCMWL5.SYS -- (BCM43XX)

DRV - [2005.08.23 20:26:00 | 001,273,344 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)

DRV - [2005.07.28 08:18:40 | 000,685,056 | ---- | M] (Aladdin Knowledge Systems Ltd.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\hardlock.sys -- (Hardlock)

DRV - [2005.06.23 10:16:08 | 000,162,176 | ---- | M] (Texas Instruments) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\tifm21.sys -- (tifm21)

DRV - [2005.05.05 11:04:08 | 000,007,936 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\eabfiltr.sys -- (eabfiltr)

DRV - [2005.05.05 11:04:04 | 000,005,760 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\EabUsb.sys -- (eabusb)

DRV - [2005.03.22 15:39:44 | 000,200,192 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSFHWATI.sys -- (HSFHWATI)

DRV - [2005.03.22 15:39:42 | 001,038,208 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_DP.sys -- (HSF_DP)

DRV - [2005.03.22 15:39:40 | 000,703,232 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys -- (winachsf)

DRV - [2005.03.15 17:14:52 | 000,346,496 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\camc6hal.sys -- (CAMCHALA)

DRV - [2005.03.15 17:14:52 | 000,037,760 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\camc6aud.sys -- (CAMCAUD)

DRV - [2004.12.23 11:52:12 | 000,399,616 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\btaudio.sys -- (btaudio)

DRV - [2004.12.23 11:50:06 | 000,148,040 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\btwdndis.sys -- (BTWDNDIS)

DRV - [2004.12.23 11:49:16 | 001,337,850 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btkrnl.sys -- (BTKRNL)

DRV - [2004.12.23 11:47:18 | 000,030,299 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\btport.sys -- (BTDriver)

DRV - [2004.12.23 11:46:44 | 000,055,320 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\btwusb.sys -- (BTWUSB)

DRV - [2004.08.03 23:31:34 | 000,020,992 | ---- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\RTL8139.sys -- (rtl8139)

DRV - [2004.06.28 11:35:24 | 000,069,760 | ---- | M] (Realtek Semiconductor Corporation                           ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtlnicxp.sys -- (RTL8023xp)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.arcor.de

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.arcor.de

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,First Home Page = hxxp://www.arcor.de

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.arcor.de

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.arcor.de

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.arcor.de

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.arcor.de

IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC

IE - HKCU\..\SearchScopes\{43DFEDA3-FFBB-4638-8F12-04B2FEBC76CE}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=NDV&o=15765&src=crm&q={searchTerms}&locale=&apn_ptnrs=NY&apn_dtid=YYYYYYYYDE&apn_uid=498C616B-7CD9-4369-8D92-9A11DB83F421&apn_sauid=542B9F04-2F6D-4207-8486-84DB3855365A&

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

 
 ========== FireFox ==========

 

FF - prefs.js..browser.search.selectedEngine: "Google"

FF - user.js - File not found

 

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_3_300_271.dll ()

FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw_1165635.dll (Adobe Systems, Inc.)

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Programme\iTunes\Mozilla Plugins\npitunes.dll ()

FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Programme\DivX\DivX Web Player\npdivx32.dll (DivX,Inc.)

FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Programme\DivX\DivX Player\npDivxPlayerPlugin.dll (DivX, Inc)

FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Programme\Google\Picasa3\npPicasa3.dll (Google, Inc.)

FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=1.6.0_33: C:\WINDOWS\system32\npdeployJava1.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Programme\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)

FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.11.3088: C:\Programme\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)

FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.2.3146: C:\Programme\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)

FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.11.3006: C:\Programme\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)

FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=:  File not found

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Programme\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Programme\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)

FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Dokumente und Einstellungen\was_\Lokale Einstellungen\Anwendungsdaten\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)

FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Dokumente und Einstellungen\was_\Lokale Einstellungen\Anwendungsdaten\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{FFB96CC1-7EB3-449D-B827-DB661701C6BB}: C:\Programme\CheckPoint\ZAForceField\TrustChecker

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Programme\Mozilla Firefox\components [2012.07.18 10:12:46 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2012.07.11 23:10:05 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 6.0.2\extensions\\Components: C:\Programme\Mozilla Thunderbird\components [2011.08.21 13:22:25 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 6.0.2\extensions\\Plugins: C:\Programme\Mozilla Thunderbird\plugins

 

[2010.02.16 19:40:43 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\was_\Anwendungsdaten\Mozilla\Extensions

[2010.02.16 19:40:43 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\was_\Anwendungsdaten\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}

[2012.08.03 01:03:11 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\was_\Anwendungsdaten\Mozilla\Firefox\Profiles\i86gvmi9.default\extensions

[2009.03.23 15:13:30 | 000,000,000 | ---D | M] ("Azerty II") -- C:\Dokumente und Einstellungen\was_\Anwendungsdaten\Mozilla\Firefox\Profiles\i86gvmi9.default\extensions\{044FA143-992A-435f-95A5-39E25470F8F0}

[2009.03.23 15:13:31 | 000,000,000 | ---D | M] (Orsa) -- C:\Dokumente und Einstellungen\was_\Anwendungsdaten\Mozilla\Firefox\Profiles\i86gvmi9.default\extensions\{31dc6a49-3d43-4932-ae14-937a6ac57262}

[2009.03.23 15:13:31 | 000,000,000 | ---D | M] (Qute) -- C:\Dokumente und Einstellungen\was_\Anwendungsdaten\Mozilla\Firefox\Profiles\i86gvmi9.default\extensions\{36C13C8F-54F1-412e-8177-2E411719162D}

[2007.11.18 21:49:58 | 000,000,000 | ---D | M] ("azureFox") -- C:\Dokumente und Einstellungen\was_\Anwendungsdaten\Mozilla\Firefox\Profiles\i86gvmi9.default\extensions\{800e72c4-0a2c-4bc5-a10a-1ee66dfd762a}

