Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   BKA-Trojaner - Auswertung (https://www.trojaner-board.de/102877-bka-trojaner-auswertung.html)

hallohallo1 25.08.2011 21:14
BKA-Trojaner - Auswertung
 
Hallo liebe Leute.
Ich hatte auch vor ein paar Tagen den lästigen BKA-Trojaner. Ich habe mir zunächst provisorisch damit beholfen über den abgesicherten Modus eine Systemwiederherstellung zu machen aber hier im Forum durchs Stöbern gesehen, dass das das Problem nicht unbedingt löst.

Ich habe alle in einem anderen Post beschrieben Schritte erledigt:

1. Mal Otl

Code:
All processes killed
========== OTL ==========
Registry key HKEY_USERS\dube_ON_C\Software\Microsoft\Internet Explorer\URLSearchHooks not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{855F3B16-6D32-4fe6-8A56-BBB695989046}\ deleted successfully.
Registry key HKEY_USERS\dube_ON_C\Software\Microsoft\Internet Explorer\URLSearchHooks not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EEE6C35D-6118-11DC-9C72-001320C79847}\ not found.
File C:\Users\dube\AppData\Roaming\Mozilla\Firefox\Profiles\0kmrmel1.default\searchplugins\icqplugin-2.xml not found.
File C:\Users\dube\AppData\Roaming\Mozilla\Firefox\Profiles\0kmrmel1.default\searchplugins\icqplugin-3.xml not found.
File C:\Users\dube\AppData\Roaming\Mozilla\Firefox\Profiles\0kmrmel1.default\searchplugins\icqplugin.gif not found.
File C:\Users\dube\AppData\Roaming\Mozilla\Firefox\Profiles\0kmrmel1.default\searchplugins\icqplugin.src not found.
File C:\Users\dube\AppData\Roaming\Mozilla\Firefox\Profiles\0kmrmel1.default\searchplugins\icqplugin.xml not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EEE6C35C-6118-11DC-9C72-001320C79847}\ not found.
File C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{EEE6C35B-6118-11DC-9C72-001320C79847} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EEE6C35B-6118-11DC-9C72-001320C79847}\ not found.
File C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll not found.
Registry key HKEY_USERS\dube_ON_C\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EEE6C35B-6118-11DC-9C72-001320C79847}\ not found.
File C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\SweetIM not found.
File C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe not found.
Registry key HKEY_USERS\dube_ON_C\Software\Microsoft\Windows\CurrentVersion\Run not found.
File C:\Users\dube\AppData\Roaming\jashla.exe not found.
Registry key HKEY_USERS\dube_ON_C\Software\Microsoft\Windows\CurrentVersion\Run not found.
Registry key HKEY_USERS\LocalService_ON_C\Software\Microsoft\Windows\CurrentVersion\RunOnce not found.
Registry key HKEY_USERS\NetworkService_ON_C\Software\Microsoft\Windows\CurrentVersion\RunOnce not found.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
File X:\AUTORUN.INF not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{55bce751-e8ff-11df-b56c-002622430e9c}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{55bce751-e8ff-11df-b56c-002622430e9c}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{55bce751-e8ff-11df-b56c-002622430e9c}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{55bce751-e8ff-11df-b56c-002622430e9c}\ not found.
File F:\LaunchU3.exe -a not found.
File C:\Users\dube\AppData\Roaming\jashla.exe not found.
File C:\Users\dube\Documents\Yvi.mcf not found.
File C:\Users\dube\Documents\Yvi.mcf~ not found.
Folder C:\ProgramData\SweetIM\ not found.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: asasas
->Temp folder emptied: 406157 bytes
->Temporary Internet Files folder emptied: 62442 bytes
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Fabian
->Temp folder emptied: 171486774 bytes
->Temporary Internet Files folder emptied: 5977585 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 64206707 bytes
->Google Chrome cache emptied: 0 bytes
->Apple Safari cache emptied: 0 bytes
->Flash cache emptied: 17283 bytes
 
User: Gast
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 7693347 bytes
->FireFox cache emptied: 12349165 bytes
->Flash cache emptied: 495 bytes
 
User: Public
->Temp folder emptied: 0 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 384522 bytes
%systemroot%\System32 .tmp files removed: 4384 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 1898178 bytes
RecycleBin emptied: 374123 bytes
 
Total Files Cleaned = 253,00 mb
 
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
OTL by OldTimer - Version 3.2.26.5 log created on 08252011_192512

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...
Malware Bytes

Code:
Malwarebytes' Anti-Malware 1.51.1.1800
www.malwarebytes.org

Datenbank Version: 7536

Windows 6.0.6000
Internet Explorer 7.0.6000.16809

25.08.2011 21:49:10
mbam-log-2011-08-25 (21-49-10).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|F:\|G:\|H:\|I:\|J:\|K:\|L:\|M:\|N:\|O:\|Z:\|)
Durchsuchte Objekte: 460483
Laufzeit: 2 Stunde(n), 16 Minute(n), 41 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)
Ccleaner
Code:
AC3Filter (remove only)                03.05.2010        1,43MB       
Activation Assistant for the 2007 Microsoft Office suites        Microsoft Corporation        01.11.2007        14,0MB       
Adobe Flash Player 10 ActiveX        Adobe Systems Incorporated        14.03.2010                10.0.45.2
Adobe Flash Player 10 Plugin        Adobe Systems Incorporated        18.07.2011                10.3.181.34
Adobe Photoshop CS4        Adobe Systems Incorporated        30.04.2010                11.0
Adobe Photoshop Elements 6.0        Adobe Systems, Inc.        24.02.2010        375MB        6.0
Adobe Reader 8.1.1 - Deutsch        Adobe Systems Incorporated        29.12.2007        105,7MB        8.1.1
AGEIA PhysX v7.09.13        AGEIA Technologies, Inc.        21.06.2008        99,5MB        7.09.13
Amazon Kindle        Amazon        05.08.2011        55,2MB       
AnyToISO        CrystalIdea Software, Inc.        04.04.2010        12,7MB        2.6.2
Apple Application Support        Apple Inc.        05.09.2010        42,8MB        1.3.2
Apple Mobile Device Support        Apple Inc.        05.09.2010        20,1MB        3.2.0.47
Apple Software Update        Apple Inc.        29.11.2009        2,16MB        2.1.1.116
Audacity 1.2.6                17.01.2008        8,43MB       
Avira AntiVir Personal - Free Antivirus        Avira GmbH        20.07.2008        30,3MB       
Bananarama                18.07.2009        1,55MB       
Bonjour        Apple Inc.        04.10.2010        1,12MB        2.0.3.0
Borland Delphi 5                31.08.2008               
Borland Delphi 7        Borland Software Corporation        20.11.2008        141,2MB        7.0
CCleaner        Piriform        24.08.2011        2,95MB        3.10
Cheat Engine 5.6.1        Dark Byte        23.09.2010        23,3MB       
Colour Options 2.0 (beta) for The Sims 2 (and Sims 2 University                02.11.2007        698MB        2.0 (beta)
Compact&Easy                21.12.2007        9,07MB       
Compatibility Pack für 2007 Office System        Microsoft Corporation        31.12.2006        56,2MB        12.0.4518.1014
Crazy Machines        FAKT Software GmbH        11.06.2011        41,7MB        1.0
Crysis® 2 Demo        Electronic Arts        27.03.2011        1.760MB        1.0.0.0
Die Sims 2: Family Fun - Accessoires                12.11.2007        282MB       
Die Sims 2: Nightlife                11.11.2007        1.287MB       
Die Sims 2: Open For Business                11.11.2007        698MB       
Die Sims 2: Wilde Campus-Jahre                01.11.2007        925MB       
Die Sims™ 2 Apartment-Leben        Electronic Arts        29.08.2008        1.307MB       
Die Sims™ 2 Freizeit-Spaß        Electronic Arts        02.08.2008        1.179MB       
Die Sims™ 2 Gute Reise        Electronic Arts        11.11.2007        947MB       
Die Sims™ 2 H&M®-Fashion-Accessoires                12.11.2007        498MB       
Die Sims™ 2 Haustiere                01.11.2007        801MB       
Die Sims™ 2 Küchen- und Bad-Einrichtungs-Accessoires        Electronic Arts        01.08.2008        473MB       
Die Sims™ 2 Party-Accessoires                12.11.2007        367MB       
Die Sims™ 2 Vier Jahreszeiten                11.11.2007        869MB       
Die Sims™ 2: Glamour-Accessoires                12.11.2007        356MB       
DivX Converter        DivX, Inc.        15.04.2010        37,1MB        7.0.0
DivX Plus DirectShow Filters        DivX, Inc.        15.04.2010        1,22MB       
DivX-Setup        DivX, Inc.        03.05.2010        2,06MB        1.0.1.5
Dungeon Keeper 2                22.07.2010        491MB       
DVDVideoSoftTB Toolbar                30.05.2010        2,61MB       
Efficient WMA MP3 Converter v0.99.2                11.09.2008        26,9MB       
Elecard MPEG-2 Decoder&Streaming Plug-in for WMP        Elecard        03.05.2010        0,66MB        3.7.90209
Electronic Arts Product Registration        Electronic Arts        19.07.2009        1,64MB        1.01.0000
FirstSteps Diagnostics        Fujitsu Siemens Computers        31.12.2006        4,67MB        1.00
Folder Access 2.1 Free Version                16.01.2010        0,94MB       
foobar2000 v1.0.3        Peter Pawlowski        09.08.2010        8,17MB        1.0.3
Forte Free 2.0                04.10.2010        27,8MB       
Fraps                05.02.2009        4,61MB       
Free Audio CD Burner version 1.4        DVDVideoSoft Limited.        11.09.2010        3,12MB       
Free Audio Converter version 2.0        DVDVideoSoft Limited.        05.09.2010        5,77MB       
Free YouTube Download 2.9        DVDVideoSoft Limited.        13.11.2010        3,27MB       
Free YouTube Download 3 version 3.0.3.622        DVDVideoSoft Limited.        30.06.2011        4,27MB       
Free YouTube to MP3 Converter version 3.9.40.602        DVDVideoSoft Limited.        09.06.2011        12,5MB       
FreeMind                04.09.2010        10,3MB        0.8.1
Freez FLV to MP3 Converter        www.smallvideosoft.com        01.11.2009        9,21MB        1.5
FSCLounge        Fujitsu Siemens Computers        01.01.2007        8,47MB        1.0.0
GameWiz32        Nico Ebert        02.01.2011        1,64MB        1.43
GeoGebra        GeoGebra Inc.        28.08.2008        55,9MB        3.0.0.0
Google Chrome        Google Inc.        28.06.2011        46,6MB        13.0.782.215
Google Earth        Google        31.05.2011        84,7MB        6.0.3.2197
Grand Theft Auto San Andreas        Rockstar Games        24.12.2007        4.795MB        1.00.00001
GTA2                25.03.2010        72,0MB       
Hama Double Action Air Grip        GASIA        06.04.2010        1,09MB        1.00.0000
HP Smart Web Printing        Ihr Firmenname        13.09.2008        6,33MB        2.15.7.0
HP Update        Hewlett-Packard        13.09.2008        3,71MB        4.000.006.003
HPSSupply        Ihr Firmenname        13.09.2008        0,96MB        2.2.0.0000
HyperCam 2                10.02.2009        1,28MB       
ICQ Toolbar        ICQ        31.10.2010        0,13MB        3.0.0
ICQ7.5        ICQ        04.08.2011        54,0MB        7.5
ISO Commander 1.6 (remove only)        TurtleBlast Software        02.04.2010        1,18MB        1.6
iTunes        Apple Inc.        04.10.2010        138,7MB        10.0.1.22
Java DB 10.2.2.0        Sun Microsystems, Inc        28.12.2007        24,4MB        10.2.2.0
Java(TM) 6 Update 19        Sun Microsystems, Inc.        02.04.2010        94,5MB        6.0.190
Java(TM) 6 Update 3        Sun Microsystems, Inc.        29.12.2007        168,1MB        1.6.0.30
Java(TM) SE Development Kit 6 Update 3        Sun Microsystems, Inc.        29.12.2007        342MB        1.6.0.30
JDownloader        AppWork UG (haftungsbeschränkt)        07.09.2010        56,2MB        0.89
Last.fm 1.5.4.27091        Last.fm        31.10.2010        33,0MB       
Lazarus 0.9.22                05.11.2010        374MB        0.9.22
LEGO Star Wars        Ihr Firmenname        13.12.2007        1.873MB        1.00.0000
LEGO Star Wars 2 DEMO        LucasArts        01.11.2007        245MB        1.00.0000
LEGO Star Wars Demo Disc        Ihr Firmenname        12.11.2009        245MB        1.00.0000
Lern-o-Mat                22.06.2009        2,17MB       
LiveUpdate 3.2 (Symantec Corporation)        Symantec Corporation        03.11.2007        19,4MB        3.2.0.68
LiveUpdate Notice (Symantec Corporation)        Symantec Corporation        11.08.2008        7,59MB        1.4.5
Luxor Amun Rising (remove only)                01.11.2007        18,1MB       
Macro Express 3        Insight Software Solutions, Inc.        30.06.2008        15,8MB        3.0
Magic FLAC to MP3 Converter 3.72        Magic Video        09.08.2010        3,71MB       
Mahjong Towers Eternity EU (remove only)                01.11.2007        15,7MB       
Malwarebytes' Anti-Malware Version 1.51.1.1800        Malwarebytes Corporation        21.08.2011        3,91MB        1.51.1.1800
Master 2.3 Freeware        Theo Heinze        19.11.2009        2,15MB       
Mein Gutscheincode Finder 1.0.0.0        Conversion One GmbH        05.08.2011        1,91MB        1.0.0.0
Microsoft .NET Framework 1.1                15.08.2008               
Microsoft .NET Framework 1.1 Hotfix (KB929729)                22.08.2008               
Microsoft .NET Framework 3.5        Microsoft Corporation        06.07.2008        33,6MB       
Microsoft .NET Framework 3.5 Language Pack - DEU        Microsoft Corporation        06.07.2008        33,6MB       
Microsoft .NET Framework SDK (German) 1.1        Microsoft        01.09.2008        332MB        1.1.4322
Microsoft Age of Empires II                26.09.2008        344MB       
Microsoft Office Enterprise 2007        Microsoft Corporation        18.03.2010        731MB        12.0.6425.1000
Microsoft Office Home and Student 2007        Microsoft Corporation        18.03.2010        297MB        12.0.6425.1000
Microsoft Office PowerPoint Viewer 2007 (German)        Microsoft Corporation        31.12.2006        51,0MB        12.0.4518.1014
Microsoft Silverlight        Microsoft Corporation        23.07.2010        34,5MB        4.0.50524.0
Microsoft SQL Server Compact 3.5 Design Tools DEU        Microsoft Corporation        04.04.2009        8,54MB        3.5.5386.0
Microsoft SQL Server Compact 3.5 DEU        Microsoft Corporation        04.04.2009        2,25MB        3.5.5386.0
Microsoft Virtual PC 2007        Microsoft Corporation        05.04.2010        36,8MB        6.0.156.0
Microsoft Visual Basic 2005 Express Edition - DEU        Microsoft Corporation        11.05.2008        166,3MB       
Microsoft Visual Basic 2008 Express Edition - DEU        Microsoft Corporation        03.04.2009        157,0MB       
Microsoft Visual C++ 2005 Redistributable        Microsoft Corporation        12.07.2010        0,41MB        8.0.56336
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17        Microsoft Corporation        23.07.2010        0,58MB        9.0.30729
Microsoft Visual J# 2.0 Redistributable Package        Microsoft Corporation        28.08.2008        133,1MB       
Microsoft Windows SDK for Visual Studio 2008 Express Tools for .NET Framework        Microsoft        04.04.2009        5,62MB        3.5.21022
Microsoft Windows SDK for Visual Studio 2008 Express Tools for Win32        Microsoft Corporation        04.04.2009        2,61MB        6.1.5288.17011
Microsoft Works        Microsoft Corporation        01.01.2007        377MB        9.7.0621
Microsoft WSE 3.0 Runtime        Microsoft Corp.        11.07.2010        0,92MB        3.0.5305.0
MobileMe Control Panel        Apple Inc.        04.10.2010        11,8MB        3.1.3.0
Movavi VideoSuite 5        MOVAVI        17.10.2008        68,4MB        5.07.004
Mozilla Firefox (3.6.20)        Mozilla        17.08.2011        31,5MB        3.6.20 (de)
MSXML 4.0 SP2 (KB941833)        Microsoft Corporation        01.01.2007        1,27MB        4.20.9849.0
MSXML 4.0 SP2 (KB954430)        Microsoft Corporation        22.11.2008        1,28MB        4.20.9870.0
Muziic Player & Encoder                01.11.2009        57,0MB       
Mystery Case Files - Prime Suspects (remove only)                01.11.2007        39,3MB       
Nero 7 Essentials        Nero AG        31.12.2006        377MB        7.02.5851
Netscape Navigator (9.0.0.6)        Netscape        27.03.2008        20,7MB        9.0.0.6 (en-US)
Norton Security Scan        Symantec Corporation        03.05.2010        12,4MB        2.7.3.34
NVIDIA Drivers                14.07.2008               
OJOsoft Audio Converter        OJOsoft        05.09.2010        16,3MB        2.7.5.0412
OpenAL                11.02.2010        0,77MB       
OpenOffice.org 2.4        OpenOffice.org        01.08.2008        328MB        2.4.9310
Opera 9.26        Opera Software ASA        11.03.2008        11,8MB        9.26
Pando Media Booster        Pando Networks Inc.        02.11.2009        6,69MB        2.3.2.8
Pcsx2 0.9.6        Pcsx2 Team        06.04.2010        19,3MB        1.0.0
Poker Superstars II (remove only)                01.11.2007        30,3MB       
PowerISO        PowerISO Computing, Inc.        24.02.2010        3,76MB        4.6
QuickTime        Apple Inc.        04.10.2010        73,7MB        7.68.75.0
RealPlayer        RealNetworks        17.01.2008        46,8MB       
Realtek High Definition Audio Driver                31.12.2006               
Safari        Apple Inc.        27.03.2008        60,8MB        3.525.13.0
SimCity 3000                28.12.2010        225MB       
SimCity 4                30.12.2010        920MB       
Softonic Toolbar        Ask.com        28.05.2011        3,33MB        1.12.2.0
Softonic_Deutsch Toolbar                23.03.2011        3,91MB       
Spesoft Audio Converter 2.30        Spesoft        09.08.2010        18,0MB       
Streamripper (Remove only)                06.11.2009        6,30MB       
Super nude patch II 2.8                31.07.2008               
Theme Park World                28.12.2010        157,5MB       
TIPP10 Version 2.0.3        (c) 2006-2008, Tom Thielicke        22.02.2010        12,2MB       
Uninstall 1.0.0.1                13.11.2010        19,4MB       
Unity Web Player        Unity Technologies ApS        10.02.2011        0,20MB       
VideoLAN VLC media player 0.8.6h        VideoLAN Team        20.06.2008        32,4MB        0.8.6h
VoiceOver Kit        Apple Inc.        26.07.2010        35,7MB        1.30.128.0
Vokabel Trainer 5        Manuel Wäschle        05.08.2011        4,98MB       
WAV to MP3                06.08.2009        0,66MB       
Winamp        Nullsoft, Inc        08.01.2008        27,0MB        5.51
Windows Live Anmelde-Assistent        Microsoft Corporation        21.12.2010        1,93MB        5.000.818.5
Windows Live Essentials        Microsoft Corporation        21.12.2010        43,9MB        14.0.8117.0416
Windows Live-Uploadtool        Microsoft Corporation        21.12.2010        0,22MB        14.0.8014.1029
Winload Toolbar        Winload        05.08.2011        4,36MB        6.3.3.3
WinRAR                25.12.2007        3,66MB       
Yu-Gi-Oh! Power of Chaos YUGI THE DESTINY        KONAMI        02.04.2010        229MB        1.00.0000

OTL 2. Mal

Code:
OTL logfile created on: 25.08.2011 21:56:25 - Run 2
OTL by OldTimer - Version 3.2.26.5    Folder = C:\Users\Fabian\Desktop
Windows Vista Home Premium Edition  (Version = 6.0.6000) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6000.16809)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 1,61 Gb Available Physical Memory | 53,63% Memory free
6,20 Gb Paging File | 4,88 Gb Available in Paging File | 78,72% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 303,35 Gb Total Space | 93,51 Gb Free Space | 30,83% Space Free | Partition Type: NTFS
Drive D: | 149,72 Gb Total Space | 42,77 Gb Free Space | 28,56% Space Free | Partition Type: NTFS
Drive Z: | 995,00 Mb Total Space | 994,99 Mb Free Space | 100,00% Space Free | Partition Type: FAT32
 
