Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   trojaner!Probleme mit einer oder mehreren OTL/SATA Festplatten! (https://www.trojaner-board.de/100657-trojaner-probleme-mehreren-otl-sata-festplatten.html)

maik78 22.06.2011 11:47
trojaner!Probleme mit einer oder mehreren OTL/SATA Festplatten!
 
hab seit neuestem riesige probleme mit meinem com.hab mir anscheinend einen trojaner eingefangen :(.nun bekomm ich immer die meldung probleme mit einer oder mehreren otl/sata festplatten.
seit dem hab ich einen schwarzen bildschirm,meine icons sind weg,desktop leer,taskmanager lässt sich nicht öffnen,festplatte zeigt an das ich noch immer den selben stand habe wie vor dem trojaner.
kann aber keine ordner öffnen da die irgendwo verschollen sind :(.
hab auch schon mal das otl durchlaufen lassen.

OTL Logfile:
Code:
OTL logfile created on: 20.06.2011 16:31:48 - Run 1
OTL by OldTimer - Version 3.2.24.1    Folder = C:\Users\Luffy\Downloads
Windows Vista Home Basic Edition  (Version = 6.0.6000) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18904)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
893,56 Mb Total Physical Memory | 486,90 Mb Available Physical Memory | 54,49% Memory free
2,13 Gb Paging File | 1,86 Gb Available in Paging File | 87,13% Paging File free
Paging file location(s): C:\pagefile.sys 1339 1339 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 37,26 Gb Total Space | 7,96 Gb Free Space | 21,37% Space Free | Partition Type: NTFS
 
Computer Name: WIHTEBIRT | User Name: Luffy | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Luffy\Downloads\OTL(3).exe (OldTimer Tools)
PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Users\Luffy\Downloads\OTL(3).exe (OldTimer Tools)
MOD - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Chrome\Hook\rpchrome10browserrecordhelper.dll (RealNetworks, Inc.)
MOD - C:\Windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.5570_none_509463cabcb6ef2a\msvcr90.dll (Microsoft Corporation)
MOD - C:\Windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.5570_none_509463cabcb6ef2a\msvcp90.dll (Microsoft Corporation)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6000.16386_none_5d07289e07e1d100\comctl32.dll (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (ScanQuery Service) -- C:\ProgramData\ScanQuery\scanquery141.exe ()
SRV - (avg9wd) -- C:\Program Files\AVG\AVG9\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (avg9emc) -- C:\Program Files\AVG\AVG9\avgemc.exe (AVG Technologies CZ, s.r.o.)
SRV - (ICQ Service) -- C:\Programme\ICQ6Toolbar\ICQ Service.exe ()
SRV - (Boonty Games) -- C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe (BOONTY)
SRV - (TuneUp.ProgramStatisticsSvc) -- C:\Windows\System32\TUProgSt.exe (TuneUp Software)
SRV - (TuneUp.Defrag) -- C:\Windows\System32\TuneUpDefragService.exe (TuneUp Software)
SRV - (UxTuneUp) -- C:\Windows\System32\uxtuneup.dll (TuneUp Software)
SRV - (OMSI download service) -- C:\Programme\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe ()
SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (WcesComm) -- C:\Windows\WindowsMobile\wcescomm.dll (Microsoft Corporation)
SRV - (RapiMgr) -- C:\Windows\WindowsMobile\rapimgr.dll (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (AvgTdiX) -- C:\Windows\System32\Drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.)
DRV - (AvgMfx86) -- C:\Windows\System32\Drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (AvgLdx86) -- C:\Windows\System32\Drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (AvgRkx86) -- C:\Windows\System32\Drivers\avgrkx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (VIAHdAudAddService) -- C:\Windows\System32\drivers\viahduaa.sys (VIA Technologies, Inc.)
DRV - (HdAudAddService) -- C:\Windows\System32\drivers\viahduaa.sys (VIA Technologies, Inc.)
DRV - (SIS163u) -- C:\Windows\System32\drivers\sis163u.sys (Silicon Integrated Systems Corp.)
DRV - (FETND6V) -- C:\Windows\System32\drivers\fetnd6v.sys (VIA Technologies, Inc.              )
DRV - (smserial) -- C:\Windows\System32\drivers\smserial.sys (Motorola Inc.)
DRV - (KMWDFILTER) -- C:\Windows\System32\drivers\KMWDFILTER.sys (Windows (R) Codename Longhorn DDK provider)
DRV - (s0016unic) Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (WDM) -- C:\Windows\System32\drivers\s0016unic.sys (MCCI Corporation)
DRV - (s0016nd5) Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (NDIS) -- C:\Windows\System32\drivers\s0016nd5.sys (MCCI Corporation)
DRV - (s0016mdfl) -- C:\Windows\System32\drivers\s0016mdfl.sys (MCCI Corporation)
DRV - (s0016mdm) -- C:\Windows\System32\drivers\s0016mdm.sys (MCCI Corporation)
DRV - (s0016mgmt) Sony Ericsson Device 0016 USB WMC Device Management Drivers (WDM) -- C:\Windows\System32\drivers\s0016mgmt.sys (MCCI Corporation)
DRV - (s0016obex) -- C:\Windows\System32\drivers\s0016obex.sys (MCCI Corporation)
DRV - (s0016bus) Sony Ericsson Device 0016 driver (WDM) -- C:\Windows\System32\drivers\s0016bus.sys (MCCI Corporation)
DRV - (SNPSTD3) USB PC Camera (SNPSTD3) -- C:\Windows\System32\drivers\snpstd3.sys (Sonix Co. Ltd.)
DRV - (S3G700) -- C:\Windows\System32\drivers\VTGKModeDX32.sys (S3 Graphics Co., Ltd.)
DRV - (winusb) -- C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)
DRV - (vsdatant) -- C:\Windows\System32\vsdatant.sys (Zone Labs, LLC)
DRV - (OVT511Plus) -- C:\Windows\System32\drivers\omcamvid.sys (OmniVision Technologies, Inc.)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://home.sweetim.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://start.facemoods.com/?a=ddr&s={searchTerms}&f=4
IE - HKLM\..\URLSearchHook:  - Reg Error: Key error. File not found
IE - HKLM\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKLM\..\URLSearchHook: {8dbb6d8e-e4a6-4e3b-9753-af78b226441c} - C:\Programme\Softonic_Deutsch\tbSoft.dll (Conduit Ltd.)
IE - HKLM\..\URLSearchHook: {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} - Reg Error: Key error. File not found
IE - HKLM\..\URLSearchHook: {e9911ec6-1bcc-40b0-9993-e0eea7f6953f} - C:\Programme\DVDVideoSoft\tbDVDV.dll (Conduit Ltd.)
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-2527848741-3311900059-3240881507-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page =
IE - HKU\S-1-5-21-2527848741-3311900059-3240881507-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Hamstersoft Search Start
IE - HKU\S-1-5-21-2527848741-3311900059-3240881507-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Restore = Facemoods Search
IE - HKU\S-1-5-21-2527848741-3311900059-3240881507-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-2527848741-3311900059-3240881507-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.sweetim.com/search.asp?src=2&q="
FF - prefs.js..browser.search.selectedEngine: "ICQ Search"
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"
FF - prefs.js..extensions.enabledItems: {3f963a5b-e555-4543-90e2-c3908898db71}:9.0.0.872
FF - prefs.js..extensions.enabledItems: {800b5000-a755-47e1-992b-48a1c1357f07}:1.1.9
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:14.0.3
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: ffxtlbr@Facemoods.com:1.2.1
FF - prefs.js..extensions.enabledItems: {DE9265D8-D55D-4286-9DC4-F8D8A0CA2F64}:1.0
FF - prefs.js..extensions.enabledItems: ClickPotatoLite@ClickPotatoLite.com:10.0.668.0
FF - prefs.js..keyword.URL: "hxxp://www.hamsterstart.com/s/?src=FF-Address&site=Yahoo!&cfg=2-475-0-0&q="
FF - prefs.js..sweetim.toolbar.previous.browser.search.defaultenginename: "Google"
FF - prefs.js..sweetim.toolbar.previous.browser.search.defaulturl: "hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q="
FF - prefs.js..sweetim.toolbar.previous.browser.search.selectedEngine: "ICQ Search"
FF - prefs.js..browser.startup.homepage: "hxxp://berlin.pennergame.de/"
FF - prefs.js..sweetim.toolbar.previous.keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&q="
 
 
FF - HKLM\software\mozilla\Firefox\Extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files\AVG\AVG9\Firefox [2010.11.24 21:09:28 | 000,000,000 | -H-D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{3112ca9c-de6d-4884-a869-9855de68056c}: C:\ProgramData\Google\Toolbar for Firefox\{3112ca9c-de6d-4884-a869-9855de68056c} [2010.02.06 18:31:33 | 000,000,000 | -H-D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2011.06.13 14:20:13 | 000,000,000 | -H-D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\ClickPotatoLite@ClickPotatoLite.com: C:\Program Files\ClickPotatoLite\bin\10.0.668.0\firefox\extensions [2011.04.14 07:16:42 | 000,000,000 | -H-D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.17\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.06.16 09:28:54 | 000,000,000 | -H-D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.17\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.06.16 09:28:54 | 000,000,000 | -H-D | M]
 