[2009.03.23 15:13:32 | 000,000,000 | ---D | M] (iFox) -- C:\Dokumente und Einstellungen\was_\Anwendungsdaten\Mozilla\Firefox\Profiles\i86gvmi9.default\extensions\{a81bafeb-b6ed-4501-aa17-15a2b3857e56}

[2007.11.18 19:49:10 | 000,000,000 | ---D | M] (Acid Burn r1) -- C:\Dokumente und Einstellungen\was_\Anwendungsdaten\Mozilla\Firefox\Profiles\i86gvmi9.default\extensions\{acidburnr1-4ed8-4a4d-9194-975a45a391xp}

[2007.11.18 21:50:01 | 000,000,000 | ---D | M] ("Fusion Alternative 2") -- C:\Dokumente und Einstellungen\was_\Anwendungsdaten\Mozilla\Firefox\Profiles\i86gvmi9.default\extensions\{b1f0be5b-b66c-41c9-bfcc-f4ec657cd17b}

[2012.07.12 09:47:30 | 000,000,000 | ---D | M] (Evernote Web Clipper) -- C:\Dokumente und Einstellungen\was_\Anwendungsdaten\Mozilla\Firefox\Profiles\i86gvmi9.default\extensions\{E0B8C461-F8FB-49b4-8373-FE32E9252800}

[2010.06.28 21:34:51 | 000,000,000 | ---D | M] (Adobe DLM (powered by getPlus(R))) -- C:\Dokumente und Einstellungen\was_\Anwendungsdaten\Mozilla\Firefox\Profiles\i86gvmi9.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}

[2009.03.23 15:13:33 | 000,000,000 | ---D | M] (Qute Modded (RSS Icon) by Brian Feinzimer) -- C:\Dokumente und Einstellungen\was_\Anwendungsdaten\Mozilla\Firefox\Profiles\i86gvmi9.default\extensions\{ec468f50-3eb9-11da-8cd6-0800200c9a66}

[2009.03.23 15:13:22 | 000,000,000 | ---D | M] (Blue) -- C:\Dokumente und Einstellungen\was_\Anwendungsdaten\Mozilla\Firefox\Profiles\i86gvmi9.default\extensions\blue

[2011.05.28 00:35:29 | 000,000,000 | ---D | M] (German Dictionary) -- C:\Dokumente und Einstellungen\was_\Anwendungsdaten\Mozilla\Firefox\Profiles\i86gvmi9.default\extensions\de-DE@dictionaries.addons.mozilla.org

[2011.02.16 23:21:50 | 000,000,000 | ---D | M] (British English Dictionary) -- C:\Dokumente und Einstellungen\was_\Anwendungsdaten\Mozilla\Firefox\Profiles\i86gvmi9.default\extensions\en-GB@dictionaries.addons.mozilla.org

[2012.07.12 09:46:13 | 000,000,000 | ---D | M] (Russian spellchecking dictionary) -- C:\Dokumente und Einstellungen\was_\Anwendungsdaten\Mozilla\Firefox\Profiles\i86gvmi9.default\extensions\ru@dictionaries.addons.mozilla.org

[2007.11.18 21:41:42 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\was_\Anwendungsdaten\Mozilla\Firefox\Profiles\kqwp28rv.default\extensions

[2007.12.05 12:05:50 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\was_\Anwendungsdaten\Mozilla\Sunbird\Profiles\kqqyqlo3.default\extensions

[2012.07.11 23:10:07 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions

[2011.07.17 15:43:42 | 000,000,000 | ---D | M] (G Data WebFilter) -- C:\Programme\Mozilla Firefox\extensions\{9AA46F4F-4DC7-4c06-97AF-5035170633FE}

[2012.07.11 23:10:07 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}

[2012.07.18 10:12:46 | 000,136,672 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll

[2012.07.14 23:21:50 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml

[2012.07.14 23:21:50 | 000,002,252 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml

[2012.07.14 23:21:50 | 000,001,153 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml

[2012.07.14 23:21:50 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml

[2012.07.14 23:21:50 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml

[2012.07.14 23:21:50 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml

 
 ========== Chrome  ==========

 

CHR - homepage: hxxp://www.ask.com/?l=dis&o=15768cr

CHR - default_search_provider: Google (Enabled)

CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}

CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}

CHR - homepage: hxxp://www.ask.com/?l=dis&o=15768cr

CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer

CHR - plugin: Native Client (Enabled) = C:\Dokumente und Einstellungen\was_\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\Application\21.0.1180.83\ppGoogleNaClPluginChrome.dll

CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Dokumente und Einstellungen\was_\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\Application\21.0.1180.83\pdf.dll

CHR - plugin: Shockwave Flash (Enabled) = C:\Dokumente und Einstellungen\was_\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\Application\21.0.1180.83\gcswf32.dll

CHR - plugin: Shockwave Flash (Enabled) = C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll

CHR - plugin: Adobe Acrobat (Enabled) = C:\Programme\Adobe\Reader 8.0\Reader\Browser\nppdf32.dll

CHR - plugin: DivX Web Player (Enabled) = C:\Programme\Mozilla Firefox\plugins\npdivx32.dll

CHR - plugin: DivX Player Netscape Plugin (Enabled) = C:\Programme\Mozilla Firefox\plugins\npDivxPlayerPlugin.dll

CHR - plugin: Microsoft Office 2003 (Enabled) = C:\Programme\Mozilla Firefox\plugins\NPOFFICE.DLL

CHR - plugin: Microsoft Office Live Plug-in for Firefox (Enabled) = C:\Programme\Microsoft\Office Live\npOLW.dll

CHR - plugin: RealPlayer(tm) G2 LiveConnect-Enabled Plug-In (32-bit)  (Enabled) = C:\Programme\Mozilla Firefox\plugins\nppl3260.dll

CHR - plugin: RealPlayer Version Plugin (Enabled) = C:\Programme\Mozilla Firefox\plugins\nprpjplug.dll