Computer Name: FABIAN-PC | User Name: Fabian | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2011.08.23 19:18:44 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Users\Fabian\Desktop\OTL.exe
PRC - [2011.05.17 13:29:46 | 000,395,144 | ---- | M] (Ask) -- C:\Programme\Ask.com\Updater\Updater.exe
PRC - [2010.10.27 22:21:54 | 001,155,072 | ---- | M] (Last.fm) -- C:\Programme\Last.fm\LastFM.exe
PRC - [2010.04.13 00:46:36 | 001,135,912 | ---- | M] () -- C:\Programme\DivX\DivX Update\DivXUpdate.exe
PRC - [2009.11.03 16:42:05 | 002,923,192 | ---- | M] () -- C:\Programme\Pando Networks\Media Booster\PMB.exe
PRC - [2008.10.29 08:20:29 | 002,923,520 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2008.10.25 12:44:34 | 000,031,072 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft Office\Office12\GrooveMonitor.exe
PRC - [2008.07.21 14:24:44 | 000,068,865 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe
PRC - [2008.07.21 14:24:40 | 000,266,497 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe
PRC - [2008.07.21 14:24:40 | 000,149,761 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe
PRC - [2008.02.26 17:24:06 | 004,939,776 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe
PRC - [2008.01.29 17:38:32 | 000,583,048 | ---- | M] (Symantec Corporation) -- C:\Programme\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
PRC - [2008.01.18 15:26:17 | 000,185,896 | ---- | M] (RealNetworks, Inc.) -- C:\Programme\Common Files\Real\Update_OB\realsched.exe
PRC - [2007.09.26 11:53:56 | 000,623,984 | ---- | M] (Symantec Corporation) -- C:\Programme\Symantec\LiveUpdate\AUPDATE.EXE
PRC - [2007.09.26 11:53:56 | 000,554,352 | ---- | M] (Symantec Corporation) -- C:\Programme\Symantec\LiveUpdate\AluSchedulerSvc.exe
PRC - [2007.05.28 18:57:54 | 000,275,968 | ---- | M] (Rocket Division Software) -- C:\Programme\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
PRC - [2007.01.01 01:36:01 | 001,006,264 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Defender\MSASCui.exe
PRC - [2006.12.08 11:52:04 | 000,204,800 | ---- | M] (Fujitsu Siemens Computers) -- C:\FirstSteps\OnlineDiagnostic\TestManager\TestHandler.exe
PRC - [2006.11.02 14:35:35 | 000,176,128 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wpcumi.exe
PRC - [2006.11.02 11:44:59 | 000,068,608 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conime.exe
PRC - [2003.03.19 10:55:56 | 000,335,872 | ---- | M] (Microsoft Corporation) -- C:\Programme\Common Files\microsoft shared\VS7Debug\mdm.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2010.10.27 22:23:04 | 000,106,496 | ---- | M] () -- C:\Programme\Last.fm\srv_rtaudioplayback.dll
MOD - [2010.10.27 22:22:52 | 000,057,344 | ---- | M] () -- C:\Programme\Last.fm\ext_messengernotify.dll
MOD - [2010.10.27 22:22:42 | 000,058,880 | ---- | M] () -- C:\Programme\Last.fm\ext_skypenotify.dll
MOD - [2010.10.27 22:22:08 | 000,147,456 | ---- | M] () -- C:\Programme\Last.fm\srv_madtranscode.dll
MOD - [2010.10.27 22:22:00 | 000,028,160 | ---- | M] () -- C:\Programme\Last.fm\srv_httpinput.dll
MOD - [2010.10.27 22:19:28 | 000,372,736 | ---- | M] () -- C:\Programme\Last.fm\LastFmFingerprint1.dll
MOD - [2010.10.27 22:19:06 | 000,025,088 | ---- | M] () -- C:\Programme\Last.fm\breakpad.dll
MOD - [2010.10.27 22:18:50 | 000,180,224 | ---- | M] () -- C:\Programme\Last.fm\Moose1.dll
MOD - [2010.10.27 22:18:34 | 000,540,672 | ---- | M] () -- C:\Programme\Last.fm\LastFmTools1.dll
MOD - [2010.10.27 22:13:52 | 001,382,507 | ---- | M] () -- C:\Programme\Last.fm\libfftw3f-3.dll
MOD - [2010.10.27 22:13:52 | 000,074,240 | ---- | M] () -- C:\Programme\Last.fm\zlibwapi.dll
MOD - [2010.04.13 00:46:46 | 000,095,528 | ---- | M] () -- C:\Programme\DivX\DivX Update\DivXUpdateCheck.dll
MOD - [2010.04.13 00:46:36 | 001,135,912 | ---- | M] () -- C:\Programme\DivX\DivX Update\DivXUpdate.exe
MOD - [2009.11.03 16:42:05 | 002,923,192 | ---- | M] () -- C:\Programme\Pando Networks\Media Booster\PMB.exe
MOD - [2009.09.05 00:15:06 | 000,067,872 | ---- | M] () -- C:\Programme\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2008.04.16 18:42:30 | 000,376,832 | ---- | M] () -- C:\Programme\Last.fm\QtNetwork4.dll
MOD - [2008.04.16 18:42:16 | 000,524,288 | ---- | M] () -- C:\Programme\Last.fm\QtSql4.dll
MOD - [2008.04.16 18:42:02 | 006,701,056 | ---- | M] () -- C:\Programme\Last.fm\QtGui4.dll
MOD - [2008.04.16 18:36:38 | 000,376,832 | ---- | M] () -- C:\Programme\Last.fm\QtXml4.dll
MOD - [2008.04.16 18:36:34 | 001,654,784 | ---- | M] () -- C:\Programme\Last.fm\QtCore4.dll
MOD - [2008.04.02 15:26:50 | 000,233,472 | ---- | M] () -- C:\Programme\Last.fm\imageformats\qmng4.dll
MOD - [2008.04.02 15:26:34 | 000,021,504 | ---- | M] () -- C:\Programme\Last.fm\imageformats\qgif4.dll
MOD - [2008.04.02 15:26:28 | 000,135,168 | ---- | M] () -- C:\Programme\Last.fm\imageformats\qjpeg4.dll
MOD - [2007.09.20 19:34:58 | 000,129,024 | ---- | M] () -- C:\Programme\WinRAR\RarExt.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - File not found [Auto | Stopped] --  -- (sdCoreService)
SRV - File not found [Auto | Stopped] --  -- (sdAuxService)
SRV - File not found [On_Demand | Stopped] --  -- (osagent)
SRV - File not found [On_Demand | Stopped] --  -- (oad)
SRV - File not found [Auto | Stopped] --  -- (LiveUpdate Notice Ex)
SRV - File not found [Auto | Stopped] --  -- (LckFldService)
SRV - File not found [Auto | Stopped] --  -- (CLTNetCnService)
SRV - [2010.05.01 19:48:37 | 000,655,624 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2008.07.21 14:24:44 | 000,068,865 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe -- (AntiVirScheduler)
SRV - [2008.07.21 14:24:40 | 000,149,761 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe -- (AntiVirService)
SRV - [2008.01.29 17:38:32 | 000,583,048 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe -- (LiveUpdate Notice Service)
SRV - [2007.09.26 11:53:56 | 002,999,664 | ---- | M] (Symantec Corporation) [On_Demand | Stopped] -- C:\Programme\Symantec\LiveUpdate\LuComServer_3_2.EXE -- (LiveUpdate)
SRV - [2007.09.26 11:53:56 | 000,554,352 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe -- (Automatisches LiveUpdate - Scheduler)
SRV - [2007.05.28 18:57:54 | 000,275,968 | ---- | M] (Rocket Division Software) [Auto | Running] -- C:\Programme\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe -- (StarWindServiceAE)
SRV - [2007.01.01 01:36:01 | 000,265,912 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2006.12.08 11:52:04 | 000,204,800 | ---- | M] (Fujitsu Siemens Computers) [Auto | Running] -- C:\FirstSteps\OnlineDiagnostic\TestManager\TestHandler.exe -- (TestHandler)
 
 
========== Driver Services (SafeList) ==========
 
DRV - [2011.08.07 10:00:00 | 000,374,392 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Programme\Common Files\Symantec Shared\EENGINE\eeCtrl.sys -- (eeCtrl)
DRV - [2010.12.29 22:37:28 | 000,691,696 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\System32\Drivers\sptd.sys -- (sptd)
DRV - [2010.03.25 20:06:30 | 000,099,728 | ---- | M] (Sun Microsystems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VBoxNetAdp.sys -- (VBoxNetAdp)
DRV - [2009.11.09 05:21:18 | 000,059,388 | ---- | M] (PowerISO Computing, Inc.) [Kernel | System | Running] -- C:\Windows\System32\drivers\scdemu.sys -- (SCDEmu)
DRV - [2008.07.21 14:24:45 | 000,075,072 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2008.06.03 15:36:45 | 000,052,032 | ---- | M] (Avira GmbH) [File_System | On_Demand | Running] -- C:\Programme\Avira\AntiVir PersonalEdition Classic\avgntflt.sys -- (avgntflt)
DRV - [2008.04.30 13:06:48 | 000,021,248 | ---- | M] (AVIRA GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2008.02.14 15:56:02 | 000,118,784 | ---- | M] (Realtek Corporation                                            ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169)
DRV - [2007.12.26 23:18:24 | 000,016,712 | ---- | M] (G DATA Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\GRD.sys -- (GRD)
DRV - [2007.12.05 02:41:00 | 008,238,720 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2007.10.18 01:16:00 | 000,079,688 | ---- | M] (PCTools Research Pty Ltd.) [Kernel | System | Running] -- C:\Windows\System32\drivers\iksyssec.sys -- (IKSysSec)
DRV - [2007.10.18 01:15:00 | 000,062,280 | ---- | M] (PCTools Research Pty Ltd.) [Kernel | System | Running] -- C:\Windows\System32\drivers\iksysflt.sys -- (IKSysFlt)
DRV - [2007.10.18 01:14:00 | 000,041,288 | ---- | M] (PCTools Research Pty Ltd.) [File_System | Boot | Running] -- C:\Windows\system32\drivers\ikfilesec.sys -- (IKFileSec)
DRV - [2007.07.02 17:37:10 | 000,131,616 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvrd32.sys -- (nvrd32)
DRV - [2007.07.02 17:37:08 | 000,110,112 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvstor32.sys -- (nvstor32)
DRV - [2007.06.13 23:47:12 | 000,048,256 | ---- | M] (JMicron Technology Corp.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\jraid.sys -- (JRAID)
DRV - [2007.02.27 16:25:04 | 000,011,840 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Programme\Avira\AntiVir PersonalEdition Classic\avgio.sys -- (avgio)
DRV - [2007.02.18 00:15:34 | 000,232,816 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\VMM.sys -- (vmm)
DRV - [2007.01.30 02:20:04 | 000,361,728 | ---- | M] (eMPIA Technology, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\emBDA.sys -- (USB28xxBGA)
DRV - [2007.01.30 02:19:48 | 000,039,680 | ---- | M] (eMPIA Technology, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\emOEM.sys -- (USB28xxOEM)
DRV - [2007.01.29 06:20:34 | 000,059,280 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\VMNetSrv.sys -- (VPCNetS2)
DRV - [2006.10.30 11:22:26 | 000,008,192 | ---- | M] (ATI Technologies Inc.) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\AtiPcie.sys -- (AtiPcie) ATI PCI Express (3GIO)
DRV - [2003.04.19 01:32:04 | 000,004,736 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\tandpl.sys -- (tandpl)
DRV - [2003.03.02 18:44:26 | 000,007,552 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\enodpl.sys -- (enodpl)
DRV - [2002.07.17 16:20:32 | 000,084,832 | ---- | M] (Adaptec) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ASPI32.SYS -- (ASPI)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/
IE - HKLM\..\URLSearchHook:  - Reg Error: Key error. File not found
IE - HKLM\..\URLSearchHook: {40c3cc16-7269-4b32-9531-17f2950fb06f} - C:\Programme\Winload\prxtbWinl.dll (Conduit Ltd.)
IE - HKLM\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - Reg Error: Key error. File not found
IE - HKLM\..\URLSearchHook: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\tbDVDV.dll (Conduit Ltd.)
IE - HKLM\..\URLSearchHook: {8dbb6d8e-e4a6-4e3b-9753-af78b226441c} - C:\Programme\Softonic_Deutsch\prxtbSof2.dll (Conduit Ltd.)
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.icq.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook:  - Reg Error: Key error. File not found
IE - HKCU\..\URLSearchHook: {40c3cc16-7269-4b32-9531-17f2950fb06f} - C:\Programme\Winload\prxtbWinl.dll (Conduit Ltd.)
IE - HKCU\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - Reg Error: Key error. File not found
IE - HKCU\..\URLSearchHook: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\tbDVDV.dll (Conduit Ltd.)
IE - HKCU\..\URLSearchHook: {8dbb6d8e-e4a6-4e3b-9753-af78b226441c} - C:\Programme\Softonic_Deutsch\prxtbSof2.dll (Conduit Ltd.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.defaultthis.engineName: "Winload Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2319825&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.suggest.enabled: false
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://start.icq.com/"
FF - prefs.js..extensions.enabledItems: {800b5000-a755-47e1-992b-48a1c1357f07}:1.1.9
FF - prefs.js..extensions.enabledItems: personas@christopher.beard:1.5.1
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:1.6.6.20090220
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1
FF - prefs.js..extensions.enabledItems: {e9911ec6-1bcc-40b0-9993-e0eea7f6953f}:2.5.8.6
FF - prefs.js..extensions.enabledItems: toolbar@ask.com:3.12.2.100006
FF - prefs.js..extensions.enabledItems: {40c3cc16-7269-4b32-9531-17f2950fb06f}:3.5.0.12
FF - prefs.js..extensions.enabledItems: finder@meingutscheincode.de:3.0.2
FF - prefs.js..keyword.URL: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2319825&q="
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll File not found
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.50524.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.11.3088: C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/npracplug;version=1.0.0.0: C:\Program Files\Real\RealArcade\Plugins\Mozilla\npracplug.dll File not found
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.2.3146: C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.11.3006: C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=:  File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc;version=0.8.6h: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN Team)
FF - HKCU\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Fabian\AppData\Local\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Fabian\AppData\Local\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\Fabian\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{3112ca9c-de6d-4884-a869-9855de68056c}: C:\ProgramData\Mozilla\Firefox Extensions\{3112ca9c-de6d-4884-a869-9855de68056c} [2007.11.02 22:05:49 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Program Files\Real\RealPlayer\browserrecord [2008.01.18 15:26:39 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.20\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.08.18 19:08:34 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.20\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.08.18 19:08:34 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Netscape Navigator 9.0.0.6\extensions\\Components: C:\Program Files\Netscape\Navigator 9\components [2010.10.04 20:43:45 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Netscape Navigator 9.0.0.6\extensions\\Plugins: C:\Program Files\Netscape\Navigator 9\plugins [2010.10.04 20:43:45 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\finder@meingutscheincode.de: C:\Program Files\Mein Gutscheincode Finder\Firefox [2011.08.06 02:58:52 | 000,000,000 | ---D | M]
 
[2008.02.22 19:36:11 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Fabian\AppData\Roaming\mozilla\Extensions
[2011.08.25 14:05:51 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions
[2007.11.22 22:14:16 | 000,000,000 | ---D | M] (Adblock) -- C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{34274bf4-1d97-a289-e984-17e546307e4f}
[2011.08.06 02:59:23 | 000,000,000 | ---D | M] (Winload Community Toolbar) -- C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f}
[2010.04.02 13:34:00 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2011.08.05 18:05:07 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2008.04.05 21:40:09 | 000,000,000 | ---D | M] (ReloadEvery) -- C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{888d99e7-e8b5-46a3-851e-1ec45da1e644}
[2011.08.22 16:40:01 | 000,000,000 | ---D | M] (kikin plugin) -- C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{AA994882-F391-4d2e-806F-8908DA4814ED}
[2010.05.30 19:37:16 | 000,000,000 | ---D | M] ("DVDVideoSoft Menu") -- C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2007.11.18 18:58:29 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{b69a9db4-d0a1-4722-b56b-f20757a29cdf}
[2010.05.31 21:41:40 | 000,000,000 | ---D | M] (DVDVideoSoft Toolbar) -- C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}
[2010.01.31 12:29:04 | 000,000,000 | ---D | M] (Personas) -- C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\personas@christopher.beard
[2010.05.01 14:52:26 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\staged-xpis
[2011.08.01 14:07:05 | 000,000,000 | ---D | M] ("Softonic Toolbar") -- C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\toolbar@ask.com
[2010.05.25 19:15:26 | 000,005,318 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\alle-notende.xml
[2010.02.04 17:45:40 | 000,002,254 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\askcom.xml
[2011.07.24 15:31:22 | 000,000,917 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\conduit.xml
[2010.12.29 22:37:47 | 000,002,059 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\daemon-search.xml
[2011.08.24 14:23:21 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-1.xml
[2010.09.16 21:51:06 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-10.xml
[2010.10.21 15:35:06 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-11.xml
[2010.10.28 22:30:02 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-12.xml
[2010.11.01 20:10:54 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-13.xml
[2010.12.12 18:15:49 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-14.xml
[2011.03.05 16:55:13 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-15.xml
[2011.03.06 15:53:40 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-16.xml
[2011.03.24 19:24:37 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-17.xml
[2011.05.28 14:30:50 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-18.xml
[2011.08.05 18:05:29 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-19.xml
[2007.11.05 23:42:58 | 000,000,949 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-2.xml
[2007.11.27 22:45:15 | 000,000,949 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-3.xml
[2009.05.13 19:07:53 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-4.xml
[2010.06.23 20:00:54 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-5.xml
[2010.06.28 00:08:50 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-6.xml
[2010.07.22 13:15:12 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-7.xml
[2010.07.26 10:58:21 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-8.xml
[2010.09.08 21:35:51 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-9.xml
[2011.08.05 18:05:07 | 000,000,168 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin.gif
[2011.08.05 18:05:07 | 000,000,618 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin.src
[2011.03.30 15:14:34 | 000,001,042 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin.xml
[2011.08.05 18:15:16 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2009.06.12 13:58:33 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Programme\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2007.11.27 22:26:07 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions\google-cjk@partners.mozilla.com
[2011.08.06 02:58:52 | 000,000,000 | ---D | M] (preisspion.de) -- C:\PROGRAM FILES\MEIN GUTSCHEINCODE FINDER\FIREFOX
[2010.04.02 13:33:15 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}
[2009.11.03 16:42:01 | 000,238,776 | ---- | M] (Pando Networks) -- C:\Program Files\mozilla firefox\plugins\npPandoWebInst.dll
[2005.04.27 22:10:49 | 000,102,400 | ---- | M] (RealNetworks) -- C:\Program Files\mozilla firefox\plugins\npracplug.dll
[2011.08.18 19:08:30 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011.08.18 19:08:30 | 000,002,344 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2011.08.18 19:08:30 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2011.08.18 19:08:30 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2011.08.18 19:08:30 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2011.08.25 19:25:53 | 000,000,098 | ---- | M]) - C:\Windows\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: ::1      localhost
O2 - BHO: (HP Print Clips) - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Programme\HP\Smart Web Printing\hpswp_framework.dll (Hewlett-Packard Co.)
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - No CLSID value found.
O2 - BHO: (Mein Gutscheincode Finder zeigt automatisch Shopping-Gutscheine an mit denen Sie beim Online-Einkauf sparen können.) - {1ED16E0A-E8C4-40A0-8BC2-79485D21F796} - C:\Programme\Mein Gutscheincode Finder\Internet Explorer\x86\ConversionOneIE.dll (Conversion One GmbH)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Programme\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Programme\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O2 - BHO: (Winload Toolbar) - {40c3cc16-7269-4b32-9531-17f2950fb06f} - C:\Programme\Winload\prxtbWinl.dll (Conduit Ltd.)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O2 - BHO: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\tbDVDV.dll (Conduit Ltd.)
O2 - BHO: (Softonic Deutsch Toolbar) - {8dbb6d8e-e4a6-4e3b-9753-af78b226441c} - C:\Programme\Softonic_Deutsch\prxtbSof2.dll (Conduit Ltd.)
O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (Softonic Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (Winload Toolbar) - {40c3cc16-7269-4b32-9531-17f2950fb06f} - C:\Programme\Winload\prxtbWinl.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (no name) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - No CLSID value found.
O3 - HKLM\..\Toolbar: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\tbDVDV.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Softonic Deutsch Toolbar) - {8dbb6d8e-e4a6-4e3b-9753-af78b226441c} - C:\Programme\Softonic_Deutsch\prxtbSof2.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Softonic Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (DVDVideoSoftTB Toolbar) - {872B5B88-9DB5-4310-BDD0-AC189557E5F5} - C:\Programme\DVDVideoSoftTB\tbDVDV.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (Softonic Deutsch Toolbar) - {8DBB6D8E-E4A6-4E3B-9753-AF78B226441C} - C:\Programme\Softonic_Deutsch\prxtbSof2.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (Softonic Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [AdobeCS4ServiceManager] C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [ApnUpdater] C:\Program Files\Ask.com\Updater\Updater.exe (Ask)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [DAEMON Tools] C:\Program Files\DAEMON Tools\daemon.exe (DT Soft Ltd.)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [HCWemmon] C:\Windows\HCWemmon.exe (eMPIA Technology, Inc.)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [NeroFilterCheck] C:\Programme\Common Files\Ahead\Lib\NeroCheck.exe (Nero AG)
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvSvc] C:\Windows\System32\nvsvc.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [PWRISOVM.EXE] C:\Programme\PowerISO\PWRISOVM.EXE (PowerISO Computing, Inc.)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [Symantec PIF AlertEng] C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe (Symantec Corporation)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKLM..\Run: [WPCUMI] C:\Windows\System32\wpcumi.exe (Microsoft Corporation)
O4 - HKCU..\Run: [AlcoholAutomount] C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe (Alcohol Soft Development Team)
O4 - HKCU..\Run: [DAEMON Tools] C:\Program Files\DAEMON Tools\daemon.exe (DT Soft Ltd.)
O4 - HKCU..\Run: [DAEMON Tools Lite] C:\Program Files\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
O4 - HKCU..\Run: [EA Core]  File not found
O4 - HKCU..\Run: [ICQ]  File not found
O4 - HKCU..\Run: [Pando Media Booster] C:\Programme\Pando Networks\Media Booster\PMB.exe ()
O4 - Startup: C:\Users\Fabian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma.lnk = C:\Programme\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
O4 - Startup: C:\Users\Fabian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk = C:\Programme\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1
O8 - Extra context menu item: Free YouTube Download - C:\Users\Fabian\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\Fabian\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: HP Sammelmappe - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Programme\HP\Smart Web Printing\hpswp_extensions.dll (Hewlett-Packard Co.)
O9 - Extra Button: HP Intelligente Auswahl - {700259D7-1666-479a-93B1-3250410481E8} - C:\Programme\HP\Smart Web Printing\hpswp_extensions.dll (Hewlett-Packard Co.)
O9 - Extra Button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Programme\ICQ7.5\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Programme\ICQ7.5\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000023 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab (Java Plug-in 1.6.0_19)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Java Plug-in 1.6.0_03)
O16 - DPF: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab (Java Plug-in 1.6.0_19)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab (Java Plug-in 1.6.0_19)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programme\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Desktop Hintergrund.bmp
O24 - Desktop BackupWallPaper: C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Desktop Hintergrund.bmp
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.08.25 21:51:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
[2011.08.25 19:25:12 | 000,000,000 | ---D | C] -- C:\_OTL
[2011.08.23 19:18:40 | 000,580,096 | ---- | C] (OldTimer Tools) -- C:\Users\Fabian\Desktop\OTL.exe
[2011.08.21 15:14:57 | 000,000,000 | ---D | C] -- C:\Users\Fabian\AppData\Local\No23 Recorder
[2011.08.21 15:14:54 | 000,000,000 | ---D | C] -- C:\Users\Fabian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\No23 Recorder
[2011.08.21 15:14:08 | 000,000,000 | ---D | C] -- C:\Users\Fabian\AppData\Roaming\kikin
[2011.08.21 15:14:07 | 000,000,000 | ---D | C] -- C:\Program Files\kikin
[2011.08.21 15:10:30 | 000,000,000 | ---D | C] -- C:\Users\Fabian\Desktop\Geäusche für Musik
[2011.08.19 14:52:01 | 000,000,000 | ---D | C] -- C:\Users\Fabian\Desktop\teeworlds-b122-r50edfd37-win32
[2011.08.12 20:43:14 | 000,000,000 | ---D | C] -- C:\Users\Fabian\Desktop\bio-referat
[2011.08.06 17:56:00 | 000,000,000 | ---D | C] -- C:\Users\Fabian\Documents\My Kindle Content
[2011.08.06 17:55:52 | 000,000,000 | ---D | C] -- C:\Users\Fabian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Amazon
[2011.08.06 17:55:37 | 000,000,000 | ---D | C] -- C:\Users\Fabian\AppData\Local\Amazon
[2011.08.06 02:59:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Vokabel Trainer
[2011.08.06 02:59:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Vokabel Trainer
[2011.08.06 02:59:36 | 000,000,000 | ---D | C] -- C:\Program Files\Vokabel Trainer
[2011.08.06 02:59:00 | 000,000,000 | ---D | C] -- C:\Program Files\Winload
[2011.08.06 02:58:50 | 000,000,000 | ---D | C] -- C:\Program Files\Mein Gutscheincode Finder
[2011.08.05 18:05:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ICQ7.5
[2011.08.05 18:04:32 | 000,000,000 | ---D | C] -- C:\Program Files\ICQ7.5
 