[2009.02.18 13:20:26 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\Luffy\AppData\Roaming\mozilla\Extensions
[2011.06.20 16:06:59 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\Luffy\AppData\Roaming\mozilla\Firefox\Profiles\li06tyiv.default\extensions
[2010.08.27 11:53:46 | 000,000,000 | -H-D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Luffy\AppData\Roaming\mozilla\Firefox\Profiles\li06tyiv.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011.06.18 01:43:20 | 000,000,000 | -H-D | M] (Google Toolbar for Firefox) -- C:\Users\Luffy\AppData\Roaming\mozilla\Firefox\Profiles\li06tyiv.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2010.02.10 19:33:51 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\Luffy\AppData\Roaming\mozilla\Firefox\Profiles\li06tyiv.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}(32)
[2011.04.04 22:03:59 | 000,000,000 | -H-D | M] ("ICQ Toolbar") -- C:\Users\Luffy\AppData\Roaming\mozilla\Firefox\Profiles\li06tyiv.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2009.05.10 14:28:14 | 000,000,000 | -H-D | M] (Softonic Deutsch Toolbar) -- C:\Users\Luffy\AppData\Roaming\mozilla\Firefox\Profiles\li06tyiv.default\extensions\{8dbb6d8e-e4a6-4e3b-9753-af78b226441c}
[2011.06.13 15:14:00 | 000,000,000 | -H-D | M] (Greasemonkey) -- C:\Users\Luffy\AppData\Roaming\mozilla\Firefox\Profiles\li06tyiv.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
[2010.02.21 12:43:12 | 000,000,000 | -H-D | M] (DVDVideoSoft Toolbar) -- C:\Users\Luffy\AppData\Roaming\mozilla\Firefox\Profiles\li06tyiv.default\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}
[2010.12.18 21:56:44 | 000,000,000 | -H-D | M] (SweetIM Toolbar for Firefox) -- C:\Users\Luffy\AppData\Roaming\mozilla\Firefox\Profiles\li06tyiv.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}
[2010.05.24 07:23:40 | 000,000,000 | -H-D | M] (SweetIM Toolbar for Firefox) -- C:\Users\Luffy\AppData\Roaming\mozilla\Firefox\Profiles\li06tyiv.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}(40)
[2011.03.19 09:38:51 | 000,000,000 | -H-D | M] (Facemoods) -- C:\Users\Luffy\AppData\Roaming\mozilla\Firefox\Profiles\li06tyiv.default\extensions\ffxtlbr@Facemoods.com
[2011.06.18 01:43:20 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\Luffy\AppData\Roaming\mozilla\Firefox\Profiles\li06tyiv.default\extensions\staged-xpis
[2011.06.19 21:25:26 | 000,000,950 | -H-- | M] () -- C:\Users\Luffy\AppData\Roaming\Mozilla\Firefox\Profiles\li06tyiv.default\searchplugins\icqplugin-1.xml
[2010.08.26 16:21:41 | 000,000,950 | -H-- | M] () -- C:\Users\Luffy\AppData\Roaming\Mozilla\Firefox\Profiles\li06tyiv.default\searchplugins\icqplugin-10.xml
[2010.08.31 06:49:05 | 000,000,950 | -H-- | M] () -- C:\Users\Luffy\AppData\Roaming\Mozilla\Firefox\Profiles\li06tyiv.default\searchplugins\icqplugin-11.xml
[2011.05.08 11:06:23 | 000,000,950 | -H-- | M] () -- C:\Users\Luffy\AppData\Roaming\Mozilla\Firefox\Profiles\li06tyiv.default\searchplugins\icqplugin-12.xml
[2011.06.12 17:30:21 | 000,000,950 | -H-- | M] () -- C:\Users\Luffy\AppData\Roaming\Mozilla\Firefox\Profiles\li06tyiv.default\searchplugins\icqplugin-13.xml
[2011.06.13 15:11:50 | 000,000,656 | -H-- | M] () -- C:\Users\Luffy\AppData\Roaming\Mozilla\Firefox\Profiles\li06tyiv.default\searchplugins\icqplugin-14.xml
[2011.06.16 20:33:56 | 000,000,950 | -H-- | M] () -- C:\Users\Luffy\AppData\Roaming\Mozilla\Firefox\Profiles\li06tyiv.default\searchplugins\icqplugin-15.xml
[2009.04.01 19:05:14 | 000,000,950 | -H-- | M] () -- C:\Users\Luffy\AppData\Roaming\Mozilla\Firefox\Profiles\li06tyiv.default\searchplugins\icqplugin-2.xml
[2009.04.06 19:17:00 | 000,000,950 | -H-- | M] () -- C:\Users\Luffy\AppData\Roaming\Mozilla\Firefox\Profiles\li06tyiv.default\searchplugins\icqplugin-3.xml
[2009.05.05 19:24:45 | 000,000,950 | -H-- | M] () -- C:\Users\Luffy\AppData\Roaming\Mozilla\Firefox\Profiles\li06tyiv.default\searchplugins\icqplugin-4.xml
[2009.06.16 00:21:13 | 000,000,950 | -H-- | M] () -- C:\Users\Luffy\AppData\Roaming\Mozilla\Firefox\Profiles\li06tyiv.default\searchplugins\icqplugin-5.xml
[2009.10.05 07:36:57 | 000,000,950 | -H-- | M] () -- C:\Users\Luffy\AppData\Roaming\Mozilla\Firefox\Profiles\li06tyiv.default\searchplugins\icqplugin-6.xml
[2009.10.11 17:09:14 | 000,000,950 | -H-- | M] () -- C:\Users\Luffy\AppData\Roaming\Mozilla\Firefox\Profiles\li06tyiv.default\searchplugins\icqplugin-7.xml
[2010.01.03 20:25:38 | 000,000,950 | -H-- | M] () -- C:\Users\Luffy\AppData\Roaming\Mozilla\Firefox\Profiles\li06tyiv.default\searchplugins\icqplugin-8.xml
[2010.01.20 15:27:48 | 000,000,950 | -H-- | M] () -- C:\Users\Luffy\AppData\Roaming\Mozilla\Firefox\Profiles\li06tyiv.default\searchplugins\icqplugin-9.xml
[2010.04.22 14:33:22 | 000,000,945 | -H-- | M] () -- C:\Users\Luffy\AppData\Roaming\Mozilla\Firefox\Profiles\li06tyiv.default\searchplugins\icqplugin.xml
[2010.12.18 21:56:27 | 000,003,915 | -H-- | M] () -- C:\Users\Luffy\AppData\Roaming\Mozilla\Firefox\Profiles\li06tyiv.default\searchplugins\sweetim.xml
[2011.06.10 08:05:33 | 000,001,061 | -H-- | M] () -- C:\Users\Luffy\AppData\Roaming\Mozilla\Firefox\Profiles\li06tyiv.default\searchplugins\yahoo-zugo.xml
[2011.06.19 21:25:23 | 000,000,000 | -H-D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2010.11.02 20:37:01 | 000,000,000 | -H-D | M] ("ICQ Toolbar") -- C:\Programme\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2010.02.11 22:14:36 | 000,000,000 | -H-D | M] ("ICQ Toolbar") -- C:\Programme\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}(11)
[2010.03.02 08:31:31 | 000,000,000 | -H-D | M] ("ICQ Toolbar") -- C:\Programme\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}(17)
[2010.03.02 09:00:33 | 000,000,000 | -H-D | M] ("ICQ Toolbar") -- C:\Programme\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}(18)
[2010.05.24 14:28:21 | 000,000,000 | -H-D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010.08.22 21:20:45 | 000,000,000 | -H-D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2010.11.03 14:25:27 | 000,000,000 | -H-D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2011.06.10 15:02:03 | 000,000,000 | -H-D | M] (ScanQuery) -- C:\Programme\Mozilla Firefox\extensions\{DE9265D8-D55D-4286-9DC4-F8D8A0CA2F64}
[2010.11.24 21:09:28 | 000,000,000 | -H-D | M] (AVG Safe Search) -- C:\PROGRAM FILES\AVG\AVG9\FIREFOX
[2011.04.14 07:16:42 | 000,000,000 | -H-D | M] (ClickPotatoLite Component) -- C:\PROGRAM FILES\CLICKPOTATOLITE\BIN\10.0.668.0\FIREFOX\EXTENSIONS
[2009.04.10 15:51:23 | 000,000,000 | -H-D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
[2009.08.29 07:01:01 | 000,000,000 | -H-D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
[2009.12.01 19:22:59 | 000,000,000 | -H-D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
[2010.05.24 14:28:21 | 000,000,000 | -H-D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010.08.22 21:20:45 | 000,000,000 | -H-D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2010.11.03 14:25:27 | 000,000,000 | -H-D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2011.06.10 15:02:03 | 000,000,000 | -H-D | M] (ScanQuery) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{DE9265D8-D55D-4286-9DC4-F8D8A0CA2F64}
[2011.06.13 14:20:13 | 000,000,000 | -H-D | M] (RealPlayer Browser Record Plugin) -- C:\PROGRAMDATA\REAL\REALPLAYER\BROWSERRECORDPLUGIN\FIREFOX\EXT
[2010.09.15 05:50:38 | 000,472,808 | -H-- | M] (Sun Microsystems, Inc.) -- C:\Programme\Mozilla Firefox\plugins\npdeployJava1.dll
[2011.06.16 09:28:41 | 000,001,392 | -H-- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2011.06.16 09:28:41 | 000,002,344 | -H-- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml
[2011.03.19 09:39:05 | 000,002,046 | -H-- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\fcmdSrchddr.xml
[2011.06.16 09:28:42 | 000,006,805 | -H-- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2011.06.16 09:28:42 | 000,001,178 | -H-- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2011.06.16 09:28:42 | 000,001,105 | -H-- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | -H-- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: ::1            localhost
O2 - BHO: (ShoppingReport2) - {258C9770-1713-4021-8D7E-1F184A2BD754} - C:\Programme\ShoppingReport2\Bin\2.7.34\ShoppingReport.dll (SmartShopper Networks)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Programme\AVG\AVG9\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (CescrtHlpr Object) - {64182481-4F71-486b-A045-B233BD0DA8FC} - C:\Programme\facemoods.com\facemoods\1.4.17.5\bh\facemoods.dll (facemoods.com BHO)
O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Programme\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)
O2 - BHO: (Softonic Deutsch Toolbar) - {8dbb6d8e-e4a6-4e3b-9753-af78b226441c} - C:\Programme\Softonic_Deutsch\tbSoft.dll (Conduit Ltd.)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\Programme\Google\GoogleToolbar1.dll (Google Germany GmbH)
O2 - BHO: (DVDVideoSoft Toolbar) - {e9911ec6-1bcc-40b0-9993-e0eea7f6953f} - C:\Programme\DVDVideoSoft\tbDVDV.dll (Conduit Ltd.)
O2 - BHO: (SweetIM Toolbar Helper) - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
O3 - HKLM\..\Toolbar: (facemoods Toolbar) - {DB4E9724-F518-4dfd-9C7C-78B52103CAB9} - C:\Programme\facemoods.com\facemoods\1.4.17.5\facemoodsTlbr.dll (facemoods.com)
O3 - HKLM\..\Toolbar: (DVDVideoSoft Toolbar) - {e9911ec6-1bcc-40b0-9993-e0eea7f6953f} - C:\Programme\DVDVideoSoft\tbDVDV.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (SweetIM Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O3 - HKU\S-1-5-21-2527848741-3311900059-3240881507-1000\..\Toolbar\WebBrowser: (DVDVideoSoft Toolbar) - {E9911EC6-1BCC-40B0-9993-E0EEA7F6953F} - C:\Programme\DVDVideoSoft\tbDVDV.dll (Conduit Ltd.)
O3 - HKU\S-1-5-21-2527848741-3311900059-3240881507-1000\..\Toolbar\WebBrowser: (SweetIM Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O4 - HKLM..\Run: [AVG9_TRAY] C:\Programme\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [ClickPotatoLiteSA] C:\Program Files\ClickPotatoLite\bin\10.0.668.0\ClickPotatoLiteSA.exe (Pinball Corporation.)
O4 - HKLM..\Run: [facemoods] C:\Program Files\facemoods.com\facemoods\1.4.17.5\facemoodssrv.exe (facemoods.com)
O4 - HKLM..\Run: [NeroFilterCheck] C:\Programme\Common Files\Ahead\Lib\NeroCheck.exe (Nero AG)
O4 - HKLM..\Run: [SMSERIAL] C:\Programme\Motorola\SMSERIAL\sm56hlpr.exe (Motorola Inc.)
O4 - HKLM..\Run: [snpstd3] C:\Windows\vsnpstd3.exe ()
O4 - HKLM..\Run: [SweetIM] C:\Programme\SweetIM\Messenger\SweetIM.exe (SweetIM Technologies Ltd.)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Real\RealPlayer\update\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKLM..\Run: [Windows Mobile-based device management] C:\Windows\WindowsMobile\wmdSync.exe (Microsoft Corporation)
O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-21-2527848741-3311900059-3240881507-1000..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe (Nero AG)
O4 - HKU\S-1-5-21-2527848741-3311900059-3240881507-1000..\Run: [BitTorrent DNA] C:\Users\Luffy\Program Files\DNA\btdna.exe (BitTorrent, Inc.)
O4 - HKU\S-1-5-21-2527848741-3311900059-3240881507-1000..\Run: [fVsVFGfVFkPeQTy] C:\ProgramData\fVsVFGfVFkPeQTy.exe (Sysinternals)
O4 - HKU\S-1-5-21-2527848741-3311900059-3240881507-1000..\Run: [GMX SMS-Manager] C:\Programme\GMX\GMX SMS-Manager\SMSMngr.exe (1&1 Internet AG)
O4 - HKU\S-1-5-21-2527848741-3311900059-3240881507-1000..\Run: [Sony Ericsson PC Suite] C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe (Sony Ericsson Mobile Communications AB)
O4 - HKU\S-1-5-21-2527848741-3311900059-3240881507-1000..\Run: [swg] C:\Programme\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe (Google Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O7 - HKU\S-1-5-21-2527848741-3311900059-3240881507-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O9 - Extra Button: ICQ7.4 - {73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - C:\Programme\ICQ7.4\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.4 - {73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - C:\Programme\ICQ7.4\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: ClickPotato - {B58926D6-CFB0-45d2-9C28-4B5A0F0368AE} - C:\Programme\ClickPotatoLite\bin\10.0.668.0\ClickPotatoLiteSABHO.dll (Pinball Corporation)
O9 - Extra Button: ShopperReports - Compare product prices - {DB38E21A-0133-419d-92AD-ECDFD5244D6D} - C:\Programme\ShoppingReport2\Bin\2.7.34\ShoppingReport.dll (SmartShopper Networks)
O9 - Extra Button: ShopperReports - Compare travel rates - {EB620C54-E229-4942-87CE-E717109FC8C6} - C:\Programme\ShoppingReport2\Bin\2.7.34\ShoppingReport.dll (SmartShopper Networks)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} hxxp://icq.oberon-media.com/Gameshell/GameHost/1.0/OberonGameHost.cab (Oberon Flash Game Host)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Programme\AVG\AVG9\avgpp.dll (AVG Technologies CZ, s.r.o.)
O20 - AppInit_DLLs: (avgrsstx.dll) - C:\Windows\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Luffy\Desktop\Neuer Ordner\symbole_files\(03)_Hak.JPG
O24 - Desktop BackupWallPaper: C:\Users\Luffy\Desktop\Neuer Ordner\symbole_files\(03)_Hak.JPG
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | -H-- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{69018abc-f15a-11de-8180-00a0d1c4b279}\Shell - "" = AutoRun
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
NetSvcs: UxTuneUp - C:\Windows\System32\uxtuneup.dll (TuneUp Software)
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias -  File not found
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
 