CHR - plugin: QuickTime Plug-in 7.6.5 (Enabled) = C:\Programme\Mozilla Firefox\plugins\npqtplugin.dll

CHR - plugin: QuickTime Plug-in 7.6.5 (Enabled) = C:\Programme\Mozilla Firefox\plugins\npqtplugin2.dll

CHR - plugin: QuickTime Plug-in 7.6.5 (Enabled) = C:\Programme\Mozilla Firefox\plugins\npqtplugin3.dll

CHR - plugin: QuickTime Plug-in 7.6.5 (Enabled) = C:\Programme\Mozilla Firefox\plugins\npqtplugin4.dll

CHR - plugin: QuickTime Plug-in 7.6.5 (Enabled) = C:\Programme\Mozilla Firefox\plugins\npqtplugin5.dll

CHR - plugin: QuickTime Plug-in 7.6.5 (Enabled) = C:\Programme\Mozilla Firefox\plugins\npqtplugin6.dll

CHR - plugin: QuickTime Plug-in 7.6.5 (Enabled) = C:\Programme\Mozilla Firefox\plugins\npqtplugin7.dll

CHR - plugin: RealJukebox NS Plugin (Enabled) = C:\Programme\Mozilla Firefox\plugins\nprjplug.dll

CHR - plugin: getPlusPlus for Adobe 16263 (Enabled) = C:\Programme\Mozilla Firefox\plugins\np_gp.dll

CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Programme\Windows Media Player\npdrmv2.dll

CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Programme\Windows Media Player\npwmsdrm.dll

CHR - plugin: Windows Media Player Plug-in Dynamic Link Library (Enabled) = C:\Programme\Windows Media Player\npdsplay.dll

CHR - plugin: Google Update (Enabled) = C:\Dokumente und Einstellungen\was_\Lokale Einstellungen\Anwendungsdaten\Google\Update\1.3.21.115\npGoogleUpdate3.dll

CHR - plugin: Picasa (Enabled) = C:\Programme\Google\Picasa3\npPicasa3.dll

CHR - plugin: Java(TM) Platform SE 6 U33 (Enabled) = C:\Programme\Java\jre6\bin\plugin2\npjp2.dll

CHR - plugin: Java Deployment Toolkit 6.0.330.3 (Enabled) = C:\WINDOWS\system32\npdeployJava1.dll

CHR - plugin: iTunes Application Detector (Enabled) = C:\Programme\iTunes\Mozilla Plugins\npitunes.dll

CHR - Extension: YouTube = C:\Dokumente und Einstellungen\was_\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\

CHR - Extension: Google-Suche = C:\Dokumente und Einstellungen\was_\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\

CHR - Extension: Minimal = C:\Dokumente und Einstellungen\was_\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\hnfhcmjkebafbfikmbkhdpbmfpfjgiog\1.0_0\

CHR - Extension: Google Mail = C:\Dokumente und Einstellungen\was_\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\

 

O1 HOSTS File: ([2007.11.18 19:21:19 | 000,000,847 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1       localhost

O1 - Hosts: 127.0.0.1       localhost

O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)

O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)

O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)

O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {FD2FD708-1F6F-4B68-B141-C5778F0C19BB} - No CLSID value found.

O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)

O4 - HKLM..\Run: [Cpqset] C:\Programme\HPQ\Default Settings\Cpqset.exe ()

O4 - HKLM..\Run: [eabconfg.cpl] C:\Programme\HPQ\Quick Launch Buttons\EabServr.exe (Hewlett-Packard )

O4 - HKLM..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k File not found

O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)

O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\BTTray.lnk = C:\Programme\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoRecentDocsNetHood = 1

O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\WINDOWS\System32\GPhotos.scr (Google Inc.)

O8 - Extra context menu item: Senden an &Bluetooth - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()

O9 - Extra 'Tools' menuitem : Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre6\bin\npjpi160_33.dll (Sun Microsystems, Inc.)

O9 - Extra Button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe File not found

O9 - Extra 'Tools' menuitem : ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe File not found

O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1196944046218 (MUWebControl Class)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Java Plug-in 1.6.0_33)

O16 - DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab (Reg Error: Key error.)

O16 - DPF: {CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Java Plug-in 1.6.0_33)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Java Plug-in 1.6.0_33)

O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Gemeinsame Dateien\Skype\Skype4COM.dll (Skype Technologies)

O18 - Protocol\Handler\widimg {EE7C2AFF-5742-44FF-BD0E-E521B0D3C3BA} - C:\WINDOWS\system32\BTXPPanel.dll (Broadcom Corporation.)

O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)

O20 - Winlogon\Notify\AtiExtEvent: DllName - (Ati2evxx.dll) - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)

O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home

O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\was_\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp

O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\was_\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2007.11.18 16:32:42 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]

O34 - HKLM BootExecute: (autocheck autochk *)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2012.09.02 20:20:55 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\was_\Recent

[2012.09.02 17:41:24 | 000,000,000 | ---D | C] -- E:\Eigene Dateien\sicheug laptop

[2012.09.02 17:40:37 | 000,000,000 | ---D | C] -- E:\Eigene Dateien\Kamera-Uploads

[2012.09.02 17:40:30 | 000,000,000 | ---D | C] -- E:\Eigene Dateien\Praktikum2

[2012.09.02 17:40:24 | 000,000,000 | ---D | C] -- E:\Eigene Dateien\Studium2

[2012.09.02 17:39:34 | 000,000,000 | ---D | C] -- E:\Eigene Dateien\Signaturen

[2012.09.02 17:39:28 | 000,000,000 | ---D | C] -- E:\Eigene Dateien\usb

[2012.09.02 17:24:38 | 000,598,528 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\was_\Desktop\OTL.exe

[2012.09.02 00:11:48 | 000,000,000 | ---D | C] -- C:\Kaspersky Rescue Disk 10.0

[2012.09.01 23:58:01 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\was_\Anwendungsdaten\Malwarebytes

[2012.09.01 23:56:48 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Malwarebytes' Anti-Malware