========== Files - Modified Within 30 Days ==========
 
[2011.08.25 22:00:07 | 000,000,420 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{C27515C3-4436-493B-94A2-3C3CF69BDCC9}.job
[2011.08.25 21:51:15 | 000,000,810 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2011.08.25 21:51:00 | 000,001,124 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1054673845-2891796712-3211906163-1000UA.job
[2011.08.25 21:26:58 | 000,003,200 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011.08.25 21:26:58 | 000,003,200 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011.08.25 21:20:01 | 000,001,098 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011.08.25 19:27:07 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011.08.25 19:26:52 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011.08.25 19:26:50 | 3220,692,992 | -HS- | M] () -- C:\hiberfil.sys
[2011.08.25 19:25:53 | 000,000,098 | ---- | M] () -- C:\Windows\System32\drivers\etc\Hosts
[2011.08.24 00:10:46 | 000,655,692 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2011.08.24 00:10:46 | 000,621,850 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011.08.24 00:10:46 | 000,122,662 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2011.08.24 00:10:46 | 000,108,934 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011.08.23 20:50:48 | 000,000,476 | -H-- | M] () -- C:\Windows\tasks\Norton Security Scan for Fabian.job
[2011.08.23 19:18:44 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Users\Fabian\Desktop\OTL.exe
[2011.08.23 15:15:58 | 000,010,054 | ---- | M] () -- C:\Users\Fabian\Desktop\13.odt
[2011.08.22 19:15:49 | 000,008,268 | ---- | M] () -- C:\Users\Fabian\AppData\Local\d3d9caps.dat
[2011.08.11 19:55:43 | 009,527,411 | ---- | M] () -- C:\Users\Fabian\Desktop\Doku über Klimaerwärmung und Climategate in finnischem TV 1_3.mp3
[2011.08.06 02:59:37 | 000,000,904 | ---- | M] () -- C:\Users\Public\Desktop\Vokabel Trainer.lnk
[2011.08.06 00:51:00 | 000,001,072 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1054673845-2891796712-3211906163-1000Core.job
[2011.07.27 05:02:13 | 000,076,800 | ---- | M] () -- C:\Users\Fabian\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
 
========== Files Created - No Company Name ==========
 
[2011.08.25 21:51:15 | 000,000,810 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2011.08.22 19:31:59 | 3220,692,992 | -HS- | C] () -- C:\hiberfil.sys
[2011.08.11 19:55:18 | 009,527,411 | ---- | C] () -- C:\Users\Fabian\Desktop\Doku über Klimaerwärmung und Climategate in finnischem TV 1_3.mp3
[2011.08.06 02:59:37 | 000,000,904 | ---- | C] () -- C:\Users\Public\Desktop\Vokabel Trainer.lnk
[2011.01.03 00:22:14 | 000,073,728 | ---- | C] () -- C:\Windows\System32\GkSui18.EXE
[2010.09.24 19:12:00 | 001,970,176 | ---- | C] () -- C:\Windows\System32\d3dx9.dll
[2010.09.03 18:45:49 | 000,256,512 | ---- | C] () -- C:\Windows\PEV.exe
[2010.09.03 18:45:49 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2010.09.03 18:45:49 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2010.09.03 18:45:49 | 000,077,312 | ---- | C] () -- C:\Windows\MBR.exe
[2010.09.03 18:45:49 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2009.11.02 19:48:01 | 008,676,883 | ---- | C] () -- C:\Windows\System32\mp3Media2.dll
[2009.02.20 15:28:45 | 000,162,304 | ---- | C] () -- C:\Windows\System32\ztvunrar36.dll
[2009.02.20 15:28:45 | 000,077,312 | ---- | C] () -- C:\Windows\System32\ztvunace26.dll
[2008.12.22 13:10:46 | 000,009,509 | ---- | C] () -- C:\ProgramData\LUUnInstall.LiveUpdate
[2008.10.18 16:40:43 | 000,004,984 | ---- | C] () -- C:\ProgramData\jexqjxsy.dne
[2008.10.18 16:40:35 | 000,000,060 | ---- | C] () -- C:\Windows\IniFile1.ini
[2008.09.01 22:42:53 | 000,264,192 | ---- | C] () -- C:\Windows\System32\midas.dll
[2008.08.13 14:34:20 | 000,000,094 | ---- | C] () -- C:\Users\Fabian\AppData\Local\fusioncache.dat
[2008.03.28 15:20:24 | 000,138,024 | -H-- | C] () -- C:\Windows\System32\mlfcache.dat
[2008.01.14 19:44:58 | 000,149,504 | ---- | C] () -- C:\Windows\System32\UNWISE.EXE
[2008.01.14 19:44:19 | 000,032,825 | ---- | C] () -- C:\Windows\Irremote.ini
[2008.01.14 19:44:09 | 000,065,536 | ---- | C] () -- C:\Windows\System32\dmcrypto.dll
[2008.01.14 19:43:46 | 000,000,209 | ---- | C] () -- C:\Windows\ODBCINST.INI
[2008.01.14 19:43:46 | 000,000,135 | ---- | C] () -- C:\Windows\ODBC.INI
[2008.01.14 19:43:45 | 000,159,744 | ---- | C] () -- C:\Windows\System32\hcwChDB.dll
[2008.01.14 19:43:14 | 000,002,075 | ---- | C] () -- C:\Windows\HCWPNP.INI
[2008.01.14 19:42:12 | 000,040,960 | ---- | C] () -- C:\Windows\System32\bdadll.dll
[2007.12.26 23:41:32 | 000,019,900 | ---- | C] () -- C:\Users\Fabian\AppData\Roaming\UserTile.png
[2007.12.26 01:09:48 | 000,000,025 | ---- | C] () -- C:\Windows\SIERRA.INI
[2007.12.26 01:04:15 | 000,156,160 | ---- | C] () -- C:\Windows\System32\unrar3.dll
[2007.12.26 01:04:15 | 000,075,264 | ---- | C] () -- C:\Windows\System32\unacev2.dll
[2007.12.08 11:27:15 | 000,008,268 | ---- | C] () -- C:\Users\Fabian\AppData\Local\d3d9caps.dat
[2007.11.22 22:22:43 | 000,000,305 | ---- | C] () -- C:\ProgramData\addr_file.html
[2007.11.18 19:15:53 | 000,237,568 | ---- | C] () -- C:\Windows\System32\lame_enc.dll
[2007.11.08 18:10:12 | 000,069,632 | R--- | C] () -- C:\Windows\System32\xmltok.dll
[2007.11.08 18:10:12 | 000,036,864 | R--- | C] () -- C:\Windows\System32\xmlparse.dll
[2007.11.08 17:52:59 | 000,007,552 | ---- | C] () -- C:\Windows\System32\drivers\enodpl.sys
[2007.11.08 17:52:59 | 000,004,736 | ---- | C] () -- C:\Windows\System32\drivers\tandpl.sys
[2007.11.06 21:36:09 | 000,007,316 | ---- | C] () -- C:\Users\Fabian\AppData\Roaming\wklnhst.dat
[2007.11.03 20:54:04 | 000,641,021 | ---- | C] () -- C:\Windows\unins000.exe
[2007.11.03 20:54:04 | 000,002,577 | ---- | C] () -- C:\Windows\unins000.dat
[2007.11.03 01:30:52 | 000,001,156 | ---- | C] () -- C:\Windows\mozver.dat
[2007.11.02 22:10:23 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat
[2007.11.02 20:41:38 | 000,000,069 | ---- | C] () -- C:\Windows\NeroDigital.ini
[2007.11.02 20:41:36 | 000,076,800 | ---- | C] () -- C:\Users\Fabian\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007.07.25 15:24:30 | 001,559,040 | ---- | C] () -- C:\Windows\System32\xvidcore.dll
[2007.04.14 16:57:06 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelTraditionalChinese.dll
[2007.04.14 16:57:06 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelSwedish.dll
[2007.04.14 16:57:06 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelSpanish.dll
[2007.04.14 16:57:04 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelSimplifiedChinese.dll
[2007.04.14 16:57:04 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelPortugese.dll
[2007.04.14 16:57:04 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelKorean.dll
[2007.04.14 16:57:04 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelJapanese.dll
[2007.04.14 16:57:04 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelGerman.dll
[2007.04.14 16:57:04 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelFrench.dll
[2007.01.01 03:49:06 | 000,000,342 | ---- | C] () -- C:\Windows\{9A3BC157-B94F-4EFD-ABA9-1E56DEB00655}_WiseFW.ini
[2006.11.02 17:33:31 | 000,655,692 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2006.11.02 17:33:31 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2006.11.02 17:33:31 | 000,122,662 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2006.11.02 17:33:31 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2006.11.02 14:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006.11.02 14:47:37 | 002,340,168 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006.11.02 12:33:01 | 000,621,850 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2006.11.02 12:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2006.11.02 12:33:01 | 000,108,934 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2006.11.02 12:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2006.11.02 12:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2006.11.02 10:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006.11.02 10:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006.11.02 09:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2006.11.02 09:22:43 | 000,099,999 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2006.11.02 09:22:43 | 000,018,271 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2006.08.11 10:52:02 | 000,012,288 | ---- | C] () -- C:\Windows\System32\EvOnlDiag.dll
[2006.02.26 16:08:28 | 000,585,728 | ---- | C] () -- C:\Windows\System32\xvidvfw.dll
[2002.07.31 18:32:03 | 000,056,832 | ---- | C] () -- C:\Windows\System32\iyvu9_32.dll
[2000.04.14 17:50:02 | 000,343,040 | ---- | C] () -- C:\Windows\System32\Lffpx7.dll
[1998.06.11 14:08:06 | 000,095,232 | ---- | C] () -- C:\Windows\System32\Lfkodak.dll
 
========== LOP Check ==========
 
[2010.12.24 20:15:31 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\.minecraft
[2007.11.27 22:09:51 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Application Data
[2007.11.29 16:14:08 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Atari
[2007.12.29 21:09:12 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Azureus
[2007.12.23 21:13:22 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Command & Conquer 3 Tiberium Wars
[2007.11.23 19:34:22 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\concept design
[2008.06.21 14:36:08 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Crystal Player
[2010.12.29 22:44:48 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\DAEMON Tools Lite
[2007.12.26 21:43:16 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\DeepBurner
[2011.07.01 11:26:57 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\DVDVideoSoft
[2011.07.01 11:22:35 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\DVDVideoSoftIEHelpers
[2009.11.10 09:56:37 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\FMZilla
[2010.08.10 14:04:03 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\foobar2000
[2010.04.25 00:02:38 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\gtk-2.0
[2011.08.25 21:54:48 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\ICQ
[2007.11.03 00:21:25 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\ICQ Toolbar
[2010.09.17 14:52:39 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\ICQLite
[2008.01.09 21:33:16 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\JLC's Software
[2008.03.12 13:21:29 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Jägermeister RadioPlayer
[2011.08.22 16:36:03 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\kikin
[2009.06.23 13:31:36 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Lern-o-Mat
[2007.11.18 19:21:23 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\lexiCan 2
[2008.03.28 15:28:14 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Netscape
[2008.03.12 21:40:21 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Opera
[2008.01.27 22:57:11 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Ordner HP Share-to-Web
[2007.11.16 21:45:09 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Participatory Culture Foundation
[2007.11.17 00:00:14 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\PCF-VLC
[2007.12.26 23:41:32 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\PeerNetworking
[2008.07.01 09:12:45 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Recorder
[2009.11.02 21:11:08 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Softplicity
[2010.08.10 13:45:08 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Spesoft Audio Converter
[2009.11.08 16:04:31 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\streamripper
[2011.08.22 19:30:51 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Teeworlds
[2007.11.17 17:36:15 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Template
[2007.11.23 15:41:43 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\TrojanHunter
[2011.08.25 19:26:01 | 000,032,638 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2011.08.25 22:00:07 | 000,000,420 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{C27515C3-4436-493B-94A2-3C3CF69BDCC9}.job
 
========== Purity Check ==========
 
 
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 481 bytes -> C:\ProgramData\TEMP:05EE1EEF
@Alternate Data Stream - 106 bytes -> C:\ProgramData\TEMP:DFC5A2B2

< End of report >

hallohallo1 25.08.2011 21:16
Extras

Code:
OTL Extras logfile created on: 25.08.2011 21:56:25 - Run 2
OTL by OldTimer - Version 3.2.26.5    Folder = C:\Users\Fabian\Desktop
Windows Vista Home Premium Edition  (Version = 6.0.6000) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6000.16809)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 1,61 Gb Available Physical Memory | 53,63% Memory free
6,20 Gb Paging File | 4,88 Gb Available in Paging File | 78,72% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 303,35 Gb Total Space | 93,51 Gb Free Space | 30,83% Space Free | Partition Type: NTFS
Drive D: | 149,72 Gb Total Space | 42,77 Gb Free Space | 28,56% Space Free | Partition Type: NTFS
Drive Z: | 995,00 Mb Total Space | 994,99 Mb Free Space | 100,00% Space Free | Partition Type: FAT32
 