SafeBootMin: AppMgmt - Service
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: NTDS -  File not found
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet: AppMgmt - Service
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: NTDS -  File not found
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} -
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0
ActiveX: {23325F73-AF59-1597-8F0F-C604055ABA54} - .NET Framework
ActiveX: {233C1507-6A77-46A4-9443-F871F945D258} - Adobe Shockwave Director 11.0.3
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2A202491-F00D-11cf-87CC-0020AFEECF20} - Adobe Shockwave Director 11.0.3
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} -
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {DAA94A2A-2A8D-4D3B-9DB8-56FBECED082D} - Microsoft .NET Framework 1.1 Security Update (KB953297)
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E78BFA60-5393-4C38-82AB-E8019E464EB4} - .NET Framework
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.lhacm - C:\Windows\System32\lhacm.acm (Microsoft Corporation)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.XVID - C:\Windows\System32\xvidvfw.dll ()
Drivers32: wave1 - C:\Windows\System32\serwvdrv.dll (Microsoft Corporation)
 
CREATERESTOREPOINT
Error creating restore point.
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.06.20 13:54:40 | 000,000,000 | -H-D | C] -- C:\Users\Luffy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Vista Repair
[2011.06.20 13:53:48 | 000,364,544 | -H-- | C] (Sysinternals) -- C:\ProgramData\29089552.exe
[2011.06.20 13:44:28 | 000,452,608 | -H-- | C] (Sysinternals) -- C:\ProgramData\fVsVFGfVFkPeQTy.exe
[2011.06.16 00:53:13 | 000,000,000 | -H-D | C] -- C:\6b149aa75bb92c904a121bb2
[2011.06.10 08:06:01 | 000,000,000 | -H-D | C] -- C:\Users\Luffy\AppData\Roaming\HamsterSoft
[2011.06.10 08:05:46 | 000,000,000 | -H-D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hamster Soft
[2011.06.10 08:05:41 | 000,000,000 | -H-D | C] -- C:\Programme\Hamster Soft
[2011.06.10 08:03:04 | 000,314,808 | -H-- | C] (HamsterSoft, Inc.) -- C:\Users\Luffy\Desktop\hamsterfreevideoconverter.exe
[2011.06.08 11:55:30 | 000,000,000 | -H-D | C] -- C:\Users\Luffy\Desktop\dragons
[2011.06.07 11:56:05 | 000,000,000 | -H-D | C] -- C:\Programme\Common Files\xing shared
[2011.06.07 11:55:50 | 000,198,848 | -H-- | C] (RealNetworks, Inc.) -- C:\Windows\System32\rmoc3260.dll
[2011.06.07 11:55:35 | 000,006,656 | -H-- | C] (RealNetworks, Inc.) -- C:\Windows\System32\pndx5016.dll
[2011.06.07 11:55:35 | 000,005,632 | -H-- | C] (RealNetworks, Inc.) -- C:\Windows\System32\pndx5032.dll
[2011.06.07 11:55:33 | 000,000,000 | -H-D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Real
[2011.05.27 01:33:24 | 000,000,000 | -H-D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth
[2010.07.05 20:28:50 | 000,148,736 | -H-- | C] (Avanquest Software) -- C:\ProgramData\hpe5275.dll
[2007.03.12 12:41:52 | 000,061,440 | -H-- | C] ( ) -- C:\Windows\System32\vsnpstd3.dll
[2005.11.23 13:55:32 | 000,053,248 | -H-- | C] ( ) -- C:\Windows\System32\csnpstd3.dll
[1 C:\*.tmp files -> C:\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2011.06.20 16:23:52 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011.06.20 16:03:18 | 000,000,522 | -H-- | M] () -- C:\Windows\tasks\1-Klick-Wartung.job
[2011.06.20 16:01:54 | 000,003,552 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011.06.20 16:01:54 | 000,003,552 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011.06.20 16:01:54 | 000,001,094 | -H-- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011.06.20 15:37:15 | 000,229,672 | -H-- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2011.06.20 15:33:55 | 000,000,286 | -H-- | M] () -- C:\Windows\tasks\RealUpgradeScheduledTaskS-1-5-21-2527848741-3311900059-3240881507-1000.job
[2011.06.20 14:24:01 | 000,001,098 | -H-- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011.06.20 13:55:19 | 000,000,224 | -H-- | M] () -- C:\ProgramData\~29089552
[2011.06.20 13:55:18 | 000,000,152 | -H-- | M] () -- C:\ProgramData\~29089552r
[2011.06.20 13:54:41 | 000,000,591 | -H-- | M] () -- C:\Users\Luffy\Desktop\Windows Vista Repair.lnk
[2011.06.20 13:54:20 | 000,000,336 | -H-- | M] () -- C:\ProgramData\29089552
[2011.06.20 13:53:48 | 000,364,544 | -H-- | M] (Sysinternals) -- C:\ProgramData\29089552.exe
[2011.06.20 13:44:26 | 000,452,608 | -H-- | M] (Sysinternals) -- C:\ProgramData\fVsVFGfVFkPeQTy.exe
[2011.06.20 10:25:05 | 078,264,409 | -H-- | M] () -- C:\Windows\System32\drivers\Avg\incavi.avm
[2011.06.20 10:18:42 | 000,000,436 | -H-- | M] () -- C:\Windows\System32\drivers\etc\hosts.ics
[2011.06.10 08:05:50 | 000,001,108 | -H-- | M] () -- C:\Users\Luffy\Desktop\Hamster Free Video Converter.lnk
[2011.06.10 08:03:06 | 000,314,808 | -H-- | M] (HamsterSoft, Inc.) -- C:\Users\Luffy\Desktop\hamsterfreevideoconverter.exe
[2011.06.08 11:58:43 | 000,001,637 | -H-- | M] () -- C:\Users\Luffy\Desktop\Paint.lnk
[2011.06.07 11:55:50 | 000,198,848 | -H-- | M] (RealNetworks, Inc.) -- C:\Windows\System32\rmoc3260.dll
[2011.06.07 11:55:35 | 000,006,656 | -H-- | M] (RealNetworks, Inc.) -- C:\Windows\System32\pndx5016.dll
[2011.06.07 11:55:35 | 000,005,632 | -H-- | M] (RealNetworks, Inc.) -- C:\Windows\System32\pndx5032.dll
[2011.06.07 11:55:33 | 000,272,896 | -H-- | M] (Progressive Networks) -- C:\Windows\System32\pncrt.dll
[2011.06.02 11:34:39 | 004,045,158 | -H-- | M] () -- C:\Windows\System32\perfh007.dat
[2011.06.02 11:34:39 | 001,665,680 | -H-- | M] () -- C:\Windows\System32\perfh009.dat
[2011.06.02 11:34:39 | 001,234,642 | -H-- | M] () -- C:\Windows\System32\perfc007.dat
[2011.06.02 11:34:39 | 001,112,968 | -H-- | M] () -- C:\Windows\System32\perfc009.dat
[2011.06.02 11:34:02 | 000,000,069 | -H-- | M] () -- C:\Windows\NeroDigital.ini
[2011.06.02 11:33:59 | 000,127,488 | -H-- | M] () -- C:\Users\Luffy\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[1 C:\*.tmp files -> C:\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2011.06.20 15:33:55 | 000,000,286 | -H-- | C] () -- C:\Windows\tasks\RealUpgradeScheduledTaskS-1-5-21-2527848741-3311900059-3240881507-1000.job
[2011.06.20 13:55:18 | 000,000,224 | -H-- | C] () -- C:\ProgramData\~29089552
[2011.06.20 13:55:18 | 000,000,152 | -H-- | C] () -- C:\ProgramData\~29089552r
[2011.06.20 13:54:41 | 000,000,591 | -H-- | C] () -- C:\Users\Luffy\Desktop\Windows Vista Repair.lnk
[2011.06.20 13:54:20 | 000,000,336 | -H-- | C] () -- C:\ProgramData\29089552
[2011.06.10 08:05:50 | 000,001,108 | -H-- | C] () -- C:\Users\Luffy\Desktop\Hamster Free Video Converter.lnk
[2011.06.08 11:58:43 | 000,001,637 | -H-- | C] () -- C:\Users\Luffy\Desktop\Paint.lnk
[2011.04.14 07:17:55 | 000,650,752 | -H-- | C] () -- C:\Windows\System32\xvidcore.dll
[2011.04.14 07:17:55 | 000,240,640 | -H-- | C] () -- C:\Windows\System32\xvidvfw.dll
[2010.05.30 11:53:58 | 000,000,151 | -H-- | C] () -- C:\Windows\PhotoSnapViewer.INI
[2010.02.06 20:57:47 | 000,000,618 | -H-- | C] () -- C:\Windows\eReg.dat
[2010.01.14 21:55:42 | 000,000,960 | -H-- | C] () -- C:\ProgramData\ss.ini
[2010.01.01 20:05:39 | 000,307,200 | -H-- | C] () -- C:\Windows\System32\AscSQLite.dll
[2009.10.12 22:32:09 | 000,000,069 | -H-- | C] () -- C:\Windows\NeroDigital.ini
[2009.10.12 22:20:29 | 000,000,039 | -H-- | C] () -- C:\Windows\Irremote.ini
[2009.06.02 20:05:18 | 000,000,088 | -H-- | C] () -- C:\Users\Luffy\AppData\Local\koega.bat
[2009.06.02 15:16:48 | 000,321,462 | -H-- | C] () -- C:\Users\Luffy\AppData\Local\gokui_nav.dat
[2009.06.02 15:16:48 | 000,000,643 | -H-- | C] () -- C:\Users\Luffy\AppData\Local\gokui_navps.dat
[2009.05.27 19:39:20 | 000,000,090 | -H-- | C] () -- C:\Users\Luffy\AppData\Local\ysgwyee.bat
[2009.05.27 08:02:16 | 000,000,088 | -H-- | C] () -- C:\Users\Luffy\AppData\Local\ucgye.bat
[2009.05.19 20:12:35 | 000,000,090 | -H-- | C] () -- C:\Users\Luffy\AppData\Local\sscqwuq.bat
[2009.05.19 12:29:36 | 000,000,090 | -H-- | C] () -- C:\Users\Luffy\AppData\Local\eaqukcm.bat
[2009.05.13 19:16:58 | 000,000,088 | -H-- | C] () -- C:\Users\Luffy\AppData\Local\uwqwe.bat
[2009.05.09 09:56:56 | 000,000,088 | -H-- | C] () -- C:\Users\Luffy\AppData\Local\qyiym.bat
[2009.05.04 16:07:04 | 000,024,206 | -H-- | C] () -- C:\Users\Luffy\AppData\Roaming\UserTile.png
[2009.04.24 18:52:41 | 000,000,088 | -H-- | C] () -- C:\Users\Luffy\AppData\Local\awwkm.bat
[2009.04.23 09:32:13 | 000,000,306 | RHS- | C] () -- C:\ProgramData\ntuser.pol
[2009.04.22 09:12:59 | 000,000,090 | -H-- | C] () -- C:\Users\Luffy\AppData\Local\igemwmi.bat
[2009.04.21 09:43:42 | 000,000,090 | -H-- | C] () -- C:\Users\Luffy\AppData\Local\smekscg.bat
[2009.04.21 08:47:36 | 000,000,031 | -H-- | C] () -- C:\Windows\warhead.ini
[2009.04.19 10:00:52 | 000,000,040 | -H-- | C] () -- C:\Windows\SIERRA.INI
[2009.04.18 12:01:37 | 000,069,632 | -H-- | C] () -- C:\Windows\System32\xmltok.dll
[2009.04.18 12:01:37 | 000,036,864 | -H-- | C] () -- C:\Windows\System32\xmlparse.dll
[2009.04.18 11:33:20 | 000,000,068 | -H-- | C] () -- C:\Windows\WININIT.INI
[2009.04.18 10:59:01 | 000,118,784 | -H-- | C] () -- C:\Windows\bwUnin-6.3.2.62-4476822L.exe
[2009.04.17 10:57:39 | 000,003,934 | -H-- | C] () -- C:\Windows\cdplayer.ini
[2009.04.17 09:55:54 | 000,127,488 | -H-- | C] () -- C:\Users\Luffy\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009.03.12 04:42:36 | 000,000,090 | -H-- | C] () -- C:\Users\Luffy\AppData\Local\oameg.bat
[2009.02.16 15:20:50 | 000,000,093 | -H-- | C] () -- C:\Users\Luffy\AppData\Local\fusioncache.dat
[2008.10.13 01:15:24 | 000,290,748 | -H-- | C] () -- C:\Windows\System32\perfi007.dat
[2008.10.13 01:15:23 | 004,045,158 | -H-- | C] () -- C:\Windows\System32\perfh007.dat
[2008.10.13 01:15:23 | 001,234,642 | -H-- | C] () -- C:\Windows\System32\perfc007.dat
[2008.10.13 01:15:23 | 000,036,916 | -H-- | C] () -- C:\Windows\System32\perfd007.dat
[2008.10.12 15:28:35 | 000,000,680 | -H-- | C] () -- C:\Users\Luffy\AppData\Local\d3d9caps.dat
[2006.11.02 14:53:49 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006.11.02 14:44:53 | 000,229,672 | -H-- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006.11.02 12:33:01 | 001,665,680 | -H-- | C] () -- C:\Windows\System32\perfh009.dat
[2006.11.02 12:33:01 | 001,112,968 | -H-- | C] () -- C:\Windows\System32\perfc009.dat
[2006.11.02 12:33:01 | 000,287,440 | -H-- | C] () -- C:\Windows\System32\perfi009.dat
[2006.11.02 12:33:01 | 000,030,674 | -H-- | C] () -- C:\Windows\System32\perfd009.dat
[2006.11.02 12:23:21 | 000,215,943 | -H-- | C] () -- C:\Windows\System32\dssec.dat
[2006.11.02 10:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006.11.02 10:19:00 | 000,000,741 | -H-- | C] () -- C:\Windows\System32\NOISE.DAT
[2006.11.02 09:40:29 | 000,013,750 | -H-- | C] () -- C:\Windows\System32\pacerprf.ini
[2006.11.02 09:25:31 | 000,673,088 | -H-- | C] () -- C:\Windows\System32\mlang.dat
[2006.11.02 09:22:43 | 000,099,999 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2006.11.02 09:22:43 | 000,018,271 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2006.10.27 08:26:56 | 000,069,632 | -H-- | C] () -- C:\Windows\System32\vuins32.dll
[2006.09.19 10:07:28 | 000,827,392 | -H-- | C] () -- C:\Windows\vsnpstd3.exe
[2004.02.27 17:36:18 | 000,015,498 | -H-- | C] () -- C:\Windows\snpstd3.ini
[2001.09.18 13:00:00 | 000,065,536 | -H-- | C] () -- C:\Windows\System32\bmpproc.dll
[2001.09.18 13:00:00 | 000,032,528 | -H-- | C] () -- C:\Windows\amcap.exe
 