[2012.09.01 23:56:45 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes

[2012.09.01 23:56:41 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys

[2012.09.01 23:56:38 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware

[2012.09.01 22:03:40 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\restore

[2012.09.01 19:49:25 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ftw

[2012.09.01 19:43:46 | 000,000,000 | ---D | C] -- C:\archive_db

[2012.09.01 19:38:53 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\backup

[2012.09.01 19:38:46 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\explauncher

[2012.09.01 19:38:44 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\launcher

[2012.09.01 19:34:17 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Paragon Backup & Recovery™ 2012 Free

[2012.09.01 19:32:28 | 000,000,000 | ---D | C] -- C:\Programme\Paragon Software

[2012.09.01 19:11:10 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Runtime Software

[2012.09.01 19:11:09 | 000,000,000 | ---D | C] -- C:\Programme\Runtime Software

[2012.08.21 22:57:53 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen\was_\IECompatCache

[2012.08.21 22:55:45 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen\was_\PrivacIE

[2012.08.20 12:22:51 | 000,000,000 | ---D | C] -- C:\Programme\iStar

[2012.08.09 19:20:44 | 000,000,000 | ---D | C] -- E:\Eigene Dateien\Mucke

[2012.08.08 14:40:53 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Avira

[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

[3 C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\*.tmp files -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\*.tmp -> ]

[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

[1 C:\Dokumente und Einstellungen\was_\Desktop\*.tmp files -> C:\Dokumente und Einstellungen\was_\Desktop\*.tmp -> ]

 
 ========== Files - Modified Within 30 Days ==========

 

[2012.09.02 20:25:00 | 000,001,086 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job

[2012.09.02 20:23:56 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl

[2012.09.02 20:23:18 | 000,000,000 | ---- | M] () -- C:\WINDOWS\TempFile

[2012.09.02 20:23:16 | 000,001,082 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job

[2012.09.02 20:22:33 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat

[2012.09.02 20:22:26 | 1072,222,208 | -HS- | M] () -- C:\hiberfil.sys

[2012.09.02 20:05:00 | 000,001,206 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1220945662-2077806209-1801674531-1003UA.job

[2012.09.02 19:59:00 | 000,000,884 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job

[2012.09.02 17:53:54 | 000,302,592 | ---- | M] () -- C:\Dokumente und Einstellungen\was_\Desktop\5xndz3mh.exe

[2012.09.02 17:24:41 | 000,598,528 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\was_\Desktop\OTL.exe

[2012.09.02 17:23:02 | 000,050,477 | ---- | M] () -- C:\Dokumente und Einstellungen\was_\Desktop\Defogger.exe

[2012.09.02 17:13:26 | 000,000,020 | ---- | M] () -- C:\Dokumente und Einstellungen\was_\defogger_reenable

[2012.09.02 12:05:02 | 000,001,154 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1220945662-2077806209-1801674531-1003Core.job

[2012.09.02 00:02:10 | 000,002,243 | ---- | M] () -- C:\Dokumente und Einstellungen\was_\Desktop\Skype.lnk

[2012.09.01 23:56:51 | 000,000,762 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes Anti-Malware.lnk

[2012.09.01 23:43:56 | 004,503,728 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\0tbpw.pad

[2012.09.01 19:34:17 | 000,002,094 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Paragon Backup & Recovery™ 2012 Free.lnk

[2012.09.01 19:11:10 | 000,000,758 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\DriveImage XML.lnk

[2012.08.22 10:14:40 | 000,002,363 | ---- | M] () -- C:\Dokumente und Einstellungen\was_\Desktop\Google Chrome.lnk

[2012.08.15 09:15:55 | 001,482,008 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT

[2012.08.12 20:26:47 | 000,321,018 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat

[2012.08.12 20:26:47 | 000,315,090 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat

[2012.08.12 20:26:47 | 000,050,648 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat

[2012.08.12 20:26:47 | 000,042,046 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat

[2012.08.09 19:07:21 | 005,156,004 | ---- | M] () -- E:\Eigene Dateien\DSC01357.JPG

[2012.08.08 18:52:03 | 000,001,125 | ---- | M] () -- C:\WINDOWS\winamp.ini

[2012.08.08 13:37:26 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat

[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

[3 C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\*.tmp files -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\*.tmp -> ]

[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

[1 C:\Dokumente und Einstellungen\was_\Desktop\*.tmp files -> C:\Dokumente und Einstellungen\was_\Desktop\*.tmp -> ]

 
 ========== Files Created - No Company Name ==========

 

[2012.09.02 17:53:53 | 000,302,592 | ---- | C] () -- C:\Dokumente und Einstellungen\was_\Desktop\5xndz3mh.exe

[2012.09.02 17:40:48 | 005,156,004 | ---- | C] () -- E:\Eigene Dateien\DSC01357.JPG

[2012.09.02 17:39:23 | 000,236,572 | ---- | C] () -- E:\Eigene Dateien\DKB Kündigung.pdf

[2012.09.02 17:22:58 | 000,050,477 | ---- | C] () -- C:\Dokumente und Einstellungen\was_\Desktop\Defogger.exe

[2012.09.02 17:13:08 | 000,000,020 | ---- | C] () -- C:\Dokumente und Einstellungen\was_\defogger_reenable

[2012.09.02 16:57:23 | 1072,222,208 | -HS- | C] () -- C:\hiberfil.sys

[2012.09.01 23:56:51 | 000,000,762 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes Anti-Malware.lnk

[2012.09.01 19:34:17 | 000,002,094 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Paragon Backup & Recovery™ 2012 Free.lnk

[2012.09.01 19:11:10 | 000,000,758 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\DriveImage XML.lnk

[2012.08.30 13:36:41 | 004,503,728 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\0tbpw.pad

[2012.08.02 15:01:47 | 000,026,624 | ---- | C] () -- C:\WINDOWS\System32\sso2ml3.dll