Computer Name: FABIAN-PC | User Name: Fabian | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = ChromeHTML] -- Reg Error: Key error. File not found
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
https [open] -- "C:\Program Files\Google\Chrome\Application\chrome.exe" -- "%1"
InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- C:\Program Files\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~2\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Directory [PlayWithVLC] -- C:\Program Files\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] -- "C:\Program Files\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft)
Directory [Winamp.Enqueue] -- "C:\Program Files\Winamp\winamp.exe" /ADD "%1" (Nullsoft)
Directory [Winamp.Play] -- "C:\Program Files\Winamp\winamp.exe" "%1" (Nullsoft)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-1054673845-2891796712-3211906163-1000]
"EnableNotifications" = 0
"EnableNotificationsRef" = 1
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{036AD46C-F133-4870-9973-43F8F1749C05}" = lport=2869 | protocol=6 | dir=in | app=system |
"{0827B1ED-7C0E-46DE-9B68-FE4507996B1B}" = lport=138 | protocol=17 | dir=in | app=system |
"{0D776123-0177-4A44-8CE8-5394DCBCE19F}" = lport=3702 | protocol=17 | dir=in | app=c:\windows\system32\p2phost.exe |
"{0DFF39ED-609F-4F70-A312-977BB4EA4C95}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{0E3EE5EF-F522-4387-80AB-719C4D2C9999}" = lport=3702 | protocol=17 | dir=in | svc=bits | app=c:\windows\system32\svchost.exe |
"{0E9B2B55-907D-4914-B06F-8E5B79D158C2}" = rport=138 | protocol=17 | dir=out | app=system |
"{1759072B-13B7-499D-9B61-612CCC1B3D2D}" = lport=27000 | protocol=6 | dir=in | name=d |
"{1EBEA911-67BE-419C-874F-E1581C565E9A}" = lport=3540 | protocol=17 | dir=in | svc=pnrpsvc | app=c:\windows\system32\svchost.exe |
"{2A278909-A1EA-402A-93CE-300F9EFB6D73}" = rport=137 | protocol=17 | dir=out | app=system |
"{2F7144FB-161C-4466-AFC0-D29C1B7C1454}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=datei- und druckerfreigabe (spoolerdienst - rpc-epmap) |
"{3150F03F-4F16-4A48-8203-A940A6031EFF}" = rport=3702 | protocol=17 | dir=out | app=c:\windows\system32\p2phost.exe |
"{35D8F183-3920-4557-B596-19870DB6DE51}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{36011B8E-B147-4963-A6D2-826484F3082B}" = lport=rpc | protocol=6 | dir=in | svc=bits | app=c:\windows\system32\svchost.exe |
"{435A64E7-0986-45B9-B8E5-94966C533E52}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | app=c:\windows\system32\svchost.exe |
"{439BF87C-C7A6-4CE2-935F-6AD809675F30}" = lport=5353 | protocol=6 | dir=in | name=adobe csi cs4 |
"{4D6A5E9F-143B-44EB-BC4B-FFF9516BE53E}" = lport=2869 | protocol=6 | dir=in | app=system |
"{52AEC027-3A2F-4BF1-BF67-BD24A029AE1A}" = rport=3540 | protocol=17 | dir=out | svc=pnrpsvc | app=c:\windows\system32\svchost.exe |
"{65999647-1C74-4D35-99C1-36CC42D060E0}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=c:\windows\system32\spoolsv.exe |
"{67334780-E818-47DA-827B-1A5B43202C2C}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{6B567DA0-527B-4EF3-8EC9-0211B47F59BF}" = lport=139 | protocol=6 | dir=in | app=system |
"{6FA4AB99-4DB6-4C10-89D9-C88972EA2583}" = lport=5353 | protocol=6 | dir=in | name=adobe csi cs4 |
"{813B975C-3260-4B28-9F16-9F07AEC40D30}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{944D6ECB-DD63-4DE7-84CB-F3959E0E195A}" = rport=139 | protocol=6 | dir=out | app=system |
"{99D470F2-0066-4F55-A9C8-881ACD582D56}" = rport=2178 | protocol=6 | dir=out | app=system |
"{9BEEA4BF-ADBC-43B9-8FCA-FEA9145EE6B7}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
"{AB4B898A-879E-4AFC-9AE5-876285DA4D9E}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
"{AD7FE4B7-98AF-4BFB-AE5D-A90063314809}" = lport=445 | protocol=6 | dir=in | app=system |
"{AEB42302-8669-4D9C-8398-49CF2494882A}" = lport=6884 | protocol=17 | dir=in | name=6884 |
"{B0B4E08D-F005-440A-B8BD-5DB578B6DC5C}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{BC0C8E39-60D1-40F1-AF7F-343E32F4475C}" = rport=3702 | protocol=17 | dir=out | svc=bits | app=c:\windows\system32\svchost.exe |
"{C6BC8FC2-94D7-44ED-924B-F8E405BE3B68}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{C92A54A0-15A1-4E64-AA9F-AF034FBD95D0}" = rport=445 | protocol=6 | dir=out | app=system |
"{C9FBF73F-656A-4369-AE29-1EF0253D3253}" = lport=2178 | protocol=6 | dir=in | app=system |
"{E84AFAE9-1D9C-45C9-9E56-C06E07C385FF}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe |
"{EEF4DA8D-99F4-4E27-80F7-0F1B83C67635}" = lport=137 | protocol=17 | dir=in | app=system |
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{15B7DACE-B63D-4B00-BDE7-38EBE09CD8B8}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{1906B78A-1159-499A-9E4D-2453B77F4950}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |
"{1D561E35-6EBC-45E2-83CE-2A0C2EDEBD93}" = protocol=6 | dir=in | app=c:\windows\system32\p2phost.exe |
"{232CF333-A59B-4C26-A399-E4254B8F9C6D}" = protocol=17 | dir=in | app=c:\program files\icq7.5\icq.exe |
"{23D860D8-52FC-4732-84F6-E3BBA890E6F6}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{27D5C767-A8DE-49D0-A43F-FADB8815438D}" = protocol=6 | dir=in | app=c:\program files\icq7.5\icq.exe |
"{2CA149DF-F520-4730-BCE3-46D689750ECF}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{30D0F232-C116-4A20-A2DE-9B5BC04E7C3B}" = protocol=1 | dir=in | name=datei- und druckerfreigabe (echoanforderung - icmpv4 eingehend) |
"{37FFD9AE-FE98-469F-85B3-55F9F4F35E46}" = protocol=17 | dir=in | app=c:\program files\gamespy arcade\aphex.exe |
"{3C45477E-95C6-408B-B992-7E22911994C6}" = protocol=17 | dir=in | app=c:\program files\common files\adobe\cs4servicemanager\cs4servicemanager.exe |
"{433D1D5A-F129-4D74-8BE6-5A8D33700882}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{435E5788-3302-4210-B920-5255232777BD}" = protocol=58 | dir=in | name=datei- und druckerfreigabe (echoanforderung - icmpv6 eingehend) |
"{4754B88C-2B44-438D-8FF7-FCFF22B00F68}" = protocol=6 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{4A0942E6-2365-44DD-BA0E-77D346AE430D}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{51504434-7621-456C-9571-14825D5F4ABA}" = protocol=6 | dir=in | app=c:\program files\fujitsu siemens computers\fsclounge\fscwbaseupdaterservice\2\fscwbaseupdaterservice.exe |
"{61C7C6D5-891B-4708-A525-0965793F9FDE}" = dir=in | app=c:\program files\windows live\messenger\livecall.exe |
"{771AAC88-87B4-4A32-9A08-EC21885B4603}" = protocol=6 | dir=in | app=c:\program files\common files\adobe\cs4servicemanager\cs4servicemanager.exe |
"{82FBAC0C-7A7E-4A98-8DA6-3B6319EF14BE}" = protocol=6 | dir=out | app=c:\windows\system32\p2phost.exe |
"{8E8B846C-446E-4DEB-8C0D-D7ECF303529E}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{93B56A5A-7FA5-446A-BF6F-140D7A04D42C}" = protocol=6 | dir=in | app=c:\program files\electronic arts\crytek\crysis 2 demo\bin32\crysis2launcher.exe |
"{9562B05F-1968-478E-9FAA-BB70B3439EDD}" = protocol=6 | dir=in | app=c:\program files\icq7.5\icq.exe |
"{96A48BB4-BB84-4D82-8117-8E82664C88C7}" = protocol=17 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{98E66267-3FBC-4BF7-A82E-8747C9DC9AE0}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\groove.exe |
"{9B6D63F1-5909-4231-9198-EB4A1E2E9A33}" = protocol=17 | dir=in | app=c:\program files\icq7.5\icq.exe |
"{A24F9136-82F0-4B84-9696-690EEA537AD8}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{A28EC850-3092-4143-9B94-88A1D2FD3461}" = protocol=6 | dir=in | app=c:\program files\common files\adobe\cs4servicemanager\cs4servicemanager.exe |
"{A3B82801-0D1E-4C35-8A2F-69C76DCC8154}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{A681499F-FFC5-406F-BBF6-4C0C5761C370}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{A9B112C1-8DC6-4119-A805-88E380BEB530}" = protocol=6 | dir=in | app=c:\program files\gamespy arcade\aphex.exe |
"{AB9F5538-F00F-4C8A-BD02-3FC401046CA1}" = dir=in | app=c:\program files\itunes\itunes.exe |
"{B2BDA0AB-BEEC-4BA4-A559-083978D7A417}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{BFF1FE41-2B7D-43F4-ABB0-E3096347F65A}" = protocol=17 | dir=in | app=c:\program files\electronic arts\crytek\crysis 2 demo\bin32\crysis2launcher.exe |
"{CA8FB01D-F1E9-4584-82C6-1F899AF18E04}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{D2C859FB-6AE9-4B51-8047-6D854C1FD5CC}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\groove.exe |
"{D396557A-B10D-433D-8EAF-7F3B0E6ABA09}" = protocol=17 | dir=in | app=c:\program files\common files\adobe\cs4servicemanager\cs4servicemanager.exe |
"{E96972C8-6FBC-4693-868D-25DD48A7FB03}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |
"{F62E7995-EC73-4D64-BD39-301199818FC9}" = protocol=17 | dir=in | app=c:\program files\fujitsu siemens computers\fsclounge\fscwbaseupdaterservice\2\fscwbaseupdaterservice.exe |
"{FCD20E1D-696D-41D7-9BE8-02774CF95EBC}" = protocol=58 | dir=out | name=datei- und druckerfreigabe (echoanforderung - icmpv6 ausgehend) |
"{FEE82F35-479B-4856-95D0-21CEFA9FB224}" = protocol=1 | dir=out | name=datei- und druckerfreigabe (echoanforderung - icmpv4 ausgehend) |
"TCP Query User{257E13E3-4875-4248-B254-0B20E8379C49}C:\program files\aspyr\guitar hero iii\gh3.exe" = protocol=6 | dir=in | app=c:\program files\aspyr\guitar hero iii\gh3.exe |
"TCP Query User{3DF5626D-F4A2-43B8-BC7F-9D4116F33FD0}C:\program files\icq6\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq6\icq.exe |
"TCP Query User{5C31B729-1B71-4381-BE09-1A9900197AFA}C:\program files\pando networks\media booster\pmb.exe" = protocol=6 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"TCP Query User{640A83A8-A2B6-472B-9BE5-31F7B07295FD}C:\program files\real\realplayer\realplay.exe" = protocol=6 | dir=in | app=c:\program files\real\realplayer\realplay.exe |
"TCP Query User{9BC5B727-73F0-4BEE-A7B1-97AD6040F044}C:\program files\zattoo\zattood.exe" = protocol=6 | dir=in | app=c:\program files\zattoo\zattood.exe |
"TCP Query User{AF729254-2EC2-4F2E-A3EE-D650B643879C}C:\program files\electronic arts\eadm\core.exe" = protocol=6 | dir=in | app=c:\program files\electronic arts\eadm\core.exe |
"TCP Query User{B9B2ED80-1CB0-47FA-9F39-D7E425EDD390}C:\users\fabian\desktop\cryptload_1.0.3\routerclient.exe" = protocol=6 | dir=in | app=c:\users\fabian\desktop\cryptload_1.0.3\routerclient.exe |
"TCP Query User{BC6169AD-2DBE-494D-94F5-AB5916DCD08A}C:\program files\lucasarts\star wars battlefront ii\gamedata\battlefrontii.exe" = protocol=6 | dir=in | app=c:\program files\lucasarts\star wars battlefront ii\gamedata\battlefrontii.exe |
"TCP Query User{CEAE6599-A07C-4596-A36D-2F42F63C65CE}C:\program files\icq6\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq6\icq.exe |
"TCP Query User{FB1981AE-E5BB-4345-BED9-E4608B86F654}C:\program files\azureus\azureus.exe" = protocol=6 | dir=in | app=c:\program files\azureus\azureus.exe |
"UDP Query User{08B0AA2C-D956-4203-8012-C2B45786FD33}C:\program files\real\realplayer\realplay.exe" = protocol=17 | dir=in | app=c:\program files\real\realplayer\realplay.exe |
"UDP Query User{100D2469-6D57-43A3-AC65-EE8FF117650A}C:\program files\electronic arts\eadm\core.exe" = protocol=17 | dir=in | app=c:\program files\electronic arts\eadm\core.exe |
"UDP Query User{81608F9D-B034-46B2-9DC8-065455D966A7}C:\program files\zattoo\zattood.exe" = protocol=17 | dir=in | app=c:\program files\zattoo\zattood.exe |
"UDP Query User{9A68E0A5-F49F-4D2C-B8C7-146B8E8E2AF3}C:\program files\lucasarts\star wars battlefront ii\gamedata\battlefrontii.exe" = protocol=17 | dir=in | app=c:\program files\lucasarts\star wars battlefront ii\gamedata\battlefrontii.exe |
"UDP Query User{B0E92103-B06D-4CB1-A9AB-A4E6861C8FF0}C:\program files\icq6\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq6\icq.exe |
"UDP Query User{D27B843C-F33C-4B8F-95E6-63DFFB652B7A}C:\program files\icq6\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq6\icq.exe |
"UDP Query User{DCD3D474-03C1-4A03-9514-EB76E06C534A}C:\program files\aspyr\guitar hero iii\gh3.exe" = protocol=17 | dir=in | app=c:\program files\aspyr\guitar hero iii\gh3.exe |
"UDP Query User{EAB1E2FD-8538-4E65-B3A0-8C352C0AF04F}C:\users\fabian\desktop\cryptload_1.0.3\routerclient.exe" = protocol=17 | dir=in | app=c:\users\fabian\desktop\cryptload_1.0.3\routerclient.exe |
"UDP Query User{EF3FA45A-AB22-41F7-B93D-BAF2EB906ECA}C:\program files\pando networks\media booster\pmb.exe" = protocol=17 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"UDP Query User{EFF85BBF-A16D-4633-9E2C-41F4B19B5D66}C:\program files\azureus\azureus.exe" = protocol=17 | dir=in | app=c:\program files\azureus\azureus.exe |
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{01521746-02A6-4A72-00BD-A285DF6B80C6}" = Die Sims 2: Wilde Campus-Jahre
"{05308C4E-7285-4066-BAE3-6B50DA6ED755}" = Adobe Update Manager CS4
"{07FCBED5-94C3-4F94-B9D3-360FA27C7B06}" = Microsoft Windows SDK for Visual Studio 2008 Express Tools for Win32
"{086BADF8-9B1F-4E89-B207-2EDA520972D6}" = Grand Theft Auto San Andreas
"{098727E1-775A-4450-B573-3F441F1CA243}" = kuler
"{098A2A49-7CF3-4F08-A38D-FB879117152A}" = Adobe Color NA Extra Settings CS4
"{0AFC9710-5DD6-4C6A-BA52-91AE992B2C9D}" = Safari
"{0D6013AB-A0C7-41DC-973C-E93129C9A29F}" = Adobe Color JA Extra Settings CS4
"{0D67A4E4-5BE0-4C9A-8AD8-AB552B433F23}" = Adobe Setup
"{0DC0E85F-36E4-463B-B3EA-4CD8ED2222A1}" = Adobe Color EU Recommended Settings CS4
"{0E2B767B-EA6A-489B-BF83-8083FE1DB661}" = Pcsx2 0.9.6
"{0ECB59D5-A3FC-4D61-AD3B-6CE679B3F852}" = Java DB 10.2.2.0
"{0F723FC1-7606-4867-866C-CE80AD292DAF}" = Adobe CSI CS4
"{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter
"{150FEA49-4039-4458-B9D0-F19CC17229FE}" = LEGO Star Wars 2 DEMO
"{1545207E-C6F3-31D7-9918-BDBB65075FBF}" = Microsoft .NET Framework 3.5 Language Pack - deu
"{159098AF-4EB8-4C10-B0C6-24CDA32B45F9}" = Microsoft SQL Server Compact 3.5 DEU
"{1618734A-3957-4ADD-8199-F973763109A8}" = Adobe Anchor Service CS4
"{16E6D2C1-7C90-4309-8EC4-D2212690AAA4}" = AdobeColorCommonSetRGB
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{1BF4CB15-6055-452A-8487-021AE2D91208}" = Crysis® 2 Demo
"{1E05CF2E-BF5F-4A43-9147-2CCBBE57BC3C}_is1" = Mein Gutscheincode Finder 1.0.0.0
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{26A24AE4-039D-4CA4-87B4-2F83216019FF}" = Java(TM) 6 Update 19
"{28F11027-A8BC-44D3-A59A-CA018ED73E8C}" = Compact&Easy
"{2CE5A2E7-3437-4CE7-BCF4-85ED6EEFF9E4}" = iTunes
"{2FC099BD-AC9B-33EB-809C-D332E1B27C40}" = Microsoft .NET Framework 3.5
"{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform
"{3248F0A8-6813-11D6-A77B-00B0D0160030}" = Java(TM) 6 Update 3
"{32A3A4F4-B792-11D6-A78A-00B0D0160030}" = Java(TM) SE Development Kit 6 Update 3
"{3571656A-575D-4CED-809D-5547587121FF}" = Yu-Gi-Oh! Power of Chaos YUGI THE DESTINY
"{35D94F92-1D3A-43C5-8605-EA268B1A7BD9}" = PDF Settings CS4
"{39D0E034-1042-4905-BECB-5502909FCB7C}" = Microsoft Works
"{3A4E8896-C2E7-4084-A4A4-B8FD1894E739}" = Adobe XMP Panels CS4
"{3D2C9DE6-9ADE-4252-A241-E43723B0CE02}" = Adobe Color - Photoshop Specific CS4
"{3DA8DF9A-044E-46C4-8531-DEDBB0EE37FF}" = Adobe WinSoft Linguistics Plugin
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{415CDA53-9100-476F-A7B2-476691E117C7}" = HP Smart Web Printing
"{45235788-142C-44BE-8A4D-DDE9A84492E5}" = AGEIA PhysX v7.09.13
"{4817189D-1785-4627-A33C-39FD90919300}" = Die Sims™ 2 Haustiere
"{487B0B9B-DCD4-440D-89A0-A6EDE1A545A3}" = HPSSupply
"{4943EFF5-229F-435D-BEA9-BE3CAEA783A7}" = Adobe Service Manager Extension
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4E074808-1B86-4230-A9EB-0904942EC4AE}" = LEGO Star Wars II
"{52B97218-98CB-4B8B-9283-D213C85E1AA4}" = Windows Live Anmelde-Assistent
"{543E938C-BDC4-4933-A612-01293996845F}" = UnloadSupport
"{56403FFF-145E-35C5-A090-96598BE57FB8}" = Microsoft Visual Basic 2008 Express Edition - DEU
"{5E0D2061-86AB-4B83-A671-A0BF3FF1537B}_is1" = Vokabel Trainer 5
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{63C24A08-70F3-4C8E-B9FB-9F21A903801D}" = Adobe Color Video Profiles CS CS4
"{63E5CDBF-8214-4F03-84F8-CD3CE48639AD}" = Adobe Photoshop CS4 Support
"{63E921D9-799A-44F9-A742-DE3DC968AFEF}" = Microsoft .NET Framework SDK (German) 1.1
"{6522C636-B04C-4333-9BEB-9E0C0B6350D6}" = Die Sims™ 2 Küchen- und Bad-Einrichtungs-Accessoires
"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
"{68243FF8-83CA-466B-B2B8-9F99DA5479C4}" = AdobeColorCommonSetCMYK
"{68A35043-C55A-4237-88C9-37EE1C63ED71}" = Microsoft Visual J# 2.0 Redistributable Package
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6BDD9CE6-D0A6-478A-BAD3-BA6945E89EB0}" = Die Sims 2: Family Fun - Accessoires
"{72263053-50D1-4598-9502-51ED64E54C51}" = Borland Delphi 7
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7578ADEA-D65F-4C89-A249-B1C88B6FFC20}" = ICQ7.5
"{7B3577F5-1D82-4C9B-008B-69D026FD8BCA}" = Die Sims 2: Open For Business
"{7BE667F1-6643-4469-A830-6C360B1A036F}" = Movavi VideoSuite 5
"{81CD6232-10F5-4832-B3DA-1B88B1571031}" = Nero 7 Essentials
"{820D3F45-F6EE-4AAF-81EF-CE21FF21D230}" = Adobe Type Support CS4
"{83877DB1-8B77-45BC-AB43-2BAC22E093E0}" = Adobe Bridge CS4
"{842B4B72-9E8F-4962-B3C1-1C422A5C4434}" = Suite Shared Configuration CS4
"{84DDE556-43EF-43ed-B2DF-37AF9E5DDD75}" = Die Sims™ 2 H&M®-Fashion-Accessoires
"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar
"{87F6C83D-F949-4d14-B5CB-DC8C75F8932D}" = Die Sims™ 2 Freizeit-Spaß
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A7CAA24-7B23-410B-A7C3-F994B0944160}" = Microsoft Virtual PC 2007
"{8E6A3B40-DCE3-47D9-835B-FE1AD9C083D0}" = Crazy Machines
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0015-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_ENTERPRISE_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{926CC8AE-8414-43DF-8EB4-CF26D9C3C663}" =
"{90120000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2007
"{90120000-0044-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_ENTERPRISE_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2007
"{90120000-00BA-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0114-0409-0000-0000000FF1CE}" = Microsoft Office Groove Setup Metadata MUI (English) 2007
"{90120000-0114-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_ENTERPRISE_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{931AB7EA-3656-4BB7-864D-022B09E3DD67}" = Adobe Linguistics CS4
"{94D398EB-D2FD-4FD1-B8C4-592635E8A191}" = Adobe CMaps CS4
"{94D66D71-12F0-48A5-B46A-D4B835A0F1B7}" = FirstSteps Diagnostics
"{95120000-00AF-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (German)
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{975E4CAE-D408-48DA-9346-65D7DB72B7DE}" = Hama Double Action Air Grip
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9A3BC157-B94F-4EFD-ABA9-1E56DEB00655}" = FSCLounge
"{9CDBC303-3EED-40b0-8E41-A7C65AA96C26}" = Die Sims™ 2: Glamour-Accessoires
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AB40272D-92AB-4F30-B36B-22EDE16F8FE5}" = HP Update
"{AC76BA86-7AD7-1031-7B44-A81000000003}" = Adobe Reader 8.1.1 - Deutsch
"{AC816492-1A38-47FA-975E-D5BDAD8ADCAB}" = Lern-o-Mat
"{AEBBFC67-7A03-4DF3-9E71-BA5C9EB4FBEF}" = MobileMe Control Panel
"{AED2DD42-9853-407E-A6BC-8A1D6B715909}" = Windows Live Messenger
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B29AD377-CC12-490A-A480-1452337C618D}" = Connect
"{B3FED300-806C-11E0-A0D0-B8AC6F97B88E}" = Google Earth
"{B639110D-747F-40DC-9682-95D94EF73790}" = dj_sf_software
"{B65BA85C-0A27-4BC0-A22D-A66F0E5B9494}" = Adobe Photoshop CS4
"{B6F5B704-06D3-4687-90F3-6195304AD755}" = Die Sims™ 2 Apartment-Leben
"{BB4E33EC-8181-4685-96F7-8554293DEC6A}" = Adobe Output Module
"{C07B8BC4-AFD9-3AA4-BDF5-330A07591FDE}" = Microsoft Windows SDK for Visual Studio 2008 Express Tools for .NET Framework
"{C52E3EC1-048C-45E1-8D53-10B0C6509683}" = Adobe Default Language CS4
"{CAFA57E8-8927-4912-AFCF-B0AA3837E989}" = Windows Live Essentials
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CBA2E782-C278-4B81-008D-4703FCBC1A2E}" = SimCity 4
"{CC75AB5C-2110-4A7F-AF52-708680D22FE8}" = Photoshop Camera Raw
"{CCA1EEA3-555E-4D05-AC46-4B49C6C5D887}" = Apple Mobile Device Support
"{CCD90636-D97D-4130-A44A-3AD4E63B9220}" = OpenOffice.org 2.4
"{D2041A37-5FEC-49F0-AE5C-3F2FFDFAA4F4}" = Windows Live Call
"{D7D50E0C-27DD-4999-BC05-E026B580F93A}" = Electronic Arts Product Registration
"{DAEAFD68-BB4A-4507-A241-C8804D2EA66D}" = Apple Application Support
"{DBA4DB9D-EE51-4944-A419-98AB1F1249C8}" = LiveUpdate Notice (Symantec Corporation)
"{DFEF49D9-FC95-4301-99B9-2FB91C6ABA06}" = Die Sims™ 2 Vier Jahreszeiten
"{E32260E7-0B10-43C7-9B77-AB9F4184676D}" = Microsoft SQL Server Compact 3.5 Design Tools DEU
"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime
"{E4848436-0345-47E2-B648-8B522FCDA623}" = Adobe Photoshop CS4
"{E7004147-2CCA-431C-AA05-2AB166B9785D}" = QuickTime
"{E914A24F-2412-4374-B420-86D21D6D444A}" = LEGO Star Wars
"{EAA38532-7AD0-4f78-918A-4F4F02096ECE}" = Die Sims™ 2 Party-Accessoires
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F0E64E2E-3A60-40D8-A55D-92F6831875DA}" = Adobe Search for Help
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F248ADFA-64E0-4b03-8A83-059078BED6A0}" = Die Sims™ 2 Gute Reise
"{F54AC413-D2C6-4A24-B324-370C223C6250}" = Adobe Photoshop Elements 6.0
"{F7529650-B9DB-481B-0089-A2AC3C2821C1}" = Die Sims 2: Nightlife
"{F7D1D93A-B17A-41F8-9070-0B2A544C6165}" = LEGO Star Wars Demo Disc
"{F8EF2B3F-C345-4F20-8FE4-791A20333CD5}" = Adobe ExtendScript Toolkit CS4
"{F93C84A6-0DC6-42AF-89FA-776F7C377353}" = Adobe PDF Library Files CS4
"{FB26A501-6BA6-459B-89AA-9736730752FB}" = VoiceOver Kit
"{FB706A00-C234-4716-AB1F-27DCB192C664}" = Opera 9.26
"{FCDD51BB-CAD0-4BB1-B7DF-CE86D1032794}" = Adobe Fonts All
"{FF1C31AE-0CDC-40CE-AB85-406F8B70D643}" = Bonjour
"{FF29527A-44CD-3422-945E-981A13584000}" = VC Runtimes MSI
"AC3Filter" = AC3Filter (remove only)
"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Photoshop Elements 6" = Adobe Photoshop Elements 6.0
"Adobe_faf656ef605427ee2f42989c3ad31b8" = Adobe Photoshop CS4
"Age of Empires 2.0" = Microsoft Age of Empires II
"AntiVir PersonalEdition Classic" = Avira AntiVir Personal - Free Antivirus
"AnyToISO_is1" = AnyToISO
"Audacity_is1" = Audacity 1.2.6
"B991B020-2968-11D8-AF23-444553540000_is1" = FreeMind
"Bananarama" = Bananarama
"CCleaner" = CCleaner
"Cheat Engine 5.6.1_is1" = Cheat Engine 5.6.1
"Delphi5" = Borland Delphi 5
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"DivX Setup.divx.com" = DivX-Setup
"Dungeon Keeper 2" = Dungeon Keeper 2
"DVDVideoSoftTB Toolbar" = DVDVideoSoftTB Toolbar
"Efficient WMA MP3 Converter_is1" = Efficient WMA MP3 Converter v0.99.2
"Elecard MPEG-2 Decoder&Streaming Plug-in for WMP 3.7.90209" = Elecard MPEG-2 Decoder&Streaming Plug-in for WMP
"ENTERPRISE" = Microsoft Office Enterprise 2007
"Folder Access 2.1 Free Version" = Folder Access 2.1 Free Version
"foobar2000" = foobar2000 v1.0.3
"Forte Free" = Forte Free 2.0
"Fraps" = Fraps
"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.4
"Free Audio Converter_is1" = Free Audio Converter version 2.0
"Free YouTube Download 3_is1" = Free YouTube Download 3 version 3.0.3.622
"Free YouTube Download_is1" = Free YouTube Download 2.9
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.9.40.602
"Freez FLV to MP3 Converter v1.5_is1" = Freez FLV to MP3 Converter
"GameWiz32" = GameWiz32
"GeoGebra" = GeoGebra
"GTA2" = GTA2
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"HyperCam 2" = HyperCam 2
"ICQToolbar" = ICQ Toolbar
"InstallShield_{150FEA49-4039-4458-B9D0-F19CC17229FE}" = LEGO Star Wars 2 DEMO
"InstallShield_{D7D50E0C-27DD-4999-BC05-E026B580F93A}" = Electronic Arts Product Registration
"InstallShield_{E914A24F-2412-4374-B420-86D21D6D444A}" = LEGO Star Wars
"InstallShield_{F7D1D93A-B17A-41F8-9070-0B2A544C6165}" = LEGO Star Wars Demo Disc
"ISO Commander" = ISO Commander 1.6 (remove only)
"JDownloader" = JDownloader
"LastFM_is1" = Last.fm 1.5.4.27091
"Lazarus_is1" = Lazarus 0.9.22
"LiveUpdate" = LiveUpdate 3.2 (Symantec Corporation)
"Luxor Amun Rising" = Luxor Amun Rising (remove only)
"Macro Express 3" = Macro Express 3
"Magic FLAC to MP3 Converter_is1" = Magic FLAC to MP3 Converter 3.72
"Mahjong Towers Eternity EU" = Mahjong Towers Eternity EU (remove only)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware Version 1.51.1.1800
"Master_is1" = Master 2.3 Freeware
"Microsoft .NET Framework 1.1  (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5" = Microsoft .NET Framework 3.5
"Microsoft .NET Framework 3.5 Language Pack - deu" = Microsoft .NET Framework 3.5 Language Pack - DEU
"Microsoft Visual Basic 2005 Express Edition - DEU" = Microsoft Visual Basic 2005 Express Edition - DEU
"Microsoft Visual Basic 2008 Express Edition - DEU" = Microsoft Visual Basic 2008 Express Edition - DEU
"Microsoft Visual J# 2.0 Redistributable Package" = Microsoft Visual J# 2.0 Redistributable Package
"Mozilla Firefox (3.6.20)" = Mozilla Firefox (3.6.20)
"MTS2_ColourOptions_is1" = Colour Options 2.0 (beta) for The Sims 2 (and Sims 2 University
"Mystery Case Files - Prime Suspects" = Mystery Case Files - Prime Suspects (remove only)
"Netscape Navigator (9.0.0.6)" = Netscape Navigator (9.0.0.6)
"NSS" = Norton Security Scan
"NVIDIA Drivers" = NVIDIA Drivers
"OJOsoft Audio Converter_is1" = OJOsoft Audio Converter
"OpenAL" = OpenAL
"Poker Superstars II" = Poker Superstars II (remove only)
"PowerISO" = PowerISO
"RealPlayer 6.0" = RealPlayer
"SimCity 3000" = SimCity 3000
"Softonic_Deutsch Toolbar" = Softonic_Deutsch Toolbar
"Spesoft Audio Converter_is1" = Spesoft Audio Converter 2.30
"Streamripper" = Streamripper (Remove only)
"Super_nude_patch_II_1.0" = Super nude patch II 2.8
"Theme Park World" = Theme Park World
"TIPP10_is1" = TIPP10 Version 2.0.3
"Uninstall_is1" = Uninstall 1.0.0.1
"VLC media player" = VideoLAN VLC media player 0.8.6h
"WAV to MP3" = WAV to MP3
"Winamp" = Winamp
"WinLiveSuite_Wave3" = Windows Live Essentials
"Winload Toolbar" = Winload Toolbar
"WinRAR archiver" = WinRAR
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Amazon Kindle" = Amazon Kindle
"Google Chrome" = Google Chrome
"Muziic Player & Encoder" = Muziic Player & Encoder
"UnityWebPlayer" = Unity Web Player
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 24.08.2011 14:04:15 | Computer Name = Fabian-PC | Source = Bonjour Service | ID = 100
Description = 392: ERROR: read_msg errno 10054 (Eine vorhandene Verbindung wurde
 vom Remotehost geschlossen.)
 