========== LOP Check ==========
 
[2009.05.10 21:13:21 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\AntsSoft
[2010.01.01 21:17:22 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\Auslogics
[2011.04.14 07:16:42 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\ClickPotatoLite
[2011.05.15 21:08:07 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\com.johnwu.sparkboothhome
[2011.06.20 16:07:21 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\DNA
[2009.05.10 14:48:01 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\gtk-2.0
[2011.06.10 08:06:01 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\HamsterSoft
[2011.06.20 13:09:56 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\ICQ
[2009.05.21 13:01:33 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\IrfanView
[2009.05.22 22:54:40 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\Opera
[2009.04.08 00:34:12 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\phonostar-Player
[2010.04.24 20:50:14 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\Sony
[2010.05.24 14:28:24 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\Sony Setup
[2009.02.16 15:17:36 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\T-Online
[2011.05.08 22:25:29 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\TS3Client
[2009.04.15 11:28:55 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\TuneUp Software
[2010.06.02 18:12:51 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\Uniblue
[2011.06.12 12:21:45 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\UseNeXT
[2011.06.20 16:03:18 | 000,000,522 | -H-- | M] () -- C:\Windows\Tasks\1-Klick-Wartung.job
[2011.06.20 16:00:28 | 000,032,620 | -H-- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2011.05.15 21:05:08 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\Adobe
[2010.07.17 11:21:30 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\Ahead
[2009.05.10 21:13:21 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\AntsSoft
[2010.05.03 08:15:22 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\Apple Computer
[2010.01.01 21:17:22 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\Auslogics
[2011.04.14 07:16:42 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\ClickPotatoLite
[2011.05.15 21:08:07 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\com.johnwu.sparkboothhome
[2011.06.20 16:07:21 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\DNA
[2011.04.03 00:33:05 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\dvdcss
[2009.02.16 15:52:41 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\Google
[2009.05.10 14:48:01 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\gtk-2.0
[2011.06.10 08:06:01 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\HamsterSoft
[2011.06.20 13:09:56 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\ICQ
[2008.10.12 15:28:41 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\Identities
[2009.05.21 13:01:33 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\IrfanView
[2009.02.13 18:34:59 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\Macromedia
[2010.10.25 13:26:24 | 000,000,000 | --SD | M] -- C:\Users\Luffy\AppData\Roaming\Microsoft
[2009.02.18 13:20:26 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\Mozilla
[2009.10.12 22:29:36 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\Nero
[2009.05.22 22:54:40 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\Opera
[2009.04.08 00:34:12 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\phonostar-Player
[2011.06.07 11:56:39 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\Real
[2010.04.24 20:50:14 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\Sony
[2010.05.24 14:28:24 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\Sony Setup
[2009.02.16 15:17:36 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\T-Online
[2011.05.15 21:29:31 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\teamspeak2
[2011.05.08 22:25:29 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\TS3Client
[2009.04.15 11:28:55 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\TuneUp Software
[2009.12.25 19:28:35 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\U3
[2010.06.02 18:12:51 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\Uniblue
[2011.06.12 12:21:45 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\UseNeXT
[2011.03.11 08:27:21 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\vlc
[2010.09.21 20:36:05 | 000,000,000 | -H-D | M] -- C:\Users\Luffy\AppData\Roaming\WinRAR
 
< %APPDATA%\*.exe /s >
[2010.04.24 20:47:55 | 000,010,134 | RH-- | M] () -- C:\Users\Luffy\AppData\Roaming\Microsoft\Installer\{0E532C84-4275-41B3-9D81-D4A1A20D8EE7}\ARPPRODUCTICON.exe
[2011.01.23 19:26:00 | 000,510,120 | -H-- | M] (RealNetworks, Inc.) -- C:\Users\Luffy\AppData\Roaming\Real\Update\setup3.13\setup.exe
[2010.04.24 20:40:13 | 033,850,672 | -H-- | M] (Apple Inc.) -- C:\Users\Luffy\AppData\Roaming\Sony Setup\9234765D-29DF-48d0-93FB-284B7B6009B9\QuickTimeInstaller.exe
[2007.10.23 10:27:20 | 000,110,592 | -H-- | M] () -- C:\Users\Luffy\AppData\Roaming\U3\temp\cleanup.exe
[2008.05.02 11:41:48 | 003,493,888 | -H-- | M] (SanDisk Corporation) -- C:\Users\Luffy\AppData\Roaming\U3\temp\Launchpad Removal.exe
[2010.06.14 22:06:15 | 005,037,504 | -H-- | M] (Uniblue Systems Ltd                                        ) -- C:\Users\Luffy\AppData\Roaming\Uniblue\RegistryBooster\_temp\ub.exe
 
< %SYSTEMDRIVE%\*.exe >
 
 
< MD5 for: AGP440.SYS  >
[2006.11.02 11:49:52 | 000,053,864 | -H-- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\drivers\AGP440.sys
[2006.11.02 11:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2006.11.02 11:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys
[2009.02.14 14:51:17 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\Windows\System32\drivers\atapi.sys
[2009.02.14 14:51:17 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_7de13c21\atapi.sys
[2009.02.14 14:51:17 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16632_none_db337a442479c42c\atapi.sys
[2009.02.14 14:51:17 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=E03E8C99D15D0381E02743C36AFC7C6F -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20757_none_dbac78a93da31a8b\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll
[2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll
 
< MD5 for: EXPLORER.EXE  >
[2009.02.14 14:50:34 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=37440D09DEAE0B672A04DCCF7ABF06BE -- C:\Windows\explorer.exe
[2009.02.14 14:50:34 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=37440D09DEAE0B672A04DCCF7ABF06BE -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_4f83bb287ccdb7e3\explorer.exe
[2009.02.14 14:50:33 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_5177ca9879e978e8\explorer.exe
[2009.02.14 14:50:32 | 002,927,616 | ---- | M] (Microsoft Corporation) MD5=50BA5850147410CDE89C523AD3BC606E -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_51e4f8c7931bd1e1\explorer.exe
[2009.02.14 15:09:03 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=6D06CD98D954FE87FB2DB8108793B399 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16549_none_4fac29707cae347a\explorer.exe
[2009.02.14 15:09:03 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=BD06F0BF753BC704B653C3A50F89D362 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20668_none_501f261995dcf2cf\explorer.exe
[2009.02.14 14:50:33 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=E7156B0B74762D9DE0E66BDCDE06E5FB -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_5033cb5995cd990b\explorer.exe
[2006.11.02 11:45:07 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=FD8C53FB002217F6F888BCF6F5D7084D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16386_none_4f7de5167cd15deb\explorer.exe
 
< MD5 for: IASTORV.SYS  >
[2006.11.02 11:51:25 | 000,232,040 | -H-- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\drivers\iaStorV.sys
[2006.11.02 11:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2006.11.02 11:46:11 | 000,559,616 | ---- | M] (Microsoft Corporation) MD5=889A2C9F2AACCD8F64EF50AC0B3D553B -- C:\Windows\System32\netlogon.dll
[2006.11.02 11:46:11 | 000,559,616 | ---- | M] (Microsoft Corporation) MD5=889A2C9F2AACCD8F64EF50AC0B3D553B -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6000.16386_none_fb80f5473b0ed783\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2006.11.02 11:50:13 | 000,040,040 | -H-- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\drivers\nvstor.sys
[2006.11.02 11:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2006.11.02 11:46:12 | 000,176,640 | ---- | M] (Microsoft Corporation) MD5=80E2839D05CA5970A86D7BE2A08BFF61 -- C:\Windows\System32\scecli.dll
[2006.11.02 11:46:12 | 000,176,640 | ---- | M] (Microsoft Corporation) MD5=80E2839D05CA5970A86D7BE2A08BFF61 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6000.16386_none_35d7205fdc305e3e\scecli.dll
 
< MD5 for: USER32.DLL  >
[2009.02.14 14:37:58 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=63B4F59D7C89B1BF5277F1FFEFD491CD -- C:\Windows\System32\user32.dll
[2009.02.14 14:37:58 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=63B4F59D7C89B1BF5277F1FFEFD491CD -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.16438_none_cb39bc5b7047127e\user32.dll
[2009.02.14 14:37:58 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=9D9F061EDA75425FC67F0365E3467C86 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.20537_none_cbc258dc896598f1\user32.dll
[2006.11.02 11:46:13 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=E698A5437B89A285ACA3FF022356810A -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.16386_none_cb01aa4570716e5e\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2006.11.02 11:45:50 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=22027835939F86C3E47AD8E3FBDE3D11 -- C:\Windows\System32\userinit.exe
[2006.11.02 11:45:50 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=22027835939F86C3E47AD8E3FBDE3D11 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6000.16386_none_d9f1f819d4c4e737\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2006.11.02 11:45:57 | 000,308,224 | ---- | M] (Microsoft Corporation) MD5=9F75392B9128A91ABAFB044EA350BAAD -- C:\Windows\System32\winlogon.exe
[2006.11.02 11:45:57 | 000,308,224 | ---- | M] (Microsoft Corporation) MD5=9F75392B9128A91ABAFB044EA350BAAD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6000.16386_none_6d8c3f1ad8066b21\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2006.11.02 10:58:26 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=84620AECDCFD2A7A14E6263927D8C0ED -- C:\Windows\System32\drivers\ws2ifsl.sys
[2006.11.02 10:58:26 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=84620AECDCFD2A7A14E6263927D8C0ED -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6000.16386_none_4d4fded8cae2956d\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
[2006.11.02 12:34:05 | 000,008,192 | -H-- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV
[2006.11.02 12:34:05 | 000,020,480 | -H-- | M] () -- C:\Windows\System32\config\DEFAULT.SAV
[2006.11.02 12:34:05 | 000,008,192 | -H-- | M] () -- C:\Windows\System32\config\SECURITY.SAV
[2006.11.02 12:34:08 | 010,133,504 | -H-- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV
[2006.11.02 12:34:08 | 001,826,816 | -H-- | M] () -- C:\Windows\System32\config\SYSTEM.SAV
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
 