[2012.08.02 14:41:12 | 000,124,792 | ---- | C] () -- C:\WINDOWS\Wiainst.exe

[2012.08.02 14:22:39 | 000,310,272 | ---- | C] () -- C:\WINDOWS\System32\UPDIO2.dll

[2012.08.02 14:22:39 | 000,254,464 | ---- | C] () -- C:\WINDOWS\System32\SUPDRun.exe

[2012.08.02 14:22:37 | 000,024,064 | ---- | C] () -- C:\WINDOWS\System32\spd__l.dll

[2012.08.02 14:22:34 | 000,151,552 | ---- | C] () -- C:\WINDOWS\System32\spd__ci.exe

[2012.08.02 14:22:25 | 001,558,432 | ---- | C] () -- C:\WINDOWS\TotalUninstaller.exe

[2012.08.02 14:17:46 | 000,004,140 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\mtbjfghn.xbe

[2012.08.02 14:12:53 | 000,493,432 | ---- | C] () -- C:\WINDOWS\ssndii.exe

[2012.07.29 13:41:54 | 000,000,017 | ---- | C] () -- C:\WINDOWS\Missing.ini

[2012.07.29 13:41:33 | 000,000,032 | ---- | C] () -- C:\WINDOWS\CD-Start.INI

[2012.07.16 13:18:56 | 002,469,760 | ---- | C] () -- C:\WINDOWS\System32\BootMan.exe

[2012.07.16 13:18:56 | 000,019,840 | ---- | C] () -- C:\WINDOWS\System32\EuEpmGdi.dll

[2012.07.16 13:18:55 | 000,086,408 | ---- | C] () -- C:\WINDOWS\System32\setupempdrv03.exe

[2012.07.16 13:18:55 | 000,013,192 | ---- | C] () -- C:\WINDOWS\System32\epmntdrv.sys

[2012.07.16 13:18:55 | 000,008,456 | ---- | C] () -- C:\WINDOWS\System32\EuGdiDrv.sys

[2012.02.28 17:52:54 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll

[2011.04.25 10:11:51 | 000,000,072 | ---- | C] () -- C:\WINDOWS\EurekaLog.ini

[2011.04.07 17:30:10 | 000,307,200 | ---- | C] () -- C:\WINDOWS\System32\SaXPWIA.dll

[2011.04.07 17:30:08 | 000,145,408 | ---- | C] () -- C:\WINDOWS\System32\SaXPUIEx.dll

[2008.01.16 11:23:10 | 000,001,356 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\QTSBandwidthCache

[2008.01.04 01:05:14 | 000,000,137 | ---- | C] () -- C:\Dokumente und Einstellungen\was_\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat

[2007.11.23 15:51:49 | 000,136,192 | ---- | C] () -- C:\Dokumente und Einstellungen\was_\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2007.11.18 21:50:23 | 000,000,305 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\addr_file.html

 
 ========== LOP Check ==========

 

[2007.11.20 17:29:25 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Abvent

[2012.04.05 14:35:23 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Ask

[2012.09.01 19:38:53 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\backup

[2010.06.01 19:09:19 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\eXPert PDF

[2010.06.01 20:50:59 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\eXPert PDF 4

[2010.06.01 19:09:19 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\eXPert PDF Jobs

[2012.09.01 19:38:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\explauncher

[2012.08.12 19:49:43 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\FreePDF

[2012.09.01 19:49:25 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ftw

[2011.07.19 17:51:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\G Data

[2012.07.16 13:19:57 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\IBUpdaterService

[2012.09.01 19:38:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\launcher

[2008.07.14 11:03:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\MailFrontier

[2007.11.18 20:18:18 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\McNeel

[2010.03.13 15:34:23 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\MyHeritage

[2012.09.01 22:03:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\restore

[2012.08.12 19:36:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Samsung

[2011.05.07 01:24:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP

[2012.07.21 17:05:33 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\xml_param

[2010.02.11 23:38:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{755AC846-7372-4AC8-8550-C52491DAA8BD}

[2008.10.03 15:57:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\was_\Anwendungsdaten\Abvent

[2012.07.16 16:06:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\was_\Anwendungsdaten\BitTorrent

[2012.08.02 14:14:38 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\was_\Anwendungsdaten\Carambis

[2010.05.12 00:05:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\was_\Anwendungsdaten\CheckPoint

[2012.09.02 17:18:23 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\was_\Anwendungsdaten\Dropbox

[2010.06.01 19:12:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\was_\Anwendungsdaten\eXPert PDF Editor

[2009.03.19 17:35:43 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\was_\Anwendungsdaten\Graphisoft

[2007.12.21 23:09:18 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\was_\Anwendungsdaten\ICQLite

[2007.12.20 14:00:51 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\was_\Anwendungsdaten\InfraRecorder

[2008.10.10 15:22:57 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\was_\Anwendungsdaten\Leadertech

[2009.10.25 13:43:51 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\was_\Anwendungsdaten\MyHeritage

[2008.08.13 10:36:23 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\was_\Anwendungsdaten\Nemetschek

[2009.03.29 22:37:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\was_\Anwendungsdaten\OpenOffice.org

[2012.07.16 15:03:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\was_\Anwendungsdaten\PerformerSoft

[2010.07.19 20:09:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\was_\Anwendungsdaten\RayV

[2010.02.16 19:40:38 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\was_\Anwendungsdaten\Thunderbird

 
 ========== Purity Check ==========

 

 

 
 ========== Files - Unicode (All) ==========

[2010.05.13 02:08:49 | 000,000,000 | ---D | M](E:\Eigene Dateien\?????) -- E:\Eigene Dateien\МиХей

[2010.05.13 02:08:45 | 000,000,000 | ---D | C](E:\Eigene Dateien\?????) -- E:\Eigene Dateien\МиХей

 
 ========== Alternate Data Streams ==========

 

@Alternate Data Stream - 104 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:88050731
 

< End of report >

Malwarebytes

Code:

Malwarebytes Anti-Malware 1.62.0.1300

www.malwarebytes.org
 

Datenbank Version: v2012.09.01.06
 

Windows XP Service Pack 3 x86 NTFS

Internet Explorer 8.0.6001.18702

was_ :: *****[Administrator]
 

02.09.2012 00:02:39

mbam-log-2012-09-02 (00-02-39).txt
 

Art des Suchlaufs: Vollständiger Suchlauf (C:\|E:\|)

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 390827

Laufzeit: 2 Stunde(n), 24 Minute(n), 50 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 1

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WAV to MP3 (Rogue.WindowsAntiVirus) -> Erfolgreich gelöscht und in Quarantäne gestellt.
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 1

C:\Programme\Wav (Rogue.WindowsAntiVirus) -> Erfolgreich gelöscht und in Quarantäne gestellt.
 