Error - 25.08.2011 08:26:17 | Computer Name = Fabian-PC | Source = WerSvc | ID = 5007
Description =
 
Error - 25.08.2011 12:49:40 | Computer Name = Fabian-PC | Source = WerSvc | ID = 5007
Description =
 
Error - 25.08.2011 13:25:17 | Computer Name = Fabian-PC | Source = Bonjour Service | ID = 100
Description = 384: ERROR: read_msg errno 10054 (Eine vorhandene Verbindung wurde
 vom Remotehost geschlossen.)
 
Error - 25.08.2011 13:25:17 | Computer Name = Fabian-PC | Source = Bonjour Service | ID = 100
Description = 392: ERROR: read_msg errno 10054 (Eine vorhandene Verbindung wurde
 vom Remotehost geschlossen.)
 
Error - 25.08.2011 13:25:17 | Computer Name = Fabian-PC | Source = Bonjour Service | ID = 100
Description = 388: ERROR: read_msg errno 10054 (Eine vorhandene Verbindung wurde
 vom Remotehost geschlossen.)
 
Error - 25.08.2011 13:25:17 | Computer Name = Fabian-PC | Source = Bonjour Service | ID = 100
Description = 376: ERROR: read_msg errno 10054 (Eine vorhandene Verbindung wurde
 vom Remotehost geschlossen.)
 
Error - 25.08.2011 13:32:42 | Computer Name = Fabian-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =
 
Error - 25.08.2011 13:32:44 | Computer Name = Fabian-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =
 
Error - 25.08.2011 14:26:58 | Computer Name = Fabian-PC | Source = WerSvc | ID = 5007
Description =
 
[ Media Center Events ]
Error - 13.12.2010 17:33:55 | Computer Name = Fabian-PC | Source = Media Center Guide | ID = 13
Description = Ereignisinformationen: Fehler beim Downloaden neuer TV-Programmdaten.
 Überprüfen Sie die Internetverbindungseinstellungen. Wenn die Verbindung über einen
 Firewall oder Proxyserver hergestellt wird, stellen Sie sicher, dass dieser ordnungsgemäß
 konfiguriert ist. Prozess: DefaultDomain Objektname: Microsoft.Ehome.Epg.EhepgdatSingleton

 
Error - 25.12.2010 10:00:53 | Computer Name = Fabian-PC | Source = Media Center Guide | ID = 13
Description = Ereignisinformationen: Fehler beim Downloaden neuer TV-Programmdaten.
 Überprüfen Sie die Internetverbindungseinstellungen. Wenn die Verbindung über einen
 Firewall oder Proxyserver hergestellt wird, stellen Sie sicher, dass dieser ordnungsgemäß
 konfiguriert ist. Prozess: DefaultDomain Objektname: Microsoft.Ehome.Epg.EhepgdatSingleton

 
Error - 04.02.2011 10:01:44 | Computer Name = Fabian-PC | Source = Media Center Guide | ID = 34
Description = Ereignisinformationen: Ermittlungsdienst: Unerwarteter Fehler. Der
 TV-Programmlistendienst ist zurzeit nicht verfügbar. Wiederholen Sie den Vorgang
 später. Prozess: DefaultDomain Objektname: Microsoft.Ehome.Epg.EhepgdatSingleton
 
Error - 16.02.2011 11:27:29 | Computer Name = Fabian-PC | Source = Media Center Guide | ID = 13
Description = Ereignisinformationen: Fehler beim Downloaden neuer TV-Programmdaten.
 Überprüfen Sie die Internetverbindungseinstellungen. Wenn die Verbindung über einen
 Firewall oder Proxyserver hergestellt wird, stellen Sie sicher, dass dieser ordnungsgemäß
 konfiguriert ist. Prozess: DefaultDomain Objektname: Microsoft.Ehome.Epg.EhepgdatSingleton

 
Error - 16.02.2011 11:27:29 | Computer Name = Fabian-PC | Source = Media Center Guide | ID = 13
Description = Ereignisinformationen: Fehler beim Downloaden neuer TV-Programmdaten.
 Überprüfen Sie die Internetverbindungseinstellungen. Wenn die Verbindung über einen
 Firewall oder Proxyserver hergestellt wird, stellen Sie sicher, dass dieser ordnungsgemäß
 konfiguriert ist. Prozess: DefaultDomain Objektname: Microsoft.Ehome.Epg.EhepgdatSingleton

 
Error - 24.02.2011 11:35:52 | Computer Name = Fabian-PC | Source = Media Center Guide | ID = 4
Description = Ereignisinformationen: Unbekannter Verbindungsfehler. Windows Media
 Center konnte keine Internetverbindung herstellen. Weitere Informationen finden
 Sie in der Hilfe. Prozess: DefaultDomain Objektname: Microsoft.Ehome.Epg.EhepgdatSingleton

 
Error - 04.03.2011 07:31:20 | Computer Name = Fabian-PC | Source = Media Center Guide | ID = 4
Description = Ereignisinformationen: Unbekannter Verbindungsfehler. Windows Media
 Center konnte keine Internetverbindung herstellen. Weitere Informationen finden
 Sie in der Hilfe. Prozess: DefaultDomain Objektname: Microsoft.Ehome.Epg.EhepgdatSingleton

 
Error - 22.03.2011 10:00:17 | Computer Name = Fabian-PC | Source = Media Center Guide | ID = 0
Description = Ereignisinformationen: ERROR: SqmApiWrapper.TimerRecord failed; Win32
 GetLastError returned 10000105  Prozess: DefaultDomain Objektname: Media Center Guide

 
Error - 14.04.2011 11:32:31 | Computer Name = Fabian-PC | Source = Media Center Guide | ID = 0
Description = Ereignisinformationen: ERROR: SqmApiWrapper.TimerRecord failed; Win32
 GetLastError returned 10000105  Prozess: DefaultDomain Objektname: Media Center Guide

 
Error - 07.07.2011 09:49:00 | Computer Name = Fabian-PC | Source = Media Center Guide | ID = 0
Description = Ereignisinformationen: ERROR: SqmApiWrapper.TimerRecord failed; Win32
 GetLastError returned 10000105  Prozess: DefaultDomain Objektname: Media Center Guide

 
[ System Events ]
Error - 25.08.2011 07:25:51 | Computer Name = Fabian-PC | Source = ACPI | ID = 327686
Description = IRQARB: ACPI-BIOS enthält keinen IRQ für das Gerät im PCI-Steckplatz
 7, Funktion 0.  Wenden Sie sich an den Systemhersteller, um technische Unterstützung
 zu erhalten.
 
Error - 25.08.2011 07:27:03 | Computer Name = Fabian-PC | Source = Service Control Manager | ID = 7000
Description =
 
Error - 25.08.2011 07:27:03 | Computer Name = Fabian-PC | Source = Service Control Manager | ID = 7000
Description =
 
Error - 25.08.2011 11:49:10 | Computer Name = Fabian-PC | Source = ACPI | ID = 327686
Description = IRQARB: ACPI-BIOS enthält keinen IRQ für das Gerät im PCI-Steckplatz
 2, Funktion 0.  Wenden Sie sich an den Systemhersteller, um technische Unterstützung
 zu erhalten.
 
Error - 25.08.2011 11:49:10 | Computer Name = Fabian-PC | Source = ACPI | ID = 327686
Description = IRQARB: ACPI-BIOS enthält keinen IRQ für das Gerät im PCI-Steckplatz
 7, Funktion 0.  Wenden Sie sich an den Systemhersteller, um technische Unterstützung
 zu erhalten.
 
Error - 25.08.2011 11:50:27 | Computer Name = Fabian-PC | Source = Service Control Manager | ID = 7000
Description =
 
Error - 25.08.2011 11:50:27 | Computer Name = Fabian-PC | Source = Service Control Manager | ID = 7000
Description =
 
Error - 25.08.2011 13:25:15 | Computer Name = Fabian-PC | Source = Service Control Manager | ID = 7034
Description =
 
Error - 25.08.2011 13:27:42 | Computer Name = Fabian-PC | Source = Service Control Manager | ID = 7000
Description =
 
Error - 25.08.2011 13:27:42 | Computer Name = Fabian-PC | Source = Service Control Manager | ID = 7000
Description =
 
 
< End of report >

So. Hoffe, dass das hilfreich war und ihr mir helfen könnt. Wäre super.
Liebe Grüße Fabian :)

hallohallo1 28.08.2011 10:04
Hi nochmal. Ich will ja wirklich nicht nerven aber der Thread war ja schon auf Seite 3. Aber könnt ihr mir denn nicht helfen oder so? :(
Ich kann ja verstehen, dass das schwer ist aufgrund der Menge von Zuschriften hier aber trotzdem :(

cosinus 29.08.2011 12:42
Es steht hier überall, dass du den Thread nicht pushen oder dir selbst antworten sollst. Tust es doch, wird er als "in Arbeit" gesehen und nicht weiter beachtet, er erscheint dann auch nciht mehr in der Liste der unbeantworteten Themen.

Zitat:
Ich habe alle in einem anderen Post beschrieben Schritte erledigt:
Du kannst nicht auf individuell auf einem Rechner zugeschnitttene Fixes auf deinen übertagen! Warum machst du was?!

hallohallo1 29.08.2011 22:10
Da hat jemand einfach was total vages gepostet von wegen "hab bka-trojaner" und die anweisung bekommen, die im übrigen auch paar weitere genau so bekommen haben... was ist daran individuell zugeschnitten?

aber tut mir leid, wenn es falsch war...

cosinus 30.08.2011 10:06
Gibt es noch weitere Logs von Malwarebytes? Wenn ja bitte alle posten, die in Malwarebytes im Reiter Logdateien sichtbar sind.

hallohallo1 30.08.2011 12:38
Ja. Es gibt noch ca. 15 weitere. Aber die sind alle nicht von 2011. Trotzdem posten?

cosinus 30.08.2011 15:24
Nee lass mal :D

Führe auch bitte ESET aus, danach sehen wir weiter.


ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

n.

hallohallo1 01.09.2011 20:59
So. Das sagt die log-datei:

Code:
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6528
# api_version=3.0.2
# EOSSerial=7a48f6434ad31d4989117994f2c86a79
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-09-01 07:57:14
# local_time=2011-09-01 09:57:14 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.0.6000 NT
# compatibility_mode=512 16777215 100 0 31376586 31376586 0 0
# compatibility_mode=1792 16777195 100 0 119130417 119130417 0 0
# compatibility_mode=2560 16777215 100 0 0 0 0 0
# compatibility_mode=5892 16776573 100 100 76735078 152425969 0 0
# compatibility_mode=8192 67108863 100 0 152 152 0 0
# scanned=324290
# found=11
# cleaned=0
# scan_time=13793
C:\Users\Fabian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\12\1dd6a40c-617b9dca        multiple threats (unable to clean)        00000000000000000000000000000000        I
C:\Users\Fabian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\3\974d443-44b4cfd1        probably a variant of Java/TrojanDownloader.Agent.AB trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Fabian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\47\140bd1ef-2391d66f        a variant of Java/Exploit.Agent.NAL trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Fabian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\49\1eff1eb1-2fd1f8ec        Java/TrojanDownloader.Agent.NBL trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Fabian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\54\694a16f6-20060773        multiple threats (unable to clean)        00000000000000000000000000000000        I
C:\Users\Fabian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\54\694a16f6-4c33b3ea        multiple threats (unable to clean)        00000000000000000000000000000000        I
C:\Users\Fabian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\55\44342237-155183ac        Java/Exploit.Agent.NAJ trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Fabian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\55\44342237-3767c220        Java/Exploit.Agent.NAJ trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Fabian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\56\e668b8-3fab79d9        multiple threats (unable to clean)        00000000000000000000000000000000        I
C:\Users\Fabian\Documents\ICQ\382996850\ReceivedFiles\373710178 zorro79\RSD 0.587\RSD 0.587\ccf2rsdf.exe        probably a variant of Win32/Agent.MXEKFBP trojan (unable to clean)        00000000000000000000000000000000        I
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\55\2b70da77-27c687e4        multiple threats (unable to clean)        00000000000000000000000000000000        I

cosinus 01.09.2011 21:06
Zitat:
C:\Users\Fabian\Documents\ICQ\382996850\ReceivedFiles\373710178 zorro79\RSD 0.587\RSD 0.587\ccf2rsdf.exe
Was für ein Mist ist das denn schon wieder? :balla:

hallohallo1 01.09.2011 21:59
Hab ich gerade gelöscht. Aber das ist locker mal 2,5 Jahre alt

cosinus 01.09.2011 22:25
Was das ist, wird damit aber nicht gerade erklärt :pfeiff:

hallohallo1 02.09.2011 07:48
Weiß nicht mehr, was das ist. Aber finde es reichlich seltsam, dass das jetzt als ne Art Malware angezeigt wird :wtf:
Und was ist mit dem Rest?

cosinus 02.09.2011 10:04
Zitat:
O3 - HKLM\..\Toolbar: (Winload Toolbar) - {40c3cc16-7269-4b32-9531-17f2950fb06f} - C:\Programme\Winload\prxtbWinl.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (no name) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - No CLSID value found.
O3 - HKLM\..\Toolbar: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\tbDVDV.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Softonic Deutsch Toolbar) - {8dbb6d8e-e4a6-4e3b-9753-af78b226441c} - C:\Programme\Softonic_Deutsch\prxtbSof2.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Softonic Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (DVDVideoSoftTB Toolbar) - {872B5B88-9DB5-4310-BDD0-AC189557E5F5} - C:\Programme\DVDVideoSoftTB\tbDVDV.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (Softonic Deutsch Toolbar) - {8DBB6D8E-E4A6-4E3B-9753-AF78B226441C} - C:\Programme\Softonic_Deutsch\prxtbSof2.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (Softonic Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)

Warum vermüllst du dir das System mit diesen nutzlosen Toolbars? :balla:

Am besten alle nutzlosen Toolbars deinstallieren. Dabei helfen können dir Ask Toolbar Remover und Multi Toolbar Remover:

http://www.chip.de/downloads/ASK-Too..._43117721.html
http://www.chip.de/downloads/Multi-T..._43155841.html


Deinstalliere bei der Gelegenheit auch alle anderen unnötigen Programme über die Systemsteuerung.

hallohallo1 02.09.2011 13:02
Glaube die Toolbars sind noch fast alle da und wurden nich wirklich gelöscht o.O

Aber hab insgesamt locker mal 50 Dinger bei Systemsteuerung -> Programme und Funktionen gelöscht^^
Was nun? Neuer Eset check?

cosinus 02.09.2011 13:55
Mach bitte ein neues CustomLog:

CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
Code:
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT

hallohallo1 02.09.2011 16:03
Fertig.