< End of report >
--- --- ---


OTL EXTRAS Logfile:
Code:
OTL Extras logfile created on: 20.06.2011 16:31:48 - Run 1
OTL by OldTimer - Version 3.2.24.1    Folder = C:\Users\Luffy\Downloads
Windows Vista Home Basic Edition  (Version = 6.0.6000) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18904)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
893,56 Mb Total Physical Memory | 486,90 Mb Available Physical Memory | 54,49% Memory free
2,13 Gb Paging File | 1,86 Gb Available in Paging File | 87,13% Paging File free
Paging file location(s): C:\pagefile.sys 1339 1339 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 37,26 Gb Total Space | 7,96 Gb Free Space | 21,37% Space Free | Partition Type: NTFS
 
Computer Name: WIHTEBIRT | User Name: Luffy | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
 
[HKEY_USERS\S-1-5-21-2527848741-3311900059-3240881507-1000\SOFTWARE\Classes\<extension>]
.html [@ = ChromeHTML] -- Reg Error: Key error. File not found
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{01F71303-4B2B-45BD-BBE8-EEEF5A4216ED}" = lport=547 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{0981C61B-FAB8-4E77-8DC3-4ED82BE11027}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{0CB808FE-E529-43AB-8921-365ED5816D8A}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{13B52BC0-C6B2-4E6E-A1DA-8F95F78F14C2}" = lport=67 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{19A9A0F2-FAD7-4A2E-BDD5-2AC6DEC73021}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{1CF9BBDB-5877-4A83-B631-2722267A6835}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{389158C0-1863-44A2-973F-6FA4CB6D4A03}" = lport=53 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{3E171DF2-5F3D-48BF-AF7F-44E70EFBC3C9}" = lport=139 | protocol=6 | dir=in | app=system |
"{3E323BBD-DA55-4B1B-9C24-AC3CE1E512DC}" = rport=445 | protocol=6 | dir=out | app=system |
"{860FF4AE-6755-4F68-9D62-8C489B1CDA3A}" = rport=2869 | protocol=6 | dir=out | app=system |
"{87DD8C26-E64F-4478-A307-6D2999FC9511}" = lport=137 | protocol=17 | dir=in | app=system |
"{9CACE15F-B4F7-4F23-8A60-790C741C3B2F}" = rport=139 | protocol=6 | dir=out | app=system |
"{AB8F2F94-5212-48D1-A5E7-B45B403280F6}" = rport=137 | protocol=17 | dir=out | app=system |
"{AE8ED6BB-001E-4BAF-9022-1AA72E2540CD}" = rport=138 | protocol=17 | dir=out | app=system |
"{BE763485-BFD2-4A8E-AD10-AB850DA7F7E1}" = lport=2869 | protocol=6 | dir=in | app=system |
"{DECB7256-2AFB-468F-8F17-761F20EE9765}" = lport=68 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{EB722D7E-DE87-4414-943E-0AC8759595E6}" = lport=138 | protocol=17 | dir=in | app=system |
"{FFDE602C-6D6E-4CC5-BB5D-7B61C4EE0B65}" = lport=445 | protocol=6 | dir=in | app=system |
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{14F13C46-891D-4AAC-AA6F-106D05BE45F6}" = dir=in | app=c:\program files\avg\avg9\avgdiagex.exe |
"{16B83387-F3DA-408B-B1AE-6567B3C6D7E8}" = protocol=6 | dir=in | app=c:\program files\icq7.4\icq.exe |
"{180FECEC-8001-43DC-A9A3-7EAF25071A94}" = protocol=17 | dir=in | app=c:\program files\dna\btdna.exe |
"{29F66ED9-95FE-4634-B082-98D3CEAE3548}" = dir=out | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{2D1132F1-429A-43F7-920E-BC210CAF220F}" = protocol=17 | dir=in | app=c:\programdata\sweetim\messenger\update\sweetimsetup.exe |
"{2E6DC27D-274B-42A9-9C5F-B1FBC8155348}" = protocol=6 | dir=in | app=c:\program files\icq7.4\icq.exe |
"{32B2E03D-8743-485F-B62F-701B99577A4D}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{3FEDB7EE-168F-4D3E-AB69-590EDD616975}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{4A6810B9-BC56-49D8-85F4-19386C073804}" = protocol=17 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{50B4F563-C950-42E0-9D74-AE6371C326C6}" = protocol=17 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{5934F792-6062-4803-8101-DCAB9F4DE503}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{68612014-57BB-422D-93A9-6EC7921D346E}" = protocol=6 | dir=in | app=c:\program files\icq7.4\icq.exe |
"{7B024A61-66E0-4882-892D-8C5992FB4886}" = protocol=17 | dir=in | app=c:\program files\icq7.4\icq.exe |
"{7FE95D49-AED0-459D-A380-3821BE9B0CF2}" = protocol=6 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{87C1A0D4-5877-4B2B-86A8-8EBB8B0A2877}" = protocol=17 | dir=in | app=c:\program files\icq7.4\icq.exe |
"{8BF41D2E-BF7D-45FA-B436-39FA24AD8D54}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{8CEA91F6-96B8-4FAE-96FA-DD80AD5E35FA}" = protocol=58 | dir=in | name=@hnetcfg.dll,-148 |
"{91B08133-3DF3-42EE-A618-EA3A2E16CC0D}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{93417572-F828-4955-8B31-58744D6AF6CC}" = protocol=6 | dir=in | app=c:\program files\dna\btdna.exe |
"{992D46F6-5EFC-4ECC-884A-65E914AA80DE}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{A8AAAAC0-DED4-4199-9CE2-42DA8FDC1DDF}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{AD100518-5F56-41CA-B3B2-5FB5A2946EF2}" = protocol=17 | dir=in | app=c:\program files\icq7.4\icq.exe |
"{D7591F63-38D5-4BCF-8C44-26F813311A8C}" = dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{EB2F476C-8926-4A05-AE50-2CE5303A0C5C}" = protocol=6 | dir=in | app=c:\programdata\sweetim\messenger\update\sweetimsetup.exe |
"{F134C143-D74C-4B4E-8600-4B94A4B6B886}" = protocol=6 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{F8D2EE41-EF34-48B0-AB5C-C8770A107B7D}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{FF59799E-E276-42F5-864A-0C4FF8E377FB}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"TCP Query User{22395FE2-0E06-4013-85F3-6C5D44530987}C:\users\luffy\program files\dna\btdna.exe" = protocol=6 | dir=in | app=c:\users\luffy\program files\dna\btdna.exe |
"TCP Query User{59ED5F62-1967-4C12-BC09-95A009F0B623}C:\program files\java\jre6\bin\java.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\java.exe |
"TCP Query User{B54A3B63-280A-4F2F-A2E4-E0799C477A5A}C:\program files\dna\btdna.exe" = protocol=6 | dir=in | app=c:\program files\dna\btdna.exe |
"TCP Query User{DA70B55C-8572-4563-BF3D-63D779515F5F}C:\program files\google\google earth\plugin\geplugin.exe" = protocol=6 | dir=in | app=c:\program files\google\google earth\plugin\geplugin.exe |
"TCP Query User{E8F133BA-8C70-4CA2-933A-E68D9D3549DA}C:\program files\java\jre6\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe |
"UDP Query User{52653F9B-457A-4B82-A18B-21173A45CD6D}C:\users\luffy\program files\dna\btdna.exe" = protocol=17 | dir=in | app=c:\users\luffy\program files\dna\btdna.exe |
"UDP Query User{7DBDFE5A-042C-4DFC-89FB-1C6323D72FCA}C:\program files\google\google earth\plugin\geplugin.exe" = protocol=17 | dir=in | app=c:\program files\google\google earth\plugin\geplugin.exe |
"UDP Query User{8FDD51A1-4028-481A-AF6B-CC54F5CDD9A7}C:\program files\java\jre6\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe |
"UDP Query User{A80C53DF-6988-48D5-8F74-2D961B693BBC}C:\program files\java\jre6\bin\java.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\java.exe |
"UDP Query User{B71325DA-248F-482F-B7E4-7F5D68BA49FB}C:\program files\dna\btdna.exe" = protocol=17 | dir=in | app=c:\program files\dna\btdna.exe |
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{06E6E30D-B498-442F-A943-07DE41D7F785}" = Microsoft Search Enhancement Pack
"{0E532C84-4275-41B3-9D81-D4A1A20D8EE7}" = PlayStation(R)Store
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{20D4A895-748C-4D88-871C-FDB1695B0169}" = Platform
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{26A24AE4-039D-4CA4-87B4-2F83216013FF}" = Java(TM) 6 Update 22
"{28BE306E-5DA6-4F9C-BDB0-DBA3C8C6FFFD}" = QuickTime
"{28C2DED6-325B-4CC7-983A-1777C8F7FBAB}" = RealUpgrade 1.1
"{295C31E5-3F91-498E-9623-DA24D2FA2B6A}" = T-Online WLAN-Access Finder
"{2FFE93F0-BB72-4E52-8761-354D1AAA9387}" = Sony Ericsson PC Suite 6.011.00
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4EE2B017-D82C-4B12-B071-5CF1B23D1A42}" = SweetIM for Messenger 3.4
"{501451DE-5808-4599-B544-8BD0915B6B24}_is1" = FreeRIP v3.2
"{520CD4F0-9DAC-4C5C-8CA1-D0210CFF6062}" = Media Go
"{553255F3-78FD-40F1-A6F8-6882140265FE}" = Apple Application Support
"{55A29068-F2CE-456C-9148-C869879E2357}" = TuneUp Utilities 2009
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{636A7142-586A-4DF7-9207-191A2AF5610C}_is1" = AusLogics BoostSpeed
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{73C6DCFB-B606-47F3-BDFA-9A4FBF931E37}" = ICQ7.4
"{76E41F43-59D2-4F30-BA42-9A762EE1E8DE}" = Avanquest update
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7770E71B-2D43-4800-9CB3-5B6CAAEBEBEA}" = RealNetworks - Microsoft Visual C++ 2008 Runtime
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{95120000-00AF-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (German)
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{999A2E61-63EE-61BF-26E4-0C7B8B2A0BE2}" = Media Go Video Playback Engine 1.8.111.02130
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{a0fe116e-9a8a-466f-aee0-625cb7c207e3}" = Microsoft Visual C++ 2005 Redistributable - KB2467175
"{A8F2089B-1F79-4BF6-B385-A2C2B0B9A74D}" = ImagXpress
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9F6CFB0-806D-11E0-8EA1-B8AC6F97B88E}" = Google Earth Plug-in
"{AC76BA86-7AD7-1031-7B44-A94000000001}" = Adobe Reader 9.4.3 - Deutsch
"{B6659DD8-00A7-4A24-BBFB-C1F6982E5D66}" = PlayStation(R)Network Downloader
"{BF67F764-95B6-4360-BB57-B2E5AA6C814B}" = SweetIM Toolbar for Internet Explorer 4.0
"{C2F8CA82-2BD9-4513-B2D1-08A47914C1DA}_is1" = Uniblue DriverScanner
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{DBEA1034-5882-4A88-8033-81C4EF0CFA29}" = Google Toolbar for Internet Explorer
"{E55B3271-7CA8-4D0C-AE06-69A24856E996}_is1" = Uniblue SpeedUpMyPC
"{E63E34A7-E552-412B-9E40-FD6FC5227ABA}_is1" = Uniblue RegistryBooster
"{E78BFA60-5393-4C38-82AB-E8019E464EB4}" = Microsoft .NET Framework 1.1 German Language Pack
"{F90D6825-8F1F-4E3A-9E42-A9C8A9DD1031}" = Nero 7 Premium
"Adobe Acrobat 4.0" = Adobe Acrobat 4.0
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"AudioCon" = AudioCon
"AVG9Uninstall" = AVG 9.0
"ClickPotatoLiteSA" = ClickPotato
"Driver Genius Professional Edition_is1" = Driver Genius Professional Edition
"DVDVideoSoft Toolbar" = DVDVideoSoft Toolbar
"facemoods" = Facemoods Toolbar
"Free Video to MP3 Converter_is1" = Free Video to MP3 Converter version 3.2
"GMX SMS-Manager" = GMX SMS-Manager
"Google Chrome" = Google Chrome
"Hamster Free Video Converter_is1" = HamsterFreeVideoConverter
"ICQToolbar" = ICQ Toolbar
"InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}" = VIA Plattform-Geräte-Manager
"JDownloader" = JDownloader
"LView Pro 2006 - Trial Version" = LView Pro 2006 - Trial Version
"Microsoft .NET Framework 1.1  (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.6.17)" = Mozilla Firefox (3.6.17)
"RealPlayer 12.0" = RealPlayer
"ScanQuery" = ScanQuery 1.0 build 141 powered by FIRST SEARCHBAR
"ShoppingReport2" = ShopperReports
"SMSERIAL" = Motorola SM56 Speakerphone Modem
"Softonic_Deutsch Toolbar" = Softonic_Deutsch Toolbar
"sscqwuq" = Favorit
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"Teamspeak 2 RC2_is1" = TeamSpeak 2 RC2
"Uninstall_is1" = Uninstall 1.0.0.1
"UseNeXT_is1" = UseNeXT
"VIA Chrome9 HC IGP Windows Vista Display" = VIA Display Vista Driver 7.14.10.0052
"VLC media player" = VLC media player 0.9.9
"VN_VUIns_Rhine_VIA" = VIA Rhine Family Fast Ethernet Adapter
"WebMediaPlayer" = WebMediaPlayer
"WinRAR archiver" = WinRAR
"Xvid Video Codec 1.3.1" = Xvid Video Codec
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\S-1-5-21-2527848741-3311900059-3240881507-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"BitTorrent DNA" = DNA
"TeamSpeak 3 Client" = TeamSpeak 3 Client
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 06.02.2011 07:43:52 | Computer Name = Wihtebirt | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung firefox.exe, Version 1.9.2.3989, Zeitstempel
 0x4cf9293f, fehlerhaftes Modul ntdll.dll, Version 6.0.6000.16386, Zeitstempel 0x4549bdc9,
 Ausnahmecode 0xc00000fd, Fehleroffset 0x00061635,  Prozess-ID 0x13c4, Anwendungsstartzeit
 01cbc5de2bac7d16.
 