Infizierte Dateien: 11

C:\Dokumente und Einstellungen\was_\Lokale Einstellungen\Temp\wpbt0.dll (Trojan.PWS) -> Löschen bei Neustart.

C:\Dokumente und Einstellungen\was_\Lokale Einstellungen\Temporary Internet Files\Content.IE5\SE36MB1S\contacts[1].exe (Trojan.PWS) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\System Volume Information\_restore{DD4D610A-63DF-47BD-ADD1-546A45C3DBCB}\RP506\A0109999.exe (PUP.BundleInstaller.IB) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Dokumente und Einstellungen\was_\Startmenü\Programme\Autostart\ctfmon.lnk (Trojan.Ransom.Gen) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Programme\Wav\LAME_ENC.DLL (Rogue.WindowsAntiVirus) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Programme\Wav\LOGO.ico (Rogue.WindowsAntiVirus) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Programme\Wav\LOGO256.BMP (Rogue.WindowsAntiVirus) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Programme\Wav\Readme.txt (Rogue.WindowsAntiVirus) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Programme\Wav\Uninstal.exe (Rogue.WindowsAntiVirus) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Programme\Wav\WAVTOMP3.cfg (Rogue.WindowsAntiVirus) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Programme\Wav\WAVTOMP3.exe (Rogue.WindowsAntiVirus) -> Erfolgreich gelöscht und in Quarantäne gestellt.
 

(Ende)

Gmer

Code:

GMER 1.0.15.15641 - hxxp://www.gmer.net

Rootkit scan 2012-09-02 20:28:39

Windows 5.1.2600 Service Pack 3 

Running: 5xndz3mh.exe; Driver: C:\DOKUME~1\was_\LOKALE~1\Temp\ugtdqpog.sys
 
 

---- System - GMER 1.0.15 ----
 

SSDT                                                                                                                                  F7CCA2B4                                                                                                             ZwClose

SSDT                                                                                                                                  F7CCA26E                                                                                                             ZwCreateKey

SSDT                                                                                                                                  F7CCA2BE                                                                                                             ZwCreateSection

SSDT                                                                                                                                  F7CCA264                                                                                                             ZwCreateThread

SSDT                                                                                                                                  F7CCA273                                                                                                             ZwDeleteKey

SSDT                                                                                                                                  F7CCA27D                                                                                                             ZwDeleteValueKey

SSDT                                                                                                                                  F7CCA2AF                                                                                                             ZwDuplicateObject

SSDT                                                                                                                                  F7CCA282                                                                                                             ZwLoadKey

SSDT                                                                                                                                  F7CCA250                                                                                                             ZwOpenProcess

SSDT                                                                                                                                  F7CCA255                                                                                                             ZwOpenThread

SSDT                                                                                                                                  F7CCA2D7                                                                                                             ZwQueryValueKey

SSDT                                                                                                                                  F7CCA28C                                                                                                             ZwReplaceKey

SSDT                                                                                                                                  F7CCA2C8                                                                                                             ZwRequestWaitReplyPort

SSDT                                                                                                                                  F7CCA287                                                                                                             ZwRestoreKey

SSDT                                                                                                                                  F7CCA2C3                                                                                                             ZwSetContextThread

SSDT                                                                                                                                  F7CCA2CD                                                                                                             ZwSetSecurityObject

SSDT                                                                                                                                  F7CCA278                                                                                                             ZwSetValueKey

SSDT                                                                                                                                  F7CCA2D2                                                                                                             ZwSystemDebugControl

SSDT                                                                                                                                  F7CCA25F                                                                                                             ZwTerminateProcess
 

---- Kernel code sections - GMER 1.0.15 ----
 

init                                                                                                                                  C:\WINDOWS\system32\drivers\tifm21.sys                                                                               entry point in "init" section [0xF5DFBDBF]

.text                                                                                                                                 C:\WINDOWS\system32\drivers\hardlock.sys                                                                             section is writeable [0xF61E5400, 0x7960C, 0xE8000020]

.protectÿÿÿÿhardlockentry point in ".protectÿÿÿÿhardlockentry point in ".protectÿÿÿÿhardlockentry point in ".p" section [0xF6287420]  C:\WINDOWS\system32\drivers\hardlock.sys                                                                             entry point in ".protectÿÿÿÿhardlockentry point in ".protectÿÿÿÿhardlockentry point in ".p" section [0xF6287420]

.protectÿÿÿÿhardlockunknown last code section [0xF6287200, 0x5049, 0xE0000020]                                                        C:\WINDOWS\system32\drivers\hardlock.sys                                                                             unknown last code section [0xF6287200, 0x5049, 0xE0000020]
 

---- Devices - GMER 1.0.15 ----
 

AttachedDevice                                                                                                                        \Driver\Kbdclass \Device\KeyboardClass0                                                                              SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)

AttachedDevice                                                                                                                        \Driver\Kbdclass \Device\KeyboardClass0                                                                              EABFiltr.sys (QLB PS/2 Keyboard filter driver/Hewlett-Packard Development Company, L.P.)