Code:
OTL logfile created on: 02.09.2011 16:34:04 - Run 3
OTL by OldTimer - Version 3.2.26.5    Folder = C:\Users\Fabian\Desktop
Windows Vista Home Premium Edition  (Version = 6.0.6000) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6000.16809)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 2,06 Gb Available Physical Memory | 68,83% Memory free
6,20 Gb Paging File | 5,29 Gb Available in Paging File | 85,46% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 303,35 Gb Total Space | 97,17 Gb Free Space | 32,03% Space Free | Partition Type: NTFS
Drive D: | 149,72 Gb Total Space | 42,77 Gb Free Space | 28,56% Space Free | Partition Type: NTFS
Drive Z: | 995,00 Mb Total Space | 994,99 Mb Free Space | 100,00% Space Free | Partition Type: FAT32
 
Computer Name: FABIAN-PC | User Name: Fabian | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2011.08.23 19:18:44 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Users\Fabian\Desktop\OTL.exe
PRC - [2010.04.13 00:46:36 | 001,135,912 | ---- | M] () -- C:\Programme\DivX\DivX Update\DivXUpdate.exe
PRC - [2009.11.03 16:42:05 | 002,923,192 | ---- | M] () -- C:\Programme\Pando Networks\Media Booster\PMB.exe
PRC - [2008.10.29 08:20:29 | 002,923,520 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2008.10.25 12:44:34 | 000,031,072 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft Office\Office12\GrooveMonitor.exe
PRC - [2008.07.21 14:24:44 | 000,068,865 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe
PRC - [2008.07.21 14:24:40 | 000,266,497 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe
PRC - [2008.07.21 14:24:40 | 000,149,761 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe
PRC - [2008.02.26 17:24:06 | 004,939,776 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe
PRC - [2008.01.29 17:38:32 | 000,583,048 | ---- | M] (Symantec Corporation) -- C:\Programme\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
PRC - [2008.01.18 15:26:17 | 000,185,896 | ---- | M] (RealNetworks, Inc.) -- C:\Programme\Common Files\Real\Update_OB\realsched.exe
PRC - [2008.01.09 22:55:56 | 001,232,896 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Sidebar\sidebar.exe
PRC - [2007.09.26 11:53:56 | 000,554,352 | ---- | M] (Symantec Corporation) -- C:\Programme\Symantec\LiveUpdate\AluSchedulerSvc.exe
PRC - [2007.05.28 18:57:54 | 000,275,968 | ---- | M] (Rocket Division Software) -- C:\Programme\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
PRC - [2007.01.01 01:36:01 | 001,006,264 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Defender\MSASCui.exe
PRC - [2006.11.02 14:35:35 | 000,176,128 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wpcumi.exe
PRC - [2003.03.19 10:55:56 | 000,335,872 | ---- | M] (Microsoft Corporation) -- C:\Programme\Common Files\microsoft shared\VS7Debug\mdm.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2010.04.13 00:46:46 | 000,095,528 | ---- | M] () -- C:\Programme\DivX\DivX Update\DivXUpdateCheck.dll
MOD - [2010.04.13 00:46:36 | 001,135,912 | ---- | M] () -- C:\Programme\DivX\DivX Update\DivXUpdate.exe
MOD - [2009.11.03 16:42:05 | 002,923,192 | ---- | M] () -- C:\Programme\Pando Networks\Media Booster\PMB.exe
MOD - [2009.09.05 00:15:06 | 000,067,872 | ---- | M] () -- C:\Programme\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2007.09.20 19:34:58 | 000,129,024 | ---- | M] () -- C:\Programme\WinRAR\RarExt.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - File not found [Auto | Stopped] --  -- (sdCoreService)
SRV - File not found [Auto | Stopped] --  -- (sdAuxService)
SRV - File not found [On_Demand | Stopped] --  -- (osagent)
SRV - File not found [On_Demand | Stopped] --  -- (oad)
SRV - File not found [Disabled | Stopped] --  -- (NMIndexingService)
SRV - File not found [Auto | Stopped] --  -- (LiveUpdate Notice Ex)
SRV - File not found [Auto | Stopped] --  -- (LckFldService)
SRV - File not found [Auto | Stopped] --  -- (CLTNetCnService)
SRV - [2010.05.01 19:48:37 | 000,655,624 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2008.07.21 14:24:44 | 000,068,865 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe -- (AntiVirScheduler)
SRV - [2008.07.21 14:24:40 | 000,149,761 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe -- (AntiVirService)
SRV - [2008.01.29 17:38:32 | 000,583,048 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe -- (LiveUpdate Notice Service)
SRV - [2007.09.26 11:53:56 | 002,999,664 | ---- | M] (Symantec Corporation) [On_Demand | Stopped] -- C:\Programme\Symantec\LiveUpdate\LuComServer_3_2.EXE -- (LiveUpdate)
SRV - [2007.09.26 11:53:56 | 000,554,352 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe -- (Automatisches LiveUpdate - Scheduler)
SRV - [2007.05.28 18:57:54 | 000,275,968 | ---- | M] (Rocket Division Software) [Auto | Running] -- C:\Programme\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe -- (StarWindServiceAE)
SRV - [2007.01.01 01:36:01 | 000,265,912 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
 
 
========== Driver Services (SafeList) ==========
 
DRV - [2011.08.07 10:00:00 | 000,374,392 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Programme\Common Files\Symantec Shared\EENGINE\eeCtrl.sys -- (eeCtrl)
DRV - [2010.12.29 22:37:28 | 000,691,696 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\System32\Drivers\sptd.sys -- (sptd)
DRV - [2010.03.25 20:06:30 | 000,099,728 | ---- | M] (Sun Microsystems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VBoxNetAdp.sys -- (VBoxNetAdp)
DRV - [2009.11.09 05:21:18 | 000,059,388 | ---- | M] (PowerISO Computing, Inc.) [Kernel | System | Running] -- C:\Windows\System32\drivers\scdemu.sys -- (SCDEmu)
DRV - [2008.07.21 14:24:45 | 000,075,072 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2008.06.03 15:36:45 | 000,052,032 | ---- | M] (Avira GmbH) [File_System | On_Demand | Running] -- C:\Programme\Avira\AntiVir PersonalEdition Classic\avgntflt.sys -- (avgntflt)
DRV - [2008.04.30 13:06:48 | 000,021,248 | ---- | M] (AVIRA GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2008.02.14 15:56:02 | 000,118,784 | ---- | M] (Realtek Corporation                                            ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169)
DRV - [2007.12.26 23:18:24 | 000,016,712 | ---- | M] (G DATA Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\GRD.sys -- (GRD)
DRV - [2007.12.05 02:41:00 | 008,238,720 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2007.10.18 01:16:00 | 000,079,688 | ---- | M] (PCTools Research Pty Ltd.) [Kernel | System | Running] -- C:\Windows\System32\drivers\iksyssec.sys -- (IKSysSec)
DRV - [2007.10.18 01:15:00 | 000,062,280 | ---- | M] (PCTools Research Pty Ltd.) [Kernel | System | Running] -- C:\Windows\System32\drivers\iksysflt.sys -- (IKSysFlt)
DRV - [2007.10.18 01:14:00 | 000,041,288 | ---- | M] (PCTools Research Pty Ltd.) [File_System | Boot | Running] -- C:\Windows\system32\drivers\ikfilesec.sys -- (IKFileSec)
DRV - [2007.07.02 17:37:10 | 000,131,616 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvrd32.sys -- (nvrd32)
DRV - [2007.07.02 17:37:08 | 000,110,112 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvstor32.sys -- (nvstor32)
DRV - [2007.06.13 23:47:12 | 000,048,256 | ---- | M] (JMicron Technology Corp.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\jraid.sys -- (JRAID)
DRV - [2007.02.27 16:25:04 | 000,011,840 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Programme\Avira\AntiVir PersonalEdition Classic\avgio.sys -- (avgio)
DRV - [2007.02.18 00:15:34 | 000,232,816 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\VMM.sys -- (vmm)
DRV - [2007.01.30 02:20:04 | 000,361,728 | ---- | M] (eMPIA Technology, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\emBDA.sys -- (USB28xxBGA)
DRV - [2007.01.30 02:19:48 | 000,039,680 | ---- | M] (eMPIA Technology, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\emOEM.sys -- (USB28xxOEM)
DRV - [2007.01.29 06:20:34 | 000,059,280 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\VMNetSrv.sys -- (VPCNetS2)
DRV - [2006.10.30 11:22:26 | 000,008,192 | ---- | M] (ATI Technologies Inc.) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\AtiPcie.sys -- (AtiPcie) ATI PCI Express (3GIO)
DRV - [2003.04.19 01:32:04 | 000,004,736 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\tandpl.sys -- (tandpl)
DRV - [2003.03.02 18:44:26 | 000,007,552 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\enodpl.sys -- (enodpl)
DRV - [2002.07.17 16:20:32 | 000,084,832 | ---- | M] (Adaptec) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ASPI32.SYS -- (ASPI)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/
IE - HKLM\..\URLSearchHook:  - Reg Error: Key error. File not found
IE - HKLM\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - Reg Error: Key error. File not found
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.icq.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook:  - Reg Error: Key error. File not found
IE - HKCU\..\URLSearchHook: {40c3cc16-7269-4b32-9531-17f2950fb06f} - Reg Error: Key error. File not found
IE - HKCU\..\URLSearchHook: {8dbb6d8e-e4a6-4e3b-9753-af78b226441c} - Reg Error: Key error. File not found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.defaultthis.engineName: "Winload Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2319825&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.suggest.enabled: false
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://start.icq.com/"
FF - prefs.js..extensions.enabledItems: {800b5000-a755-47e1-992b-48a1c1357f07}:1.1.9
FF - prefs.js..extensions.enabledItems: personas@christopher.beard:1.5.1
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:1.6.6.20090220
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1
FF - prefs.js..extensions.enabledItems: {e9911ec6-1bcc-40b0-9993-e0eea7f6953f}:2.5.8.6
FF - prefs.js..extensions.enabledItems: {40c3cc16-7269-4b32-9531-17f2950fb06f}:3.5.0.12
FF - prefs.js..extensions.enabledItems: {AA994882-F391-4d2e-806F-8908DA4814ED}:2.4.15
FF - prefs.js..keyword.URL: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2319825&q="
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll File not found
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.50524.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.11.3088: C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/npracplug;version=1.0.0.0: C:\Program Files\Real\RealArcade\Plugins\Mozilla\npracplug.dll File not found
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.2.3146: C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.11.3006: C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=:  File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc;version=0.8.6h: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN Team)
FF - HKCU\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll File not found
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Fabian\AppData\Local\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Fabian\AppData\Local\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{3112ca9c-de6d-4884-a869-9855de68056c}: C:\ProgramData\Mozilla\Firefox Extensions\{3112ca9c-de6d-4884-a869-9855de68056c} [2007.11.02 22:05:49 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Program Files\Real\RealPlayer\browserrecord [2008.01.18 15:26:39 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.21\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.09.01 22:47:53 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.21\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.09.01 22:47:53 | 000,000,000 | ---D | M]
 
[2008.02.22 19:36:11 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Fabian\AppData\Roaming\mozilla\Extensions
[2011.09.02 13:16:50 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions
[2007.11.22 22:14:16 | 000,000,000 | ---D | M] (Adblock) -- C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{34274bf4-1d97-a289-e984-17e546307e4f}
[2011.08.06 02:59:23 | 000,000,000 | ---D | M] (Winload Community Toolbar) -- C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f}
[2010.04.02 13:34:00 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2011.08.05 18:05:07 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2008.04.05 21:40:09 | 000,000,000 | ---D | M] (ReloadEvery) -- C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{888d99e7-e8b5-46a3-851e-1ec45da1e644}
[2011.08.22 16:40:01 | 000,000,000 | ---D | M] (kikin plugin) -- C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{AA994882-F391-4d2e-806F-8908DA4814ED}
[2010.05.30 19:37:16 | 000,000,000 | ---D | M] ("DVDVideoSoft Menu") -- C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2007.11.18 18:58:29 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{b69a9db4-d0a1-4722-b56b-f20757a29cdf}
[2010.05.31 21:41:40 | 000,000,000 | ---D | M] (DVDVideoSoft Toolbar) -- C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}
[2010.01.31 12:29:04 | 000,000,000 | ---D | M] (Personas) -- C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\personas@christopher.beard
[2010.05.01 14:52:26 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\staged-xpis
[2010.05.25 19:15:26 | 000,005,318 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\alle-notende.xml
[2010.02.04 17:45:40 | 000,002,254 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\askcom.xml
[2011.07.24 15:31:22 | 000,000,917 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\conduit.xml
[2010.12.29 22:37:47 | 000,002,059 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\daemon-search.xml
[2011.08.31 15:59:34 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-1.xml
[2010.09.16 21:51:06 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-10.xml
[2010.10.21 15:35:06 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-11.xml
[2010.10.28 22:30:02 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-12.xml
[2010.11.01 20:10:54 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-13.xml
[2010.12.12 18:15:49 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-14.xml
[2011.03.05 16:55:13 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-15.xml
[2011.03.06 15:53:40 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-16.xml
[2011.03.24 19:24:37 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-17.xml
[2011.05.28 14:30:50 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-18.xml
[2011.08.05 18:05:29 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-19.xml
[2007.11.05 23:42:58 | 000,000,949 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-2.xml
[2011.09.01 22:48:08 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-20.xml
[2007.11.27 22:45:15 | 000,000,949 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-3.xml
[2009.05.13 19:07:53 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-4.xml
[2010.06.23 20:00:54 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-5.xml
[2010.06.28 00:08:50 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-6.xml
[2010.07.22 13:15:12 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-7.xml
[2010.07.26 10:58:21 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-8.xml
[2010.09.08 21:35:51 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-9.xml
[2011.08.05 18:05:07 | 000,000,168 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin.gif
[2011.08.05 18:05:07 | 000,000,618 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin.src
[2011.03.30 15:14:34 | 000,001,042 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin.xml
[2011.08.05 18:15:16 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2009.06.12 13:58:33 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Programme\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2007.11.27 22:26:07 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions\google-cjk@partners.mozilla.com
[2010.04.02 13:33:15 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}
[2009.11.03 16:42:01 | 000,238,776 | ---- | M] (Pando Networks) -- C:\Program Files\mozilla firefox\plugins\npPandoWebInst.dll
[2005.04.27 22:10:49 | 000,102,400 | ---- | M] (RealNetworks) -- C:\Program Files\mozilla firefox\plugins\npracplug.dll
[2011.08.18 19:08:30 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011.08.18 19:08:30 | 000,002,344 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2011.08.18 19:08:30 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2011.08.18 19:08:30 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2011.08.18 19:08:30 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2011.08.25 19:25:53 | 000,000,098 | ---- | M]) - C:\Windows\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: ::1      localhost
O2 - BHO: (HP Print Clips) - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Programme\HP\Smart Web Printing\hpswp_framework.dll (Hewlett-Packard Co.)
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - No CLSID value found.
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Programme\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Programme\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {8DBB6D8E-E4A6-4E3B-9753-AF78B226441C} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {ED4BD629-C1B6-4399-8A34-02CCAA921DC9} - No CLSID value found.
O4 - HKLM..\Run: [AdobeCS4ServiceManager] C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [DAEMON Tools] C:\Program Files\DAEMON Tools\daemon.exe (DT Soft Ltd.)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [HCWemmon] C:\Windows\HCWemmon.exe (eMPIA Technology, Inc.)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvSvc] C:\Windows\System32\nvsvc.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [PWRISOVM.EXE] C:\Programme\PowerISO\PWRISOVM.EXE (PowerISO Computing, Inc.)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [Symantec PIF AlertEng] C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe (Symantec Corporation)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKLM..\Run: [WPCUMI] C:\Windows\System32\wpcumi.exe (Microsoft Corporation)
O4 - HKCU..\Run: [AlcoholAutomount] C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe (Alcohol Soft Development Team)
O4 - HKCU..\Run: [DAEMON Tools] C:\Program Files\DAEMON Tools\daemon.exe (DT Soft Ltd.)
O4 - HKCU..\Run: [DAEMON Tools Lite] C:\Program Files\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
O4 - HKCU..\Run: [EA Core]  File not found
O4 - HKCU..\Run: [ICQ]  File not found
O4 - HKCU..\Run: [msnmsgr]  File not found
O4 - HKCU..\Run: [Pando Media Booster] C:\Programme\Pando Networks\Media Booster\PMB.exe ()
O4 - Startup: C:\Users\Fabian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma.lnk = C:\Programme\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
O4 - Startup: C:\Users\Fabian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk = C:\Programme\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\Fabian\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: HP Sammelmappe - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Programme\HP\Smart Web Printing\hpswp_extensions.dll (Hewlett-Packard Co.)
O9 - Extra Button: HP Intelligente Auswahl - {700259D7-1666-479a-93B1-3250410481E8} - C:\Programme\HP\Smart Web Printing\hpswp_extensions.dll (Hewlett-Packard Co.)
O9 - Extra Button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Programme\ICQ7.5\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Programme\ICQ7.5\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000023 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab (Java Plug-in 1.6.0_19)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Java Plug-in 1.6.0_03)
O16 - DPF: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab (Java Plug-in 1.6.0_19)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab (Java Plug-in 1.6.0_19)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programme\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Desktop Hintergrund.bmp
O24 - Desktop BackupWallPaper: C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Desktop Hintergrund.bmp
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
 
SafeBootMin: AppMgmt -  File not found
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: NTDS -  File not found
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: sdauxservice -  File not found
SafeBootMin: sdcoreservice -  File not found
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet: AppMgmt -  File not found
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: NTDS -  File not found
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: sdauxservice -  File not found
SafeBootNet: sdcoreservice -  File not found
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} -
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} -
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.7
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {AAC3F1F0-5649-4670-A698-F1523729F015} - Microsoft .NET Framework 1.1 Hotfix (KB929729)
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Reg Error: Value error.
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
 
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\Windows\System32\DivX.dll (DivX, Inc.)
Drivers32: VIDC.FPS1 - C:\Windows\System32\frapsvid.dll (Beepa P/L)
Drivers32: VIDC.IV41 - C:\Windows\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.VP60 - C:\Windows\System32\vp6vfw.dll (On2.com)
Drivers32: vidc.VP61 - C:\Windows\System32\vp6vfw.dll (On2.com)
Drivers32: vidc.yv12 - C:\Windows\System32\DivX.dll (DivX, Inc.)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.09.02 13:34:31 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2011.09.01 23:38:08 | 000,000,000 | ---D | C] -- C:\Users\Fabian\.hades
[2011.09.01 18:04:49 | 000,000,000 | ---D | C] -- C:\Program Files\ESET
[2011.08.29 19:27:09 | 000,000,000 | ---D | C] -- C:\Program Files\AutocompletePro
[2011.08.26 17:01:23 | 000,000,000 | ---D | C] -- C:\Program Files\DemonFlyff
[2011.08.25 21:51:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
[2011.08.25 19:25:12 | 000,000,000 | ---D | C] -- C:\_OTL
[2011.08.23 19:18:40 | 000,580,096 | ---- | C] (OldTimer Tools) -- C:\Users\Fabian\Desktop\OTL.exe
[2011.08.21 15:14:57 | 000,000,000 | ---D | C] -- C:\Users\Fabian\AppData\Local\No23 Recorder
[2011.08.21 15:14:54 | 000,000,000 | ---D | C] -- C:\Users\Fabian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\No23 Recorder
[2011.08.21 15:14:08 | 000,000,000 | ---D | C] -- C:\Users\Fabian\AppData\Roaming\kikin
[2011.08.21 15:14:07 | 000,000,000 | ---D | C] -- C:\Program Files\kikin
[2011.08.06 17:56:00 | 000,000,000 | ---D | C] -- C:\Users\Fabian\Documents\My Kindle Content
[2011.08.06 17:55:37 | 000,000,000 | ---D | C] -- C:\Users\Fabian\AppData\Local\Amazon
[2011.08.06 02:59:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Vokabel Trainer
[2011.08.05 18:05:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ICQ7.5
[2011.08.05 18:04:32 | 000,000,000 | ---D | C] -- C:\Program Files\ICQ7.5
 
========== Files - Modified Within 30 Days ==========
 
[2011.09.02 16:40:06 | 000,000,420 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{C27515C3-4436-493B-94A2-3C3CF69BDCC9}.job
[2011.09.02 16:28:50 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011.09.02 16:28:39 | 000,003,200 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011.09.02 16:28:38 | 000,003,200 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011.09.02 16:28:19 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011.09.02 16:28:17 | 3220,692,992 | -HS- | M] () -- C:\hiberfil.sys
[2011.09.02 13:51:00 | 000,001,124 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1054673845-2891796712-3211906163-1000UA.job
[2011.09.02 13:36:04 | 000,076,800 | ---- | M] () -- C:\Users\Fabian\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.09.02 13:20:00 | 000,001,098 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011.09.02 12:48:12 | 000,655,692 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2011.09.02 12:48:12 | 000,621,850 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011.09.02 12:48:12 | 000,122,662 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2011.09.02 12:48:12 | 000,108,934 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011.09.01 20:51:56 | 000,000,476 | -H-- | M] () -- C:\Windows\tasks\Norton Security Scan for Fabian.job
[2011.09.01 18:06:33 | 000,010,097 | ---- | M] () -- C:\Users\Fabian\Desktop\13.odt
[2011.08.28 22:32:58 | 000,000,805 | ---- | M] () -- C:\Users\Fabian\Desktop\Flyff.exe - Verknüpfung.lnk
[2011.08.26 19:51:24 | 000,000,069 | ---- | M] () -- C:\Windows\NeroDigital.ini
[2011.08.25 21:51:15 | 000,000,810 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2011.08.25 19:25:53 | 000,000,098 | ---- | M] () -- C:\Windows\System32\drivers\etc\Hosts
[2011.08.23 19:18:44 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Users\Fabian\Desktop\OTL.exe
[2011.08.22 19:15:49 | 000,008,268 | ---- | M] () -- C:\Users\Fabian\AppData\Local\d3d9caps.dat
[2011.08.06 00:51:00 | 000,001,072 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1054673845-2891796712-3211906163-1000Core.job
 