Error - 07.02.2011 14:40:20 | Computer Name = Wihtebirt | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung firefox.exe, Version 1.9.2.3989, Zeitstempel
 0x4cf9293f, fehlerhaftes Modul ntdll.dll, Version 6.0.6000.16386, Zeitstempel 0x4549bdc9,
 Ausnahmecode 0xc00000fd, Fehleroffset 0x00061635,  Prozess-ID 0xcc8, Anwendungsstartzeit
 01cbc6aa5289bc06.
 
Error - 07.02.2011 17:03:04 | Computer Name = Wihtebirt | Source = Microsoft-Windows-RestartManager | ID = 10006
Description =
 
Error - 10.02.2011 09:27:08 | Computer Name = Wihtebirt | Source = Application Hang | ID = 1002
Description = Programm ICQ.exe, Version 6.5.0.2026 arbeitet nicht mehr mit Windows
 zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen
 für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem
 zu suchen.  Prozess-ID: 1770  Anfangszeit: 01cbc908d91540b4  Zeitpunkt der Beendigung:
 1361
 
Error - 10.02.2011 09:58:07 | Computer Name = Wihtebirt | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung firefox.exe, Version 1.9.2.3989, Zeitstempel
 0x4cf9293f, fehlerhaftes Modul ntdll.dll, Version 6.0.6000.16386, Zeitstempel 0x4549bdc9,
 Ausnahmecode 0xc00000fd, Fehleroffset 0x000447f2,  Prozess-ID 0xb3c, Anwendungsstartzeit
 01cbc8ff22e1f8b3.
 
Error - 10.02.2011 10:21:05 | Computer Name = Wihtebirt | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =
 
Error - 18.02.2011 15:51:17 | Computer Name = Wihtebirt | Source = LoadPerf | ID = 3012
Description =
 
Error - 18.02.2011 15:51:17 | Computer Name = Wihtebirt | Source = LoadPerf | ID = 3012
Description =
 
Error - 18.02.2011 15:51:17 | Computer Name = Wihtebirt | Source = LoadPerf | ID = 3011
Description =
 
Error - 20.02.2011 12:13:42 | Computer Name = Wihtebirt | Source = Application Hang | ID = 1002
Description = Programm ICQ.exe, Version 6.5.0.2026 arbeitet nicht mehr mit Windows
 zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen
 für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem
 zu suchen.  Prozess-ID: a1c  Anfangszeit: 01cbd0f8854d4fdd  Zeitpunkt der Beendigung:
 19444
 
[ System Events ]
Error - 20.06.2011 10:09:57 | Computer Name = Wihtebirt | Source = DCOM | ID = 10016
Description =
 
Error - 20.06.2011 10:23:54 | Computer Name = Wihtebirt | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am 20.06.2011 um 16:21:47 unerwartet heruntergefahren.
 
Error - 20.06.2011 10:24:30 | Computer Name = Wihtebirt | Source = DCOM | ID = 10005
Description =
 
Error - 20.06.2011 10:24:30 | Computer Name = Wihtebirt | Source = DCOM | ID = 10005
Description =
 
Error - 20.06.2011 10:24:30 | Computer Name = Wihtebirt | Source = LSM | ID = 1048
Description =
 
Error - 20.06.2011 10:24:36 | Computer Name = Wihtebirt | Source = DCOM | ID = 10005
Description =
 
Error - 20.06.2011 10:24:38 | Computer Name = Wihtebirt | Source = DCOM | ID = 10005
Description =
 
Error - 20.06.2011 10:24:38 | Computer Name = Wihtebirt | Source = DCOM | ID = 10005
Description =
 
Error - 20.06.2011 10:24:44 | Computer Name = Wihtebirt | Source = Service Control Manager | ID = 7001
Description =
 
Error - 20.06.2011 10:24:44 | Computer Name = Wihtebirt | Source = Service Control Manager | ID = 7026
Description =
 
 
< End of report >
--- --- ---

maik78 22.06.2011 13:39
achja wollte noch sagen das ich zur zeit im abgesicherten modus mit neztwerktreibern arbeite.weiß ja nicht ob das dann ein problem darstellt.

markusg 22.06.2011 13:53
das auf deinem pc malware ist, kann ich verstehen, noch nie vista updates, aktuell wäre zb sp2, du hast nicht mal sp1...

aber hauptsache ne torrent software instaliert...

achtung!
dieses script sowie evtl. folgende scripts sind nur für den jeweiligen user.
wenn ihr probleme habt, eröffnet eigene topics und wartet auf, für euch angepasste scripts.

• Starte bitte die OTL.exe
• Kopiere nun das Folgende in die Textbox.


:OTL
O4 - HKU\S-1-5-21-2527848741-3311900059-3240881507-1000..\Run: [fVsVFGfVFkPeQTy] C:\ProgramData\fVsVFGfVFkPeQTy.exe (Sysinternals)
[2011.06.20 13:54:40 | 000,000,000 | -H-D | C] -- C:\Users\Luffy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Vista Repair
[2011.06.20 13:53:48 | 000,364,544 | -H-- | C] (Sysinternals) -- C:\ProgramData\29089552.exe
[2011.06.20 13:44:28 | 000,452,608 | -H-- | C] (Sysinternals) -- C:\ProgramData\fVsVFGfVFkPeQTy.exe
[2011.06.20 13:55:19 | 000,000,224 | -H-- | M] () -- C:\ProgramData\~29089552
[2011.06.20 13:55:18 | 000,000,152 | -H-- | M] () -- C:\ProgramData\~29089552r
[2011.06.20 13:54:41 | 000,000,591 | -H-- | M] () -- C:\Users\Luffy\Desktop\Windows Vista Repair.lnk
[2011.06.20 13:54:20 | 000,000,336 | -H-- | M] () -- C:\ProgramData\29089552
:Files
C:\ProgramData\fVsVFGfVFkPeQTy.exe
:Commands
[purity]
[EMPTYFLASH]
[emptytemp]
[Reboot]


• Schliesse bitte nun alle Programme.
• Klicke nun bitte auf den Fix Button.
• OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
• Nach dem Neustart findest Du ein Textdokument, dessen inhalt in deiner nächsten antwort hier reinkopieren.
starte wieder im normalen modus.

lade unhide:
http://filepony.de/download-unhide/
doppelklicken, dateien werden sichtbar

öffne computer , öffne C: dann _OTL
dort rechtsklick auf moved files
wähle zu moved files.rar oder zip hinzufügen.
http://www.trojaner-board.de/54791-a...ner-board.html

maik78 22.06.2011 14:16
All processes killed
========== OTL ==========
Registry value HKEY_USERS\S-1-5-21-2527848741-3311900059-3240881507-1000\Software\Microsoft\Windows\CurrentVersion\Run\\fVsVFGfVFkPeQTy deleted successfully.
C:\ProgramData\fVsVFGfVFkPeQTy.exe moved successfully.
C:\Users\Luffy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Vista Repair folder moved successfully.
C:\ProgramData\29089552.exe moved successfully.
File C:\ProgramData\fVsVFGfVFkPeQTy.exe not found.
C:\ProgramData\~29089552 moved successfully.
C:\ProgramData\~29089552r moved successfully.
C:\Users\Luffy\Desktop\Windows Vista Repair.lnk moved successfully.
C:\ProgramData\29089552 moved successfully.
========== FILES ==========
File\Folder C:\ProgramData\fVsVFGfVFkPeQTy.exe not found.
========== COMMANDS ==========

[EMPTYFLASH]

User: All Users

User: Default
->Flash cache emptied: 2834 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: Luffy
->Flash cache emptied: 12599857 bytes

User: Public

Total Flash Files Cleaned = 12,00 mb


[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Luffy
->Temp folder emptied: 1990123 bytes
->Temporary Internet Files folder emptied: 53588305 bytes
->Java cache emptied: 47342201 bytes
->FireFox cache emptied: 91114830 bytes
->Google Chrome cache emptied: 310385364 bytes
->Opera cache emptied: 344454 bytes
->Flash cache emptied: 0 bytes

User: Public

%systemdrive% .tmp files removed: 39186394 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 200946 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 519,00 mb


OTL by OldTimer - Version 3.2.24.1 log created on 06222011_150544

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

markusg 22.06.2011 14:20
ok weiter mit dem upload. in den upload channel, link folgen bitte

maik78 22.06.2011 14:24
das unhide ist grad am arbeiten ....werd dann so bald es fertig ist mit den anderen sachen weiter machen oder kann ich das nebenbei tun?

einige datein wurden wieder hergestellt aber der arbeitsplatz ist noch nicht vorhanden.

markusg 22.06.2011 14:27
lass es arbeiten.
immer mit der ruhe wir sind nicht fertig :-)

maik78 22.06.2011 14:35
ok.....bin grad der anleitung gefolgt und bin nun bei dem upload channel.wie finde ich nun die verdächtige datei ?

markusg 22.06.2011 14:40
hab doch geschrieben das du den ordner packen sollst, steht über dem link zum upload channel

maik78 22.06.2011 14:47
also hab es jetzt hochgeladen und hab den link von dieser seite eingegeben un meinen namen.

markusg 22.06.2011 14:51
danke
bitte erstelle und poste ein combofix log.
Ein Leitfaden und Tutorium zur Nutzung von ComboFix

maik78 22.06.2011 18:14
sry hatte private probleme.....so....kann das combofix nur runterlanden aber nicht auf desktop speichern.zeigt nur speichern an!

markusg 22.06.2011 18:15
mach mal nen rechtsklick auf den download link, ziehl speichern unter, dann gehts

maik78 22.06.2011 18:26
hab ich gemacht aber da komm ich wieder auf der seite raus wo ich es runterladen soll :(

kann ich es so starten wenn es nicht auf dem desktop ist?


ok habs hinbekommen



passiert nichts :(

maik78 22.06.2011 18:42
kann ich es nochmal löschen un neu probieren oder ist das nicht gut?

markusg 22.06.2011 18:50
starte in den abgesicherten modus ohne netzwerk, ist bei pc start zu erreichen mit f8, versuche dort combofix, falls pc neustartet, wieder in abgesicherten modus.
dann neustarten in normalen modus und combofix.txt posten.

maik78 22.06.2011 19:41
hoffe dass das soweit richtig war.