AttachedDevice                                                                                                                        \Driver\Kbdclass \Device\KeyboardClass1                                                                              SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)

AttachedDevice                                                                                                                        \Driver\Kbdclass \Device\KeyboardClass1                                                                              EABFiltr.sys (QLB PS/2 Keyboard filter driver/Hewlett-Packard Development Company, L.P.)

AttachedDevice                                                                                                                        \FileSystem\Fastfat \Fat                                                                                             fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

AttachedDevice                                                                                                                        \FileSystem\Fastfat \Fat                                                                                             fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
 

---- Registry - GMER 1.0.15 ----
 

Reg                                                                                                                                   HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)                 

Reg                                                                                                                                   HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0                                      0

Reg                                                                                                                                   HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh                                   0x8A 0xCB 0x7D 0x4A ...

Reg                                                                                                                                   HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)                 

Reg                                                                                                                                   HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0                                      C:\Programme\DAEMON Tools\

Reg                                                                                                                                   HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0                                      0

Reg                                                                                                                                   HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh                                   0xC1 0x99 0x4C 0x08 ...

Reg                                                                                                                                   HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet)        

Reg                                                                                                                                   HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0                             0x20 0x01 0x00 0x00 ...

Reg                                                                                                                                   HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh                          0xF2 0xEC 0x80 0x5D ...

Reg                                                                                                                                   HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet)  

Reg                                                                                                                                   HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh                    0x95 0xEB 0xAC 0xF2 ...

Reg                                                                                                                                   HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)                 

Reg                                                                                                                                   HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0                                      0

Reg                                                                                                                                   HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh                                   0x8A 0xCB 0x7D 0x4A ...

Reg                                                                                                                                   HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4                                     

Reg                                                                                                                                   HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0                                  0

Reg                                                                                                                                   HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh                               0x8A 0xCB 0x7D 0x4A ...

Reg                                                                                                                                   HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)                 

Reg                                                                                                                                   HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0                                      0

Reg                                                                                                                                   HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh                                   0x8A 0xCB 0x7D 0x4A ...
 

---- EOF - GMER 1.0.15 ----

So, alles ausgeführt, hier kommen die Logs:

OTL

Code:

All processes killed

========== OTL ==========

Service WDICA stopped successfully!

Service WDICA deleted successfully!

Error: No service named ugtdqpog was found to stop!

Service\Driver key ugtdqpog not found.

File C:\DOKUME~1\was_\LOKALE~1\Temp\ugtdqpog.sys not found.

Service PDRFRAME stopped successfully!

Service PDRFRAME deleted successfully!

Service PDRELI stopped successfully!

Service PDRELI deleted successfully!

Service PDFRAME stopped successfully!

Service PDFRAME deleted successfully!

Service PDCOMP stopped successfully!

Service PDCOMP deleted successfully!

Service PCIDump stopped successfully!

Service PCIDump deleted successfully!

Service lbrtfdc stopped successfully!

Service lbrtfdc deleted successfully!

Service i2omgmt stopped successfully!

Service i2omgmt deleted successfully!

Service Changer stopped successfully!

Service Changer deleted successfully!

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{43DFEDA3-FFBB-4638-8F12-04B2FEBC76CE}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{43DFEDA3-FFBB-4638-8F12-04B2FEBC76CE}\ not found.

HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!

HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride| /E : value set successfully!

Prefs.js: "Google" removed from browser.search.selectedEngine

Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@Apple.com/iTunes,version=\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=\ not found.

Use Chrome's Settings page to change the HomePage.

Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{FD2FD708-1F6F-4B68-B141-C5778F0C19BB} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FD2FD708-1F6F-4B68-B141-C5778F0C19BB}\ not found.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\KernelFaultCheck deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\HonorAutoRunSetting deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\EnableLinkedConnections deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{B863453A-26C3-4e1f-A54D-A2CD196348E9}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B863453A-26C3-4e1f-A54D-A2CD196348E9}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{B863453A-26C3-4e1f-A54D-A2CD196348E9}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B863453A-26C3-4e1f-A54D-A2CD196348E9}\ not found.

Starting removal of ActiveX control {8AD9C840-044E-11D1-B3E9-00805F499D93}

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.

Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.

Starting removal of ActiveX control {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA}

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA}\ not found.

Starting removal of ActiveX control {CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}\ deleted successfully.

Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}\ not found.

Starting removal of ActiveX control {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.

Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!

C:\AUTOEXEC.BAT moved successfully.

C:\WINDOWS\System32\CONFIG.TMP deleted successfully.

C:\Dokumente und Einstellungen\was_\Desktop\5xndz3mh.exe moved successfully.

ADS C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Temp:88050731 deleted successfully.

C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml moved successfully.

C:\Programme\Mozilla Firefox\searchplugins\bing.xml moved successfully.

C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml moved successfully.

C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml moved successfully.

C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml moved successfully.

C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml moved successfully.

C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\0tbpw.pad moved successfully.

C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\IBUpdaterService folder moved successfully.

========== FILES ==========

Folder C:\Programme\Wav not found.

File\Folder C:\Users\was_\AppData\Local\{*} not found.

File\Folder C:\ProgramData\*.exe not found.

File\Folder C:\ProgramData\TEMP not found.

File\Folder C:\Users\was_\AppData\Local\Temp\*.exe not found.

File\Folder C:\Users\was_\AppData\LocalLow\Sun\Java\Deployment\cache not found.

File/Folder C:\Dokumente und Einstellungen\was_\Anwendungsdaten\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk not found.

File/Folder C:\WINDOWS\System32\*.tmp not found.

File/Folder C:\WINDOWS\SysWOW64\*.tmp not found.
 < ipconfig /flushdns /c >

Windows-IP-Konfiguration

Der DNS-Auflösungscache wurde geleert.

C:\Dokumente und Einstellungen\was_\Desktop\cmd.bat deleted successfully.

C:\Dokumente und Einstellungen\was_\Desktop\cmd.txt deleted successfully.