========== Files Created - No Company Name ==========
 
[2011.09.02 12:47:05 | 000,280,909 | ---- | C] () -- C:\Users\Fabian\Desktop\Multi-Toolbar Remover.exe
[2011.08.28 22:32:58 | 000,000,805 | ---- | C] () -- C:\Users\Fabian\Desktop\Flyff.exe - Verknüpfung.lnk
[2011.08.25 21:51:15 | 000,000,810 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2011.08.22 19:31:59 | 3220,692,992 | -HS- | C] () -- C:\hiberfil.sys
[2011.01.03 00:22:14 | 000,073,728 | ---- | C] () -- C:\Windows\System32\GkSui18.EXE
[2010.09.03 18:45:49 | 000,256,512 | ---- | C] () -- C:\Windows\PEV.exe
[2010.09.03 18:45:49 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2010.09.03 18:45:49 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2010.09.03 18:45:49 | 000,077,312 | ---- | C] () -- C:\Windows\MBR.exe
[2010.09.03 18:45:49 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2009.02.20 15:28:45 | 000,162,304 | ---- | C] () -- C:\Windows\System32\ztvunrar36.dll
[2009.02.20 15:28:45 | 000,077,312 | ---- | C] () -- C:\Windows\System32\ztvunace26.dll
[2008.12.22 13:10:46 | 000,009,509 | ---- | C] () -- C:\ProgramData\LUUnInstall.LiveUpdate
[2008.10.18 16:40:43 | 000,004,984 | ---- | C] () -- C:\ProgramData\jexqjxsy.dne
[2008.09.01 22:42:53 | 000,264,192 | ---- | C] () -- C:\Windows\System32\midas.dll
[2008.08.13 14:34:20 | 000,000,094 | ---- | C] () -- C:\Users\Fabian\AppData\Local\fusioncache.dat
[2008.03.28 15:20:24 | 000,138,024 | -H-- | C] () -- C:\Windows\System32\mlfcache.dat
[2008.01.14 19:44:58 | 000,149,504 | ---- | C] () -- C:\Windows\System32\UNWISE.EXE
[2008.01.14 19:44:19 | 000,032,825 | ---- | C] () -- C:\Windows\Irremote.ini
[2008.01.14 19:44:09 | 000,065,536 | ---- | C] () -- C:\Windows\System32\dmcrypto.dll
[2008.01.14 19:43:46 | 000,000,209 | ---- | C] () -- C:\Windows\ODBCINST.INI
[2008.01.14 19:43:46 | 000,000,135 | ---- | C] () -- C:\Windows\ODBC.INI
[2008.01.14 19:43:45 | 000,159,744 | ---- | C] () -- C:\Windows\System32\hcwChDB.dll
[2008.01.14 19:43:14 | 000,002,075 | ---- | C] () -- C:\Windows\HCWPNP.INI
[2008.01.14 19:42:12 | 000,040,960 | ---- | C] () -- C:\Windows\System32\bdadll.dll
[2007.12.26 23:41:32 | 000,019,900 | ---- | C] () -- C:\Users\Fabian\AppData\Roaming\UserTile.png
[2007.12.26 01:09:48 | 000,000,025 | ---- | C] () -- C:\Windows\SIERRA.INI
[2007.12.26 01:04:15 | 000,156,160 | ---- | C] () -- C:\Windows\System32\unrar3.dll
[2007.12.26 01:04:15 | 000,075,264 | ---- | C] () -- C:\Windows\System32\unacev2.dll
[2007.12.08 11:27:15 | 000,008,268 | ---- | C] () -- C:\Users\Fabian\AppData\Local\d3d9caps.dat
[2007.11.22 22:22:43 | 000,000,305 | ---- | C] () -- C:\ProgramData\addr_file.html
[2007.11.18 19:15:53 | 000,237,568 | ---- | C] () -- C:\Windows\System32\lame_enc.dll
[2007.11.08 18:10:12 | 000,069,632 | R--- | C] () -- C:\Windows\System32\xmltok.dll
[2007.11.08 18:10:12 | 000,036,864 | R--- | C] () -- C:\Windows\System32\xmlparse.dll
[2007.11.08 17:52:59 | 000,007,552 | ---- | C] () -- C:\Windows\System32\drivers\enodpl.sys
[2007.11.08 17:52:59 | 000,004,736 | ---- | C] () -- C:\Windows\System32\drivers\tandpl.sys
[2007.11.06 21:36:09 | 000,007,316 | ---- | C] () -- C:\Users\Fabian\AppData\Roaming\wklnhst.dat
[2007.11.03 20:54:04 | 000,641,021 | ---- | C] () -- C:\Windows\unins000.exe
[2007.11.03 20:54:04 | 000,002,577 | ---- | C] () -- C:\Windows\unins000.dat
[2007.11.03 01:30:52 | 000,001,156 | ---- | C] () -- C:\Windows\mozver.dat
[2007.11.02 22:10:23 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat
[2007.11.02 20:41:38 | 000,000,069 | ---- | C] () -- C:\Windows\NeroDigital.ini
[2007.11.02 20:41:36 | 000,076,800 | ---- | C] () -- C:\Users\Fabian\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007.04.14 16:57:06 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelTraditionalChinese.dll
[2007.04.14 16:57:06 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelSwedish.dll
[2007.04.14 16:57:06 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelSpanish.dll
[2007.04.14 16:57:04 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelSimplifiedChinese.dll
[2007.04.14 16:57:04 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelPortugese.dll
[2007.04.14 16:57:04 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelKorean.dll
[2007.04.14 16:57:04 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelJapanese.dll
[2007.04.14 16:57:04 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelGerman.dll
[2007.04.14 16:57:04 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelFrench.dll
[2007.01.01 03:49:06 | 000,000,342 | ---- | C] () -- C:\Windows\{9A3BC157-B94F-4EFD-ABA9-1E56DEB00655}_WiseFW.ini
[2006.11.02 17:33:31 | 000,655,692 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2006.11.02 17:33:31 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2006.11.02 17:33:31 | 000,122,662 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2006.11.02 17:33:31 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2006.11.02 14:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006.11.02 14:47:37 | 002,340,168 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006.11.02 12:33:01 | 000,621,850 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2006.11.02 12:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2006.11.02 12:33:01 | 000,108,934 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2006.11.02 12:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2006.11.02 12:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2006.11.02 10:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006.11.02 10:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006.11.02 09:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2006.11.02 09:22:43 | 000,099,999 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2006.11.02 09:22:43 | 000,018,271 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2006.08.11 10:52:02 | 000,012,288 | ---- | C] () -- C:\Windows\System32\EvOnlDiag.dll
[2002.07.31 18:32:03 | 000,056,832 | ---- | C] () -- C:\Windows\System32\iyvu9_32.dll
[2000.04.14 17:50:02 | 000,343,040 | ---- | C] () -- C:\Windows\System32\Lffpx7.dll
[1998.06.11 14:08:06 | 000,095,232 | ---- | C] () -- C:\Windows\System32\Lfkodak.dll
 
========== LOP Check ==========
 
[2010.12.24 20:15:31 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\.minecraft
[2007.11.27 22:09:51 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Application Data
[2007.11.29 16:14:08 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Atari
[2007.12.29 21:09:12 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Azureus
[2007.12.23 21:13:22 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Command & Conquer 3 Tiberium Wars
[2007.11.23 19:34:22 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\concept design
[2008.06.21 14:36:08 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Crystal Player
[2010.12.29 22:44:48 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\DAEMON Tools Lite
[2007.12.26 21:43:16 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\DeepBurner
[2011.07.01 11:26:57 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\DVDVideoSoft
[2011.07.01 11:22:35 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\DVDVideoSoftIEHelpers
[2009.11.10 09:56:37 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\FMZilla
[2010.04.25 00:02:38 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\gtk-2.0
[2011.09.02 13:22:26 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\ICQ
[2007.11.03 00:21:25 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\ICQ Toolbar
[2010.09.17 14:52:39 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\ICQLite
[2008.01.09 21:33:16 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\JLC's Software
[2008.03.12 13:21:29 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Jägermeister RadioPlayer
[2011.08.22 16:36:03 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\kikin
[2009.06.23 13:31:36 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Lern-o-Mat
[2007.11.18 19:21:23 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\lexiCan 2
[2008.03.28 15:28:14 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Netscape
[2008.03.12 21:40:21 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Opera
[2008.01.27 22:57:11 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Ordner HP Share-to-Web
[2007.11.16 21:45:09 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Participatory Culture Foundation
[2007.11.17 00:00:14 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\PCF-VLC
[2007.12.26 23:41:32 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\PeerNetworking
[2008.07.01 09:12:45 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Recorder
[2009.11.02 21:11:08 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Softplicity
[2010.08.10 13:45:08 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Spesoft Audio Converter
[2009.11.08 16:04:31 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\streamripper
[2011.08.22 19:30:51 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Teeworlds
[2007.11.17 17:36:15 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Template
[2007.11.23 15:41:43 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\TrojanHunter
[2011.09.02 14:12:57 | 000,032,638 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2011.09.02 16:40:06 | 000,000,420 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{C27515C3-4436-493B-94A2-3C3CF69BDCC9}.job
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2010.12.24 20:15:31 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\.minecraft
[2011.09.02 12:58:23 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Adobe
[2007.11.03 00:16:08 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Ahead
[2009.12.21 14:37:01 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Apple Computer
[2007.11.27 22:09:51 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Application Data
[2007.11.29 16:14:08 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Atari
[2007.12.29 21:09:12 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Azureus
[2007.12.23 21:13:22 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Command & Conquer 3 Tiberium Wars
[2007.11.23 19:34:22 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\concept design
[2008.06.21 14:36:08 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Crystal Player
[2010.12.29 22:44:48 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\DAEMON Tools Lite
[2007.12.26 21:43:16 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\DeepBurner
[2010.04.17 16:02:37 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\DivX
[2011.08.22 19:30:50 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\dvdcss
[2011.07.01 11:26:57 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\DVDVideoSoft
[2011.07.01 11:22:35 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\DVDVideoSoftIEHelpers
[2009.11.10 09:56:37 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\FMZilla
[2007.11.04 02:12:13 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Google
[2010.04.25 00:02:38 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\gtk-2.0
[2008.09.13 14:58:45 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\HP
[2008.09.13 14:53:50 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\HPAppData
[2011.09.02 13:22:26 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\ICQ
[2007.11.03 00:21:25 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\ICQ Toolbar
[2010.09.17 14:52:39 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\ICQLite
[2007.11.02 20:25:03 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Identities
[2007.11.03 00:19:50 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\InstallShield
[2008.01.09 21:33:16 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\JLC's Software
[2008.03.12 13:21:29 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Jägermeister RadioPlayer
[2011.08.22 16:36:03 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\kikin
[2009.06.23 13:31:36 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Lern-o-Mat
[2007.11.18 19:21:23 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\lexiCan 2
[2007.11.02 21:54:53 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Macromedia
[2010.09.01 19:10:10 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Malwarebytes
[2006.11.02 14:37:34 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Media Center Programs
[2011.08.16 19:26:45 | 000,000,000 | --SD | M] -- C:\Users\Fabian\AppData\Roaming\Microsoft
[2008.02.22 19:36:11 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Mozilla
[2008.03.28 15:28:14 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Netscape
[2011.09.01 18:06:33 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\OpenOffice.org2
[2008.03.12 21:40:21 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Opera
[2008.01.27 22:57:11 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Ordner HP Share-to-Web
[2007.11.16 21:45:09 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Participatory Culture Foundation
[2007.11.24 13:09:56 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\PC Tools
[2007.11.17 00:00:14 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\PCF-VLC
[2007.12.26 23:41:32 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\PeerNetworking
[2009.12.07 18:43:59 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Real
[2008.07.01 09:12:45 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Recorder
[2009.11.02 21:11:08 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Softplicity
[2010.08.10 13:45:08 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Spesoft Audio Converter
[2009.11.08 16:04:31 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\streamripper
[2007.12.27 21:22:02 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Sun
[2007.11.02 22:10:29 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Talkback
[2011.08.22 19:30:51 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Teeworlds
[2007.11.17 17:36:15 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Template
[2007.11.23 15:41:43 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\TrojanHunter
[2007.11.02 22:04:03 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\vlc
[2008.01.12 21:26:54 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\Winamp
[2007.11.03 00:17:35 | 000,000,000 | ---D | M] -- C:\Users\Fabian\AppData\Roaming\WinRAR
 
< %APPDATA%\*.exe /s >
[2008.05.28 18:46:30 | 000,065,536 | R--- | M] (Macrovision Corporation) -- C:\Users\Fabian\AppData\Roaming\Microsoft\Installer\{0CE1A6C0-F3F7-49E6-8F9D-2431F9827441}\NewShortcut4_0CE1A6C0F3F749E68F9D2431F9827441.exe
[2008.05.28 18:46:30 | 000,008,854 | R--- | M] () -- C:\Users\Fabian\AppData\Roaming\Microsoft\Installer\{0CE1A6C0-F3F7-49E6-8F9D-2431F9827441}\UNINST_Uninstall_G_0CE1A6C0F3F749E68F9D2431F9827441_1.exe
[2010.04.03 18:10:06 | 000,040,960 | R--- | M] (InstallShield Software Corp.) -- C:\Users\Fabian\AppData\Roaming\Microsoft\Installer\{3571656A-575D-4CED-809D-5547587121FF}\NewShortcut1.exe
[2010.04.03 18:10:06 | 000,040,960 | R--- | M] (InstallShield Software Corp.) -- C:\Users\Fabian\AppData\Roaming\Microsoft\Installer\{3571656A-575D-4CED-809D-5547587121FF}\NewShortcut3.exe
[2010.04.03 18:10:06 | 000,040,960 | R--- | M] (InstallShield Software Corp.) -- C:\Users\Fabian\AppData\Roaming\Microsoft\Installer\{3571656A-575D-4CED-809D-5547587121FF}\NewShortcut8.EXE
[2010.07.12 19:44:57 | 000,010,134 | R--- | M] () -- C:\Users\Fabian\AppData\Roaming\Microsoft\Installer\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}\ARPPRODUCTICON.exe
[2010.02.23 18:53:21 | 000,439,816 | ---- | M] (RealNetworks, Inc.) -- C:\Users\Fabian\AppData\Roaming\Real\Update\setup3.09\setup.exe
[2010.05.25 17:59:38 | 000,443,912 | ---- | M] (RealNetworks, Inc.) -- C:\Users\Fabian\AppData\Roaming\Real\Update\setup3.10\setup.exe
[2010.09.12 17:46:23 | 000,456,200 | ---- | M] (RealNetworks, Inc.) -- C:\Users\Fabian\AppData\Roaming\Real\Update\setup3.12\setup.exe
[2011.01.30 19:49:48 | 000,510,120 | ---- | M] (RealNetworks, Inc.) -- C:\Users\Fabian\AppData\Roaming\Real\Update\setup3.13\setup.exe
[2011.08.27 22:12:20 | 000,310,400 | ---- | M] (RealNetworks, Inc.) -- C:\Users\Fabian\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\8.00\rnupgagent.exe
 
< %SYSTEMDRIVE%\*.exe >
 
 
< MD5 for: AGP440.SYS  >
[2008.01.19 09:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\SoftwareDistribution\Download\b2ee164db645e6bc8d77bb51f082e3b3\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys
[2007.01.01 02:36:07 | 000,056,504 | ---- | M] (Microsoft Corporation) MD5=198636E76971EBC96404547EC0FD5E75 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_cb7c81c7\AGP440.sys
[2007.01.01 02:36:07 | 000,056,504 | ---- | M] (Microsoft Corporation) MD5=198636E76971EBC96404547EC0FD5E75 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6000.20598_none_b85cfa98dae9b436\AGP440.sys
[2006.11.02 11:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\ERDNT\cache\AGP440.sys
[2006.11.02 11:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\drivers\AGP440.sys
[2006.11.02 11:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2007.01.01 03:25:09 | 000,021,688 | ---- | M] (Microsoft Corporation) MD5=28D0C21DB4FFED1BBFB42E9AA34E0C0D -- C:\Windows\ERDNT\cache\atapi.sys
[2007.01.01 03:25:09 | 000,021,688 | ---- | M] (Microsoft Corporation) MD5=28D0C21DB4FFED1BBFB42E9AA34E0C0D -- C:\Windows\System32\drivers\atapi.sys
[2007.01.01 03:25:09 | 000,021,688 | ---- | M] (Microsoft Corporation) MD5=28D0C21DB4FFED1BBFB42E9AA34E0C0D -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_37a5f048\atapi.sys
[2007.01.01 03:25:09 | 000,021,688 | ---- | M] (Microsoft Corporation) MD5=28D0C21DB4FFED1BBFB42E9AA34E0C0D -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20658_none_dbad770d3da236bb\atapi.sys
[2008.01.19 09:41:30 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\SoftwareDistribution\Download\b2ee164db645e6bc8d77bb51f082e3b3\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys
[2006.11.02 11:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\ERDNT\cache\cngaudit.dll
[2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll
[2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll
 
< MD5 for: IASTOR.SYS  >
[2007.07.12 16:35:02 | 000,305,176 | ---- | M] (Intel Corporation) MD5=2358C53F30CB9DCD1D3843C4E2F299B2 -- C:\Windows\System32\drivers\iaStor.sys
[2007.07.12 16:35:02 | 000,305,176 | ---- | M] (Intel Corporation) MD5=2358C53F30CB9DCD1D3843C4E2F299B2 -- C:\Windows\System32\DriverStore\FileRepository\iastor.inf_ec8a8d1b\iaStor.sys
 
< MD5 for: IASTORV.SYS  >
[2008.01.19 09:42:51 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\SoftwareDistribution\Download\b2ee164db645e6bc8d77bb51f082e3b3\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys
[2006.11.02 11:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\drivers\iaStorV.sys
[2006.11.02 11:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2006.11.02 11:46:11 | 000,559,616 | ---- | M] (Microsoft Corporation) MD5=889A2C9F2AACCD8F64EF50AC0B3D553B -- C:\Windows\ERDNT\cache\netlogon.dll
[2006.11.02 11:46:11 | 000,559,616 | ---- | M] (Microsoft Corporation) MD5=889A2C9F2AACCD8F64EF50AC0B3D553B -- C:\Windows\System32\netlogon.dll
[2006.11.02 11:46:11 | 000,559,616 | ---- | M] (Microsoft Corporation) MD5=889A2C9F2AACCD8F64EF50AC0B3D553B -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6000.16386_none_fb80f5473b0ed783\netlogon.dll
[2008.01.19 09:35:36 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\SoftwareDistribution\Download\b2ee164db645e6bc8d77bb51f082e3b3\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2006.11.02 11:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\drivers\nvstor.sys
[2006.11.02 11:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys
[2008.01.19 09:42:09 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\SoftwareDistribution\Download\b2ee164db645e6bc8d77bb51f082e3b3\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys
 
< MD5 for: NVSTOR32.SYS  >
[2007.07.02 17:37:08 | 000,110,112 | ---- | M] (NVIDIA Corporation) MD5=703E3A7093B0FAC0EEBADBB8E931ECAF -- C:\Windows\System32\drivers\nvstor32.sys
[2007.07.02 17:37:08 | 000,110,112 | ---- | M] (NVIDIA Corporation) MD5=703E3A7093B0FAC0EEBADBB8E931ECAF -- C:\Windows\System32\DriverStore\FileRepository\nvrd32.inf_bbf77119\nvstor32.sys
 
< MD5 for: SCECLI.DLL  >
[2008.01.19 09:36:19 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\SoftwareDistribution\Download\b2ee164db645e6bc8d77bb51f082e3b3\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll
[2006.11.02 11:46:12 | 000,176,640 | ---- | M] (Microsoft Corporation) MD5=80E2839D05CA5970A86D7BE2A08BFF61 -- C:\Windows\ERDNT\cache\scecli.dll
[2006.11.02 11:46:12 | 000,176,640 | ---- | M] (Microsoft Corporation) MD5=80E2839D05CA5970A86D7BE2A08BFF61 -- C:\Windows\System32\scecli.dll
[2006.11.02 11:46:12 | 000,176,640 | ---- | M] (Microsoft Corporation) MD5=80E2839D05CA5970A86D7BE2A08BFF61 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6000.16386_none_35d7205fdc305e3e\scecli.dll
 
< MD5 for: USER32.DLL  >
[2007.01.01 02:03:03 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=3322B167C8F76319C991B851514DFAC9 -- C:\Windows\ERDNT\cache\user32.dll
[2008.01.19 09:36:46 | 000,627,200 | ---- | M] (Microsoft Corporation) MD5=B974D9F06DC7D1908E825DC201681269 -- C:\Windows\SoftwareDistribution\Download\b2ee164db645e6bc8d77bb51f082e3b3\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_cd386c416d5c7f32\user32.dll
[2006.11.02 11:46:13 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=E698A5437B89A285ACA3FF022356810A -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.16386_none_cb01aa4570716e5e\user32.dll
[2007.01.01 02:03:03 | 000,633,856 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\user32.dll
[2007.01.01 02:03:03 | 000,633,856 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.20587_none_cb8c4940898e24a6\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2008.01.19 09:33:33 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\SoftwareDistribution\Download\b2ee164db645e6bc8d77bb51f082e3b3\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe
[2006.11.02 11:45:50 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=22027835939F86C3E47AD8E3FBDE3D11 -- C:\Windows\ERDNT\cache\userinit.exe
[2006.11.02 11:45:50 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=22027835939F86C3E47AD8E3FBDE3D11 -- C:\Windows\System32\userinit.exe
[2006.11.02 11:45:50 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=22027835939F86C3E47AD8E3FBDE3D11 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6000.16386_none_d9f1f819d4c4e737\userinit.exe
 
< MD5 for: VIAMRAID.SYS  >
[2006.11.08 15:23:52 | 000,102,912 | ---- | M] (VIA Technologies inc,.ltd) MD5=7DC3E1DC6E4F8BE381C31BFEA578412A -- C:\Windows\System32\drivers\viamraid.sys
[2006.11.08 15:23:52 | 000,102,912 | ---- | M] (VIA Technologies inc,.ltd) MD5=7DC3E1DC6E4F8BE381C31BFEA578412A -- C:\Windows\System32\DriverStore\FileRepository\viamraid.inf_74a36694\viamraid.sys
 
< MD5 for: WININIT.EXE  >
[2008.01.19 09:33:37 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\SoftwareDistribution\Download\b2ee164db645e6bc8d77bb51f082e3b3\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6001.18000_none_30f2b8cf0450a6a2\wininit.exe
[2007.01.01 02:06:13 | 000,095,744 | ---- | M] (Microsoft Corporation) MD5=39D959CD9F3BC44F78DB3C6588AAC3FE -- C:\Windows\ERDNT\cache\wininit.exe
[2007.01.01 02:06:13 | 000,095,744 | ---- | M] (Microsoft Corporation) MD5=39D959CD9F3BC44F78DB3C6588AAC3FE -- C:\Windows\System32\wininit.exe
[2007.01.01 02:06:13 | 000,095,744 | ---- | M] (Microsoft Corporation) MD5=39D959CD9F3BC44F78DB3C6588AAC3FE -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6000.20593_none_2f37c4ba208e02ab\wininit.exe
[2006.11.02 11:45:57 | 000,095,744 | ---- | M] (Microsoft Corporation) MD5=D4385B03E8CCCEE6F0EE249F827C1F3E -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6000.16386_none_2ebbf6d3076595ce\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2006.11.02 11:45:57 | 000,308,224 | ---- | M] (Microsoft Corporation) MD5=9F75392B9128A91ABAFB044EA350BAAD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6000.16386_none_6d8c3f1ad8066b21\winlogon.exe
[2007.01.01 02:06:13 | 000,308,224 | ---- | M] (Microsoft Corporation) MD5=A3FEA6ED9FD3CF07219A632E4A716226 -- C:\Windows\ERDNT\cache\winlogon.exe
[2007.01.01 02:06:13 | 000,308,224 | ---- | M] (Microsoft Corporation) MD5=A3FEA6ED9FD3CF07219A632E4A716226 -- C:\Windows\System32\winlogon.exe
[2007.01.01 02:06:13 | 000,308,224 | ---- | M] (Microsoft Corporation) MD5=A3FEA6ED9FD3CF07219A632E4A716226 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6000.20593_none_6e080d01f12ed7fe\winlogon.exe
[2008.01.19 09:33:37 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\SoftwareDistribution\Download\b2ee164db645e6bc8d77bb51f082e3b3\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2006.11.02 10:58:26 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=84620AECDCFD2A7A14E6263927D8C0ED -- C:\Windows\System32\drivers\ws2ifsl.sys
[2006.11.02 10:58:26 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=84620AECDCFD2A7A14E6263927D8C0ED -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6000.16386_none_4d4fded8cae2956d\ws2ifsl.sys
[2008.01.19 07:56:49 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\SoftwareDistribution\Download\b2ee164db645e6bc8d77bb51f082e3b3\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6001.18000_none_4f86a0d4c7cda641\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
[2010.12.29 22:37:28 | 000,691,696 | ---- | M] () Unable to obtain MD5 -- C:\Windows\system32\drivers\sptd.sys
 