Combofix Logfile:
Code:
ComboFix 11-06-22.01 - Luffy 22.06.2011  20:05:43.1.2 - x86
Microsoft® Windows Vista™ Home Basic  6.0.6000.0.1252.49.1031.18.894.449 [GMT 2:00]
ausgeführt von:: c:\users\Luffy\Desktop\ComboFix.exe
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\ClickPotatoLite
c:\program files\ClickPotatoLite\bin\10.0.668.0\ClickPotatoLiteSA.exe
c:\program files\ClickPotatoLite\bin\10.0.668.0\ClickPotatoLiteSAAX.dll
c:\program files\ClickPotatoLite\bin\10.0.668.0\ClickPotatoLiteSABHO.dll
c:\program files\ClickPotatoLite\bin\10.0.668.0\ClickPotatoLiteUninstaller.exe
c:\program files\ClickPotatoLite\bin\10.0.668.0\firefox\extensions\install.rdf
c:\program files\ClickPotatoLite\bin\10.0.668.0\firefox\extensions\plugins\npclntax_ClickPotatoLiteSA.dll
c:\program files\ClickPotatoLite\bin\10.0.668.0\LaunchHelp.dll
c:\program files\facemoods.com
c:\program files\facemoods.com\facemoods\1.4.17.5\bh\facemoods.dll
c:\program files\facemoods.com\facemoods\1.4.17.5\facemoods.crx
c:\program files\facemoods.com\facemoods\1.4.17.5\facemoods.png
c:\program files\facemoods.com\facemoods\1.4.17.5\facemoodsApp.dll
c:\program files\facemoods.com\facemoods\1.4.17.5\facemoodsEng.dll
c:\program files\facemoods.com\facemoods\1.4.17.5\facemoodssrv.exe
c:\program files\facemoods.com\facemoods\1.4.17.5\facemoodsTlbr.dll
c:\program files\facemoods.com\facemoods\1.4.17.5\uninstall.exe
c:\program files\Mozilla Firefox\extensions\{DE9265D8-D55D-4286-9DC4-F8D8A0CA2F64}
c:\program files\Mozilla Firefox\extensions\{DE9265D8-D55D-4286-9DC4-F8D8A0CA2F64}\chrome.manifest
c:\program files\Mozilla Firefox\extensions\{DE9265D8-D55D-4286-9DC4-F8D8A0CA2F64}\chrome\scanquery.jar
c:\program files\Mozilla Firefox\extensions\{DE9265D8-D55D-4286-9DC4-F8D8A0CA2F64}\defaults\preferences\prefs.js
c:\program files\Mozilla Firefox\extensions\{DE9265D8-D55D-4286-9DC4-F8D8A0CA2F64}\install.rdf
c:\program files\ScanQuery
c:\program files\ScanQuery\scanquery.dll
c:\program files\ScanQuery\scanquery.exe
c:\program files\ScanQuery\ScanQuery_deleted_\scanquery.dll
c:\program files\ScanQuery\ScanQuery_deleted_\scanquery.exe
c:\program files\ScanQuery\uninstall.exe
c:\program files\ShoppingReport2
c:\program files\ShoppingReport2\Bin\2.7.34\ShoppingReport.dll
c:\program files\ShoppingReport2\Uninst.exe
c:\program files\webmediaplayer
c:\program files\webmediaplayer\resources\wmp_translation_file.xml
c:\program files\webmediaplayer\skins\classic.skn
c:\program files\webmediaplayer\sqlite3.dll
c:\program files\webmediaplayer\uninst.exe
c:\program files\webmediaplayer\WebMediaPlayer.exe
c:\programdata\2ACA5CC3-0F83-453D-A079-1076FE1A8B65
c:\programdata\ClickPotatoLiteSA
c:\programdata\ClickPotatoLiteSA\ClickPotatoLiteSA.dat
c:\programdata\ClickPotatoLiteSA\ClickPotatoLiteSA_kyf.dat
c:\programdata\ClickPotatoLiteSA\ClickPotatoLiteSAAbout.mht
c:\programdata\ClickPotatoLiteSA\ClickPotatoLiteSAau.dat
c:\programdata\ClickPotatoLiteSA\ClickPotatoLiteSAEULA.mht
c:\programdata\hpe5275.dll
c:\programdata\Microsoft\Windows\Start Menu\Programs\ClickPotato
c:\programdata\Microsoft\Windows\Start Menu\Programs\WebMediaPlayer
c:\programdata\ScanQuery
c:\programdata\ScanQuery\scanquery143.exe
c:\users\Luffy\AppData\Local\gokui_nav.dat
c:\users\Luffy\AppData\Local\gokui_navps.dat
c:\users\Luffy\AppData\Roaming\ClickPotatoLite
c:\windows\IsUn0407.exe
c:\windows\system32\sm56co85.txt
.
.
(((((((((((((((((((((((((((((((((((((((  Treiber/Dienste  )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_Boonty Games
-------\Service_ScanQuery Service
.
.
(((((((((((((((((((((((  Dateien erstellt von 2011-05-22 bis 2011-06-22  ))))))))))))))))))))))))))))))
.
.
2011-06-22 18:13 . 2011-06-22 18:13        --------        d-----w-        c:\users\Default\AppData\Local\temp
2011-06-22 13:55 . 2011-06-22 18:03        --------        d-----w-        C:\32788R22FWJFW
2011-06-22 13:05 . 2011-06-22 13:44        --------        d-----w-        C:\_OTL
2011-06-15 22:53 . 2011-06-15 22:56        --------        d-----w-        C:\6b149aa75bb92c904a121bb2
2011-06-10 06:06 . 2011-06-10 06:06        --------        d-----w-        c:\users\Luffy\AppData\Roaming\HamsterSoft
2011-06-10 06:05 . 2011-06-10 06:05        --------        d-----w-        c:\program files\Hamster Soft
2011-06-07 09:56 . 2011-06-07 09:56        11776        ----a-w-        c:\program files\Mozilla Firefox\plugins\nprjplug.dll
2011-06-07 09:56 . 2011-06-07 09:56        --------        d-----w-        c:\program files\Common Files\xing shared
2011-06-07 09:55 . 2011-06-07 09:55        150712        ----a-w-        c:\program files\Mozilla Firefox\plugins\nppl3260.dll
2011-06-07 09:55 . 2011-06-07 09:55        105472        ----a-w-        c:\program files\Mozilla Firefox\plugins\nprpjplug.dll
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8dbb6d8e-e4a6-4e3b-9753-af78b226441c}]
2009-03-10 09:47        2079256        ----a-w-        c:\program files\Softonic_Deutsch\tbSoft.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}]
2009-12-31 10:53        2349080        ----a-w-        c:\program files\DVDVideoSoft\tbDVDV.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}]
2010-10-18 16:28        1485112        ----a-r-        c:\program files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}"= "c:\program files\DVDVideoSoft\tbDVDV.dll" [2009-12-31 2349080]
"{EEE6C35B-6118-11DC-9C72-001320C79847}"= "c:\program files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll" [2010-10-18 1485112]
.
[HKEY_CLASSES_ROOT\clsid\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}]
.
[HKEY_CLASSES_ROOT\clsid\{eee6c35b-6118-11dc-9c72-001320c79847}]
[HKEY_CLASSES_ROOT\SWEETIE.IEToolbar.1]
[HKEY_CLASSES_ROOT\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}]
[HKEY_CLASSES_ROOT\SWEETIE.IEToolbar]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{E9911EC6-1BCC-40B0-9993-E0EEA7F6953F}"= "c:\program files\DVDVideoSoft\tbDVDV.dll" [2009-12-31 2349080]
"{EEE6C35B-6118-11DC-9C72-001320C79847}"= "c:\program files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll" [2010-10-18 1485112]
.
[HKEY_CLASSES_ROOT\clsid\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}]
.
[HKEY_CLASSES_ROOT\clsid\{eee6c35b-6118-11dc-9c72-001320c79847}]
[HKEY_CLASSES_ROOT\SWEETIE.IEToolbar.1]
[HKEY_CLASSES_ROOT\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}]
[HKEY_CLASSES_ROOT\SWEETIE.IEToolbar]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2009-02-14 171448]
"BitTorrent DNA"="c:\users\Luffy\Program Files\DNA\btdna.exe" [2011-06-22 323392]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2008-01-22 152872]
"Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" [2009-11-20 434176]
"GMX SMS-Manager"="c:\program files\GMX\GMX SMS-Manager\SMSMngr.exe" [2007-07-19 3539968]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"snpstd3"="c:\windows\vsnpstd3.exe" [2006-09-19 827392]
"Windows Mobile-based device management"="c:\windows\WindowsMobile\wmdSync.exe" [2006-11-02 215552]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2008-05-28 570664]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-01-31 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]
"SweetIM"="c:\program files\SweetIM\Messenger\SweetIM.exe" [2010-12-20 111928]
"SMSERIAL"="c:\program files\Motorola\SMSERIAL\sm56hlpr.exe" [2009-10-26 1458176]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-08-14 1348904]
"TkBellExe"="c:\program files\Real\RealPlayer\update\realsched.exe" [2011-06-07 273544]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"AvgUninstallURL"="start http:" [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"WindowsWelcomeCenter"=rundll32.exe oobefldr.dll,ShowWelcomeCenter
"BitTorrent DNA"="c:\users\Luffy\Program Files\DNA\btdna.exe"
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"S3Trayp"=S3trayp.exe
"SMSERIAL"=c:\program files\Motorola\SMSERIAL\sm56hlpr.exe
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
.
R2 gupdate1c9b2faf0b082fe;Google Update Service (gupdate1c9b2faf0b082fe);c:\program files\Google\Update\GoogleUpdate.exe [2009-04-01 133104]
R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2009-04-01 133104]
R3 s0016bus;Sony Ericsson Device 0016 driver (WDM);c:\windows\system32\DRIVERS\s0016bus.sys [2008-05-16 89256]
R3 s0016mdfl;Sony Ericsson Device 0016 USB WMC Modem Filter;c:\windows\system32\DRIVERS\s0016mdfl.sys [2008-05-16 15016]
R3 s0016mdm;Sony Ericsson Device 0016 USB WMC Modem Driver;c:\windows\system32\DRIVERS\s0016mdm.sys [2008-05-16 120744]
R3 s0016mgmt;Sony Ericsson Device 0016 USB WMC Device Management Drivers (WDM);c:\windows\system32\DRIVERS\s0016mgmt.sys [2008-05-16 114216]
R3 s0016nd5;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (NDIS);c:\windows\system32\DRIVERS\s0016nd5.sys [2008-05-16 25512]
R3 s0016obex;Sony Ericsson Device 0016 USB WMC OBEX Interface;c:\windows\system32\DRIVERS\s0016obex.sys [2008-05-16 110632]
R3 s0016unic;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (WDM);c:\windows\system32\DRIVERS\s0016unic.sys [2008-05-16 115752]
S2 ICQ Service;ICQ Service;c:\program files\ICQ6Toolbar\ICQ Service.exe [2010-09-06 247096]
S2 OMSI download service;Sony Ericsson OMSI download service;c:\program files\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe [2009-04-30 90112]
S3 FETND6V;VIA Rhine Family Fast Ethernet Adapter Driver;c:\windows\system32\DRIVERS\fetnd6v.sys [2010-06-02 43520]
S3 S3G700;S3G700;c:\windows\system32\DRIVERS\VTGKModeDX32.sys [2006-12-19 813056]
S3 SIS163u;SiS163 USB Wireless LAN Adapter Driver;c:\windows\system32\DRIVERS\sis163u.sys [2010-06-02 218112]
S3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [2010-06-02 230912]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork        REG_MULTI_SZ          PLA DPS BFE mpssvc
WindowsMobile        REG_MULTI_SZ          wcescomm rapimgr
LocalServiceRestricted        REG_MULTI_SZ          WcesComm RapiMgr
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
UxTuneUp
.
Inhalt des "geplante Tasks" Ordners
.
2011-06-22 c:\windows\Tasks\1-Klick-Wartung.job
- c:\program files\TuneUp Utilities 2009\OneClickStarter.exe [2009-11-16 11:45]
.
2011-06-22 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-04-01 18:51]
.
2011-06-22 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-04-01 18:51]
.
2011-06-22 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-2527848741-3311900059-3240881507-1000.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-03-29 08:47]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.hamsterstart.com/?cfg=2-475-0-0&engine_id=3&provider_id=3&product_id=475&country=DE
mStart Page = hxxp://home.sweetim.com
IE: {{73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - c:\program files\ICQ7.4\ICQ.exe
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\Luffy\AppData\Roaming\Mozilla\Firefox\Profiles\li06tyiv.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.sweetim.com/search.asp?src=2&q=
FF - prefs.js: browser.search.selectedEngine - ICQ Search
FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/
FF - prefs.js: keyword.URL - hxxp://www.hamsterstart.com/s/?src=FF-Address&site=Yahoo!&cfg=2-475-0-0&q=
FF - Ext: ICQ Toolbar: {800b5000-a755-47e1-992b-48a1c1357f07} - c:\program files\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
FF - Ext: Facemoods: ffxtlbr@Facemoods.com - %profile%\extensions\ffxtlbr@Facemoods.com
FF - Ext: Google Toolbar for Firefox: {3112ca9c-de6d-4884-a869-9855de68056c} - %profile%\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
FF - Ext: ICQ Toolbar: {800b5000-a755-47e1-992b-48a1c1357f07} - %profile%\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
FF - Ext: Google Toolbar for Firefox: {3112ca9c-de6d-4884-a869-9855de68056c} - c:\programdata\Google\Toolbar for Firefox\{3112ca9c-de6d-4884-a869-9855de68056c}
FF - Ext: RealPlayer Browser Record Plugin: {ABDE892B-13A8-4d1b-88E6-365A6E755758} - c:\programdata\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
FF - user.js: network.http.max-connections-per-server - 6
FF - user.js: network.http.max-persistent-connections-per-server - 3
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
BHO-{64182481-4F71-486b-A045-B233BD0DA8FC} - c:\program files\facemoods.com\facemoods\1.4.17.5\bh\facemoods.dll
Toolbar-{DB4E9724-F518-4dfd-9C7C-78B52103CAB9} - c:\program files\facemoods.com\facemoods\1.4.17.5\facemoodsTlbr.dll
HKLM-Run-facemoods - c:\program files\facemoods.com\facemoods\1.4.17.5\facemoodssrv.exe
HKLM-Run-ClickPotatoLiteSA - c:\program files\ClickPotatoLite\bin\10.0.668.0\ClickPotatoLiteSA.exe
AddRemove-Adobe Acrobat 4.0 - c:\windows\ISUN0407.EXE
AddRemove-facemoods - c:\program files\facemoods.com\facemoods\1.4.17.5\uninstall.exe
AddRemove-ScanQuery - c:\program files\ScanQuery\uninstall.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover
Rootkit scan 2011-06-22 20:18
Windows 6.0.6000  NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'Explorer.exe'(2876)
c:\program files\SweetIM\Messenger\mgAdaptersProxy.dll
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\windows\system32\AUDIODG.EXE
c:\windows\system32\IoctlSvc.exe
c:\windows\System32\TUProgSt.exe
c:\windows\system32\conime.exe
c:\windows\system32\wbem\unsecapp.exe
c:\program files\Synaptics\SynTP\SynTPHelper.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2011-06-22  20:24:20 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2011-06-22 18:24
.
Vor Suchlauf: 7.662.391.296 Bytes frei
Nach Suchlauf: 8.658.464.768 Bytes frei
.
- - End Of File - - 4BEFB8FF601BDEF68DDC89F96A899144
--- --- ---