========== COMMANDS ==========

 

[EMPTYTEMP]

 

User: Administrator

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

 

User: All Users

 

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

 

User: Internet

->Temp folder emptied: 544027 bytes

->Temporary Internet Files folder emptied: 34489 bytes

->Java cache emptied: 0 bytes

->FireFox cache emptied: 165756677 bytes

->Flash cache emptied: 719 bytes

 

User: keks

 

User: Lena

->Temp folder emptied: 49069678 bytes

->Temporary Internet Files folder emptied: 5612461 bytes

->Java cache emptied: 0 bytes

->FireFox cache emptied: 288774128 bytes

->Flash cache emptied: 8184 bytes

 

User: LocalService

->Temp folder emptied: 2202536 bytes

->Temporary Internet Files folder emptied: 279476 bytes

 

User: NetworkService

->Temp folder emptied: 2130056 bytes

->Temporary Internet Files folder emptied: 33170 bytes

 

User: was_

->Temp folder emptied: 6029425 bytes

->Temporary Internet Files folder emptied: 1581663 bytes

->Java cache emptied: 47553881 bytes

->FireFox cache emptied: 75195485 bytes

->Google Chrome cache emptied: 7056061 bytes

->Apple Safari cache emptied: 0 bytes

->Flash cache emptied: 1305 bytes

 

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 2148906 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32\dllcache .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 49663 bytes

RecycleBin emptied: 0 bytes

 

Total Files Cleaned = 624,00 mb

 

 

OTL by OldTimer - Version 3.2.59.1 log created on 09052012_101431
 

Files\Folders moved on Reboot...
 

PendingFileRenameOperations files...
 

Registry entries deleted on Reboot...

MBAM

Code:

Malwarebytes Anti-Malware 1.62.0.1300

www.malwarebytes.org
 

Datenbank Version: v2012.09.05.06
 

Windows XP Service Pack 3 x86 NTFS

Internet Explorer 8.0.6001.18702

was_ :: **** [Administrator]
 

05.09.2012 15:14:58

mbam-log-2012-09-05 (15-14-58).txt
 

Art des Suchlaufs: Vollständiger Suchlauf (C:\|E:\|)

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 408098

Laufzeit: 2 Stunde(n), 27 Minute(n), 19 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 0

(Keine bösartigen Objekte gefunden)
 

(Ende)

AdwCleaner 1

Code:

# AdwCleaner v2.000 - Datei am 09/05/2012 um 17:47:07 erstellt

# Aktualisiert am 30/08/2012 von Xplode

# Betriebssystem : Microsoft Windows XP Service Pack 3 (32 bits)

# Benutzer : was_ - ****

# Normaler Modus : Normal

# Ausgeführt unter : C:\Dokumente und Einstellungen\was_\Desktop\adwcleaner (1).exe

# Option [Suche]
 
 

**** [Dienste] ****
 
 

***** [Dateien / Ordner] *****
 

Ordner Gefunden : C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Ask

Ordner Gefunden : C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Trymedia
 

***** [Registrierungsdatenbank] *****
 

Schlüssel Gefunden : HKCU\Software\Conduit

Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{79A765E1-C399-405B-85AF-466F52E918B0}

Schlüssel Gefunden : HKCU\Software\Softonic

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\ComObject.DeskbarEnabler

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\ComObject.DeskbarEnabler.1

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{2A42D13C-D427-4787-821B-CF6973855778}

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{3D8478AA-7B88-48A9-8BCB-B85D594411EC}

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{FFB96CC1-7EB3-449D-B827-DB661701C6BB}

Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{EC4085F2-8DB3-45A6-AD0B-CA289F3C5D7E}
 

***** [Internet Browser] *****
 

-\\ Internet Explorer v8.0.6001.18702
 

[OK] Die Registrierungsdatenbank ist sauber.
 

*************************
 

AdwCleaner[R1].txt - [1455 octets] - [02/09/2012 22:22:43]

AdwCleaner[R2].txt - [1545 octets] - [05/09/2012 17:47:07]
 

########## EOF - C:\AdwCleaner[R2].txt - [1605 octets] ##########

AdwCleaner 2

Code:

# AdwCleaner v2.000 - Datei am 09/05/2012 um 17:48:28 erstellt

# Aktualisiert am 30/08/2012 von Xplode

# Betriebssystem : Microsoft Windows XP Service Pack 3 (32 bits)

# Benutzer : was_ - ****

# Normaler Modus : Normal

# Ausgeführt unter : C:\Dokumente und Einstellungen\was_\Desktop\adwcleaner (1).exe

# Option [Löschen]
 
 

**** [Dienste] ****
 
 

***** [Dateien / Ordner] *****
 

Ordner Gelöscht : C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Ask

Ordner Gelöscht : C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Trymedia
 

***** [Registrierungsdatenbank] *****
 

Schlüssel Gelöscht : HKCU\Software\Conduit

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{79A765E1-C399-405B-85AF-466F52E918B0}

Schlüssel Gelöscht : HKCU\Software\Softonic

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ComObject.DeskbarEnabler

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ComObject.DeskbarEnabler.1

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2A42D13C-D427-4787-821B-CF6973855778}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{3D8478AA-7B88-48A9-8BCB-B85D594411EC}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{FFB96CC1-7EB3-449D-B827-DB661701C6BB}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{EC4085F2-8DB3-45A6-AD0B-CA289F3C5D7E}
 

***** [Internet Browser] *****
 

-\\ Internet Explorer v8.0.6001.18702
 

Wiederhergestellt : [HKCU\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]

Wiederhergestellt : [HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes - DefaultScope]

Wiederhergestellt : [HKU\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]

Wiederhergestellt : [HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]

Wiederhergestellt : [HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
 

*************************
 

AdwCleaner[R1].txt - [1455 octets] - [02/09/2012 22:22:43]

AdwCleaner[R2].txt - [1674 octets] - [05/09/2012 17:47:07]

AdwCleaner[S1].txt - [2050 octets] - [05/09/2012 17:48:28]
 

########## EOF - C:\AdwCleaner[S1].txt - [2110 octets] ##########