markusg 22.06.2011 19:52
download malwarebytes:
Malwarebytes : Malwarebytes Anti-Malware is a free download that removes viruses and malware from your computer
instalieren, öffnen, registerkarte aktualisierung, programm updaten.
schalte alle laufenden programme ab, trenne die internetverbindung.
registerkarte scanner, komplett scan, funde entfernen, log posten.

maik78 22.06.2011 20:45
müsste das richtige sein


Malwarebytes' Anti-Malware 1.51.0.1200
Malwarebytes : Free anti-malware, anti-virus and spyware removal download

Datenbank Version: 6920

Windows 6.0.6000
Internet Explorer 8.0.6001.18904

22.06.2011 21:37:41
mbam-log-2011-06-22 (21-37-16).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)
Durchsuchte Objekte: 237591
Laufzeit: 36 Minute(n), 34 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 7
Infizierte Registrierungswerte: 1
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 19

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
HKEY_CLASSES_ROOT\Typelib\{B035BA6B-57CD-4F72-B545-65BE465FCAF6} (Adware.ShoppingReport2) -> No action taken.
HKEY_CLASSES_ROOT\Typelib\{D44FD6F0-9746-484E-B5C4-C66688393872} (Adware.ShoppingReport2) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{0EB3F101-224A-4B2B-9E5B-DF720857529C} (Adware.ShoppingReport2) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A078F691-9C07-4AF2-BF43-35E79EECF8B7} (Adware.Softomate) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\OOO (Malware.Trace) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\OOO (Rogue.LivePlayer) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\ScanQuery (Adware.ScanQuery) -> No action taken.

Infizierte Registrierungswerte:
HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions\ClickPotatoLite@ClickPotatoLite.com (Adware.ClickPotato) -> Value: ClickPotatoLite@ClickPotatoLite.com -> No action taken.

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
c:\Qoobox\quarantine\C\program files\clickpotatolite\bin\10.0.668.0\clickpotatolitesa.exe.vir (Adware.ClickPotato) -> No action taken.
c:\Qoobox\quarantine\C\program files\clickpotatolite\bin\10.0.668.0\clickpotatolitesaax.dll.vir (Adware.ClickPotato) -> No action taken.
c:\Qoobox\quarantine\C\program files\clickpotatolite\bin\10.0.668.0\clickpotatolitesabho.dll.vir (Adware.ClickPotato) -> No action taken.
c:\Qoobox\quarantine\C\program files\clickpotatolite\bin\10.0.668.0\clickpotatoliteuninstaller.exe.vir (Adware.ClickPotato) -> No action taken.
c:\Qoobox\quarantine\C\program files\clickpotatolite\bin\10.0.668.0\launchhelp.dll.vir (Adware.Seekmo) -> No action taken.
c:\Qoobox\quarantine\C\program files\clickpotatolite\bin\10.0.668.0\firefox\extensions\plugins\npclntax_clickpotatolitesa.dll.vir (Adware.ClickPotato) -> No action taken.
c:\Qoobox\quarantine\C\program files\scanquery\scanquery.dll.vir (Adware.Agent.ZGen) -> No action taken.
c:\Qoobox\quarantine\C\program files\scanquery\scanquery.exe.vir (Adware.Agent.ZGen) -> No action taken.
c:\Qoobox\quarantine\C\program files\scanquery\scanquery_deleted_\scanquery.dll.vir (Adware.Agent.ZGen) -> No action taken.
c:\Qoobox\quarantine\C\program files\scanquery\scanquery_deleted_\scanquery.exe.vir (Adware.Agent.Gen) -> No action taken.
c:\Qoobox\quarantine\C\program files\shoppingreport2\uninst.exe.vir (Adware.ShoppingReports2) -> No action taken.
c:\Qoobox\quarantine\C\program files\shoppingreport2\Bin\2.7.34\shoppingreport.dll.vir (Adware.SmartShopper) -> No action taken.
c:\Qoobox\quarantine\C\programdata\scanquery\scanquery143.exe.vir (Adware.Agent.ZGen) -> No action taken.
c:\UseNeXT\wizard\nero 7.8.5.0 premium edition incl. keygen - by sch\keygen.exe (RiskWare.Tool.CK) -> No action taken.
c:\UseNeXT\wizard\tuneup utilities 2009 - 8.0.3100.31 - by prof. div\tuneup.utilities.2009-keygen.exe (Trojan.Agent.CK) -> No action taken.
c:\Users\Luffy\downloads\foc7xdxj\xvidsetup.exe (Adware.Hotbar) -> No action taken.
c:\_OTL\movedfiles\06222011_150544\c_programdata\29089552.exe (Trojan.Agent.PF) -> No action taken.
c:\_OTL\movedfiles\06222011_150544\c_programdata\fvsvfgfvfkpeqty.exe (Trojan.FakeHDD) -> No action taken.
c:\extracted\password.txt (Malware.Trace) -> No action taken.

markusg 23.06.2011 10:48
c:\UseNeXT\wizard\nero 7.8.5.0 premium edition incl. keygen - by sch\keygen.exe (RiskWare.Tool.CK) -> No action taken.
und andere software ist illegal, illegal genutzte software (keygens) unterstützen wir hier nicht, da die verwendung solcher software eine straftat ist.
daher gibts hier ausschließlich support beim formatieren, neu aufsetzen und absichern des pcs.
ich werde keinerlei fragen beantworten wie "ist noch malware auf dem pc" sondern nur die von mir genannte möglichkeit bearbeiten.

maik78 23.06.2011 19:24
also heißt das das ich das runterhauen soll?

markusg 23.06.2011 19:31
nein, dass heißt genau das, was da steht.

maik78 23.06.2011 19:32
also system komplett neu!

markusg 23.06.2011 19:34
ja, genau wies da steht.
daten bitte vorher sichern, schmeiß den ganzen keygen müll gleich runter.
wenn du nicht weist wie man formatiert, gibts ne anleitung.
dann zeige ich dir, falls du willst, wie man das system absichert.
danach müssen alle passwörter geendert werden.

maik78 23.06.2011 19:46
hab jetzt nero+keygen deinstalliert und gelöscht.finde aber meinen papierkorb nicht.also sozusagen bilder usw sichern?!


lass alles wech machen un guti!


c://formatieren?

markusg 24.06.2011 10:29
ja, bilder, dokumente, evtl. setup dateien falls nötig.
weist du wie man formatiert?
falls nein, hast du ne windows cd, recovery cd oder recovery partition?

maik78 24.06.2011 18:49
nein hab ich leider nicht weil des der com von nem kumpel war un der das nich mehr hatte.


bei formatieren muß ich auf c: und dann rechtsklick und formatieren nehm ich mal an.

markusg 24.06.2011 19:09
ne, du brauchst ne windows cd und musst über diese formatieren.

maik78 24.06.2011 19:18
kann ich mir da von wem anders eine besorgen?

markusg 24.06.2011 19:24
würde ich nicht machen, sonst kanns passieren das die lizenz gesperrt wird

maik78 24.06.2011 19:28
hmmm.....na da werd ich wo ma beim kumpel rumschauen müssen ob er sie noch irgendwo rumkullern hat.un was ist wenn er sie nich mehr besitzt?

markusg 24.06.2011 19:38
hab da ne verrückte idee, kaufen vllt, wie es sich gehört für eine software die man bezahlen muss.
aber dann würd ich eher windows 7 nutzen.

maik78 24.06.2011 19:42
:)....ja ok werd schaun was sich machen lässt.un danke schon mal...ihr seid super

markusg 24.06.2011 19:53
musst mal bei amazon schauen zb, da gibts dass immer relativ günstig.
würde aber die home nehmen, nicht starter version.

maik78 24.06.2011 19:58
ok werd mal schaun....dankö....meld mich sobald ich was habe.

markusg 24.06.2011 20:00
ok, falls ichs übersehe, kurze private nachicht

maik78 24.06.2011 20:04
werd ich machen....trotzdem schon nen dickes danke


Alle Zeitangaben in WEZ +1. Es ist jetzt 20:10 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27