< %systemroot%\System32\config\*.sav >
[2007.10.16 08:29:22 | 006,664,192 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV
[2007.10.16 08:29:20 | 000,102,400 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV
[2007.10.16 08:29:22 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV
[2007.10.16 08:29:28 | 015,720,448 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV
[2007.10.16 08:29:29 | 006,021,120 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 481 bytes -> C:\ProgramData\TEMP:05EE1EEF
@Alternate Data Stream - 106 bytes -> C:\ProgramData\TEMP:DFC5A2B2

< End of report >

cosinus 04.09.2011 12:32
Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:
:OTL
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/
IE - HKLM\..\URLSearchHook:  - Reg Error: Key error. File not found
IE - HKLM\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - Reg Error: Key error. File not found
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://start.icq.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook:  - Reg Error: Key error. File not found
IE - HKCU\..\URLSearchHook: {40c3cc16-7269-4b32-9531-17f2950fb06f} - Reg Error: Key error. File not found
IE - HKCU\..\URLSearchHook: {8dbb6d8e-e4a6-4e3b-9753-af78b226441c} - Reg Error: Key error. File not found
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.defaultthis.engineName: "Winload Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2319825&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.startup.homepage: "http://start.icq.com/"
FF - prefs.js..keyword.URL: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2319825&q="
[2011.08.06 02:59:23 | 000,000,000 | ---D | M] (Winload Community Toolbar) -- C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f}
[2010.04.02 13:34:00 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2011.08.05 18:05:07 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2008.04.05 21:40:09 | 000,000,000 | ---D | M] (ReloadEvery) -- C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{888d99e7-e8b5-46a3-851e-1ec45da1e644}
[2011.08.22 16:40:01 | 000,000,000 | ---D | M] (kikin plugin) -- C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{AA994882-F391-4d2e-806F-8908DA4814ED}
[2010.05.30 19:37:16 | 000,000,000 | ---D | M] ("DVDVideoSoft Menu") -- C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2007.11.18 18:58:29 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{b69a9db4-d0a1-4722-b56b-f20757a29cdf}
[2010.05.31 21:41:40 | 000,000,000 | ---D | M] (DVDVideoSoft Toolbar) -- C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}
[2010.05.01 14:52:26 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\staged-xpis
[2010.02.04 17:45:40 | 000,002,254 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\askcom.xml
[2011.07.24 15:31:22 | 000,000,917 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\conduit.xml
[2010.12.29 22:37:47 | 000,002,059 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\daemon-search.xml
[2011.08.31 15:59:34 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-1.xml
[2010.09.16 21:51:06 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-10.xml
[2010.10.21 15:35:06 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-11.xml
[2010.10.28 22:30:02 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-12.xml
[2010.11.01 20:10:54 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-13.xml
[2010.12.12 18:15:49 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-14.xml
[2011.03.05 16:55:13 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-15.xml
[2011.03.06 15:53:40 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-16.xml
[2011.03.24 19:24:37 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-17.xml
[2011.05.28 14:30:50 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-18.xml
[2011.08.05 18:05:29 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-19.xml
[2007.11.05 23:42:58 | 000,000,949 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-2.xml
[2011.09.01 22:48:08 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-20.xml
[2007.11.27 22:45:15 | 000,000,949 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-3.xml
[2009.05.13 19:07:53 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-4.xml
[2010.06.23 20:00:54 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-5.xml
[2010.06.28 00:08:50 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-6.xml
[2010.07.22 13:15:12 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-7.xml
[2010.07.26 10:58:21 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-8.xml
[2010.09.08 21:35:51 | 000,000,950 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-9.xml
[2011.08.05 18:05:07 | 000,000,168 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin.gif
[2011.08.05 18:05:07 | 000,000,618 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin.src
[2011.03.30 15:14:34 | 000,001,042 | ---- | M] () -- C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin.xml
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - No CLSID value found.
O2 - BHO: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Programme\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {8DBB6D8E-E4A6-4E3B-9753-AF78B226441C} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {ED4BD629-C1B6-4399-8A34-02CCAA921DC9} - No CLSID value found.
O4 - HKCU..\Run: [EA Core]  File not found
O4 - HKCU..\Run: [ICQ]  File not found
O4 - HKCU..\Run: [msnmsgr]  File not found
O4 - HKCU..\Run: [Pando Media Booster] C:\Programme\Pando Networks\Media Booster\PMB.exe ()
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
[2011.01.03 00:22:14 | 000,073,728 | ---- | C] () -- C:\Windows\System32\GkSui18.EXE
[2008.10.18 16:40:43 | 000,004,984 | ---- | C] () -- C:\ProgramData\jexqjxsy.dne
@Alternate Data Stream - 481 bytes -> C:\ProgramData\TEMP:05EE1EEF
@Alternate Data Stream - 106 bytes -> C:\ProgramData\TEMP:DFC5A2B2
:Commands
[emptytemp]
[resethosts]
Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

hallohallo1 04.09.2011 13:29
Code:
All processes killed
========== OTL ==========
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Local Page| /E : value set successfully!
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{855F3B16-6D32-4fe6-8A56-BBB695989046} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{855F3B16-6D32-4fe6-8A56-BBB695989046}\ not found.
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\StartPageCache| /E : value set successfully!
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\ deleted successfully.
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{40c3cc16-7269-4b32-9531-17f2950fb06f} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{40c3cc16-7269-4b32-9531-17f2950fb06f}\ not found.
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{8dbb6d8e-e4a6-4e3b-9753-af78b226441c} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8dbb6d8e-e4a6-4e3b-9753-af78b226441c}\ not found.
Prefs.js: "Ask.com" removed from browser.search.defaultengine
Prefs.js: "ICQ Search" removed from browser.search.defaultenginename
Prefs.js: "Winload Customized Web Search" removed from browser.search.defaultthis.engineName
Prefs.js: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2319825&SearchSource=3&q={searchTerms}" removed from browser.search.defaulturl
Prefs.js: "Ask.com" removed from browser.search.order.1
Prefs.js: "hxxp://start.icq.com/" removed from browser.startup.homepage
Prefs.js: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2319825&q=" removed from keyword.URL
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f}\searchplugin folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f}\modules folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f}\META-INF folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f}\defaults folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f}\components folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f}\chrome folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f} folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}\META-INF folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}\defaults\preferences folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}\defaults folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}\components folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}\chrome folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\search_engine folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\META-INF folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\defaults\preferences folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\defaults folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\components folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\skin folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\tr folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\sk folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\ru folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\it folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\he folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\fr folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\es folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\en-US folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\de folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\cs folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\bg folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\content\img folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\content folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07} folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{888d99e7-e8b5-46a3-851e-1ec45da1e644}\chrome folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{888d99e7-e8b5-46a3-851e-1ec45da1e644} folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{AA994882-F391-4d2e-806F-8908DA4814ED}\settings folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{AA994882-F391-4d2e-806F-8908DA4814ED}\components folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{AA994882-F391-4d2e-806F-8908DA4814ED}\chrome folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{AA994882-F391-4d2e-806F-8908DA4814ED} folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}\chrome folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C} folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{b69a9db4-d0a1-4722-b56b-f20757a29cdf} folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}\searchplugin folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}\META-INF folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}\lib folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}\defaults folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}\components folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}\chrome folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f} folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\staged-xpis\{b69a9db4-d0a1-4722-b56b-f20757a29cdf} folder moved successfully.
C:\Users\Fabian\AppData\Roaming\mozilla\Firefox\Profiles\5vl12vjn.default\extensions\staged-xpis folder moved successfully.
C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\askcom.xml moved successfully.
C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\conduit.xml moved successfully.
C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\daemon-search.xml moved successfully.
C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-1.xml moved successfully.
C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-10.xml moved successfully.
C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-11.xml moved successfully.
C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-12.xml moved successfully.
C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-13.xml moved successfully.
C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-14.xml moved successfully.
C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-15.xml moved successfully.
C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-16.xml moved successfully.
C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-17.xml moved successfully.
C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-18.xml moved successfully.
C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-19.xml moved successfully.
C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-2.xml moved successfully.
C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-20.xml moved successfully.
C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-3.xml moved successfully.
C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-4.xml moved successfully.
C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-5.xml moved successfully.
C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-6.xml moved successfully.
C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-7.xml moved successfully.
C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-8.xml moved successfully.
C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin-9.xml moved successfully.
C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin.gif moved successfully.
C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin.src moved successfully.
C:\Users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\searchplugins\icqplugin.xml moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1E8A6170-7264-4D0F-BEAE-D42A53123C75}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1E8A6170-7264-4D0F-BEAE-D42A53123C75}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{30F9B915-B755-4826-820B-08FBA6BD249D}\ deleted successfully.
C:\Programme\ConduitEngine\prxConduitEngine.dll moved successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{855F3B16-6D32-4FE6-8A56-BBB695989046} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{855F3B16-6D32-4FE6-8A56-BBB695989046}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{8DBB6D8E-E4A6-4E3B-9753-AF78B226441C} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8DBB6D8E-E4A6-4E3B-9753-AF78B226441C}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{ED4BD629-C1B6-4399-8A34-02CCAA921DC9} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ED4BD629-C1B6-4399-8A34-02CCAA921DC9}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\EA Core deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\ICQ deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\msnmsgr deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\Pando Media Booster deleted successfully.
C:\Programme\Pando Networks\Media Booster\PMB.exe moved successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
C:\autoexec.bat moved successfully.
C:\Windows\System32\GkSui18.EXE moved successfully.
C:\ProgramData\jexqjxsy.dne moved successfully.
ADS C:\ProgramData\TEMP:05EE1EEF deleted successfully.
ADS C:\ProgramData\TEMP:DFC5A2B2 deleted successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: asasas
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Fabian
->Temp folder emptied: 70557407 bytes
->Temporary Internet Files folder emptied: 140723361 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 47514330 bytes
->Google Chrome cache emptied: 0 bytes
->Apple Safari cache emptied: 0 bytes
->Flash cache emptied: 10623 bytes
 
User: Gast
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: Public
->Temp folder emptied: 0 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 867504 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 248,00 mb
 
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
OTL by OldTimer - Version 3.2.26.5 log created on 09042011_142014

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

cosinus 04.09.2011 13:49
Bitte nun dieses Tool von Kaspersky ausführen und das Log posten => http://www.trojaner-board.de/82358-t...entfernen.html

Das Tool so einstellen wie unten im Bild angegeben - also beide Haken setzen, auf Start scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.

http://www.trojaner-board.de/attachm...rnen-start.png


Falls du durch die Infektion auf deine Dokumente/Eigenen Dateien nicht zugreifen kannst, Verknüpfungen auf dem Desktop oder im Startmenü unter "alle Programme" fehlen, bitte unhide ausführen:
Downloade dir bitte unhide.exe und speichere diese Datei auf deinem Desktop.
Starte das Tool und es sollten alle Dateien und Ordner wieder sichtbar sein. ( Könnte eine Weile dauern )
http://www.trojaner-board.de/images/icons/icon4.gif Windows-Vista und Windows-7-User müssen das Tool per Rechtsklick als Administrator ausführen! http://www.trojaner-board.de/images/icons/icon4.gif

hallohallo1 04.09.2011 14:09
Code:
2011/09/04 15:05:52.0890 3092        TDSS rootkit removing tool 2.5.17.0 Aug 22 2011 15:46:57
2011/09/04 15:05:53.0093 3092        ================================================================================
2011/09/04 15:05:53.0093 3092        SystemInfo:
2011/09/04 15:05:53.0093 3092       
2011/09/04 15:05:53.0093 3092        OS Version: 6.0.6000 ServicePack: 0.0
2011/09/04 15:05:53.0093 3092        Product type: Workstation
2011/09/04 15:05:53.0093 3092        ComputerName: FABIAN-PC
2011/09/04 15:05:53.0093 3092        UserName: Fabian
2011/09/04 15:05:53.0093 3092        Windows directory: C:\Windows
2011/09/04 15:05:53.0093 3092        System windows directory: C:\Windows
2011/09/04 15:05:53.0093 3092        Processor architecture: Intel x86
2011/09/04 15:05:53.0093 3092        Number of processors: 2
2011/09/04 15:05:53.0093 3092        Page size: 0x1000
2011/09/04 15:05:53.0093 3092        Boot type: Normal boot
2011/09/04 15:05:53.0093 3092        ================================================================================
2011/09/04 15:05:53.0936 3092        Initialize success
2011/09/04 15:06:03.0514 4912        ================================================================================
2011/09/04 15:06:03.0514 4912        Scan started
2011/09/04 15:06:03.0514 4912        Mode: Manual;
2011/09/04 15:06:03.0514 4912        ================================================================================
2011/09/04 15:06:04.0606 4912        ACPI            (192bdbd1540645c4a2aa69f24cce197f) C:\Windows\system32\drivers\acpi.sys
2011/09/04 15:06:04.0684 4912        adp94xx        (2edc5bbac6c651ece337bde8ed97c9fb) C:\Windows\system32\drivers\adp94xx.sys
2011/09/04 15:06:04.0762 4912        adpahci        (b84088ca3cdca97da44a984c6ce1ccad) C:\Windows\system32\drivers\adpahci.sys
2011/09/04 15:06:04.0824 4912        adpu160m        (7880c67bccc27c86fd05aa2afb5ea469) C:\Windows\system32\drivers\adpu160m.sys
2011/09/04 15:06:04.0902 4912        adpu320        (9ae713f8e30efc2abccd84904333df4d) C:\Windows\system32\drivers\adpu320.sys
2011/09/04 15:06:04.0980 4912        AFD            (5d24caf8efd924a875698ff28384db8b) C:\Windows\system32\drivers\afd.sys
2011/09/04 15:06:05.0043 4912        agp440          (ef23439cdd587f64c2c1b8825cead7d8) C:\Windows\system32\drivers\agp440.sys
2011/09/04 15:06:05.0105 4912        aic78xx        (ae1fdf7bf7bb6c6a70f67699d880592a) C:\Windows\system32\drivers\djsvs.sys
2011/09/04 15:06:05.0168 4912        aliide          (90395b64600ebb4552e26e178c94b2e4) C:\Windows\system32\drivers\aliide.sys
2011/09/04 15:06:05.0230 4912        amdagp          (2b13e304c9dfdfa5eb582f6a149fa2c7) C:\Windows\system32\drivers\amdagp.sys
2011/09/04 15:06:05.0277 4912        amdide          (0577df1d323fe75a739c787893d300ea) C:\Windows\system32\drivers\amdide.sys
2011/09/04 15:06:05.0339 4912        AmdK7          (dc487885bcef9f28eece6fac0e5ddfc5) C:\Windows\system32\drivers\amdk7.sys
2011/09/04 15:06:05.0402 4912        AmdK8          (0ca0071da4315b00fc1328ca86b425da) C:\Windows\system32\DRIVERS\amdk8.sys
2011/09/04 15:06:05.0542 4912        arc            (5f673180268bb1fdb69c99b6619fe379) C:\Windows\system32\drivers\arc.sys
2011/09/04 15:06:05.0604 4912        arcsas          (957f7540b5e7f602e44648c7de5a1c05) C:\Windows\system32\drivers\arcsas.sys
2011/09/04 15:06:05.0682 4912        ASPI            (e54e27976e2c5a6465d44c10b1d87ac0) C:\Windows\System32\DRIVERS\ASPI32.sys
2011/09/04 15:06:05.0745 4912        AsyncMac        (e86cf7ce67d5de898f27ef884dc357d8) C:\Windows\system32\DRIVERS\asyncmac.sys
2011/09/04 15:06:05.0792 4912        atapi          (28d0c21db4ffed1bbfb42e9aa34e0c0d) C:\Windows\system32\drivers\atapi.sys
2011/09/04 15:06:05.0838 4912        AtiPcie        (a356e45e8432432c06981ea63a1e0fe8) C:\Windows\system32\DRIVERS\AtiPcie.sys
2011/09/04 15:06:05.0963 4912        avgio          (71a751d7f8b0219bcf827596fc5af318) C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgio.sys
2011/09/04 15:06:06.0010 4912        avgntflt        (cf8a756118fc374c494fb8c86c03bcc7) C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgntflt.sys
2011/09/04 15:06:06.0057 4912        avipbb          (fdba6800835b9628ef401f642284ce55) C:\Windows\system32\DRIVERS\avipbb.sys
2011/09/04 15:06:06.0119 4912        Beep            (ac3dd1708b22761ebd7cbe14dcc3b5d7) C:\Windows\system32\drivers\Beep.sys
2011/09/04 15:06:06.0244 4912        bowser          (913cd06fbe9105ce6077e90fd4418561) C:\Windows\system32\DRIVERS\bowser.sys
2011/09/04 15:06:06.0322 4912        BrFiltLo        (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\drivers\brfiltlo.sys
2011/09/04 15:06:06.0384 4912        BrFiltUp        (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\drivers\brfiltup.sys
2011/09/04 15:06:06.0447 4912        Brserid        (b304e75cff293029eddf094246747113) C:\Windows\system32\drivers\brserid.sys
2011/09/04 15:06:06.0556 4912        BrSerWdm        (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\system32\drivers\brserwdm.sys
2011/09/04 15:06:06.0603 4912        BrUsbMdm        (bd456606156ba17e60a04e18016ae54b) C:\Windows\system32\drivers\brusbmdm.sys
2011/09/04 15:06:06.0634 4912        BrUsbSer        (af72ed54503f717a43268b3cc5faec2e) C:\Windows\system32\drivers\brusbser.sys
2011/09/04 15:06:06.0681 4912        BTHMODEM        (ad07c1ec6665b8b35741ab91200c6b68) C:\Windows\system32\drivers\bthmodem.sys
2011/09/04 15:06:06.0852 4912        cdfs            (6c3a437fc873c6f6a4fc620b6888cb86) C:\Windows\system32\DRIVERS\cdfs.sys
2011/09/04 15:06:06.0899 4912        cdrom          (8d1866e61af096ae8b582454f5e4d303) C:\Windows\system32\DRIVERS\cdrom.sys
2011/09/04 15:06:06.0962 4912        circlass        (da8e0afc7baa226c538ef53ac2f90897) C:\Windows\system32\drivers\circlass.sys
2011/09/04 15:06:07.0040 4912        CLFS            (1b84fd0937d3b99af9ba38ddff3daf54) C:\Windows\system32\CLFS.sys
2011/09/04 15:06:07.0118 4912        cmdide          (45201046c776ffdaf3fc8a0029c581c8) C:\Windows\system32\drivers\cmdide.sys
2011/09/04 15:06:07.0180 4912        Compbatt        (82b8c91d327cfecf76cb58716f7d4997) C:\Windows\system32\drivers\compbatt.sys
2011/09/04 15:06:07.0227 4912        crcdisk        (2a213ae086bbec5e937553c7d9a2b22c) C:\Windows\system32\drivers\crcdisk.sys
2011/09/04 15:06:07.0289 4912        Crusoe          (22a7f883508176489f559ee745b5bf5d) C:\Windows\system32\drivers\crusoe.sys
2011/09/04 15:06:07.0398 4912        DfsC            (a7179de59ae269ab70345527894ccd7c) C:\Windows\system32\Drivers\dfsc.sys
2011/09/04 15:06:07.0461 4912        disk            (841af4c4d41d3e3b2f244e976b0f7963) C:\Windows\system32\drivers\disk.sys
2011/09/04 15:06:07.0554 4912        drmkaud        (ee472cd2c01f6f8e8aa1fa06ffef61b6) C:\Windows\system32\drivers\drmkaud.sys
2011/09/04 15:06:07.0632 4912        DXGKrnl        (2d13d9e98caf6321f219b28921af214c) C:\Windows\System32\drivers\dxgkrnl.sys
2011/09/04 15:06:07.0710 4912        E1G60          (f88fb26547fd2ce6d0a5af2985892c48) C:\Windows\system32\DRIVERS\E1G60I32.sys
2011/09/04 15:06:07.0773 4912        Ecache          (38573398f734b71b06cd2411494f234a) C:\Windows\system32\drivers\ecache.sys
2011/09/04 15:06:07.0882 4912        eeCtrl          (8f7dbc4be48f5388a6fe1f285e7948ef) C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys
2011/09/04 15:06:08.0147 4912        elxstor        (e8f3f21a71720c84bcf423b80028359f) C:\Windows\system32\drivers\elxstor.sys
2011/09/04 15:06:08.0256 4912        enodpl          (b4556f3d468c8dcb0b259d9d866cd4c4) C:\Windows\system32\drivers\enodpl.sys
2011/09/04 15:06:08.0397 4912        fastfat        (84a317cb0b3954d3768cdcd018dbf670) C:\Windows\system32\drivers\fastfat.sys
2011/09/04 15:06:08.0475 4912        fdc            (63bdada84951b9c03e641800e176898a) C:\Windows\system32\DRIVERS\fdc.sys
2011/09/04 15:06:08.0522 4912        FileInfo        (65773d6115c037ffd7ef8280ae85eb9d) C:\Windows\system32\drivers\fileinfo.sys
2011/09/04 15:06:08.0568 4912        Filetrace      (c226dd0de060745f3e042f58dcf78402) C:\Windows\system32\drivers\filetrace.sys
2011/09/04 15:06:08.0631 4912        flpydisk        (6603957eff5ec62d25075ea8ac27de68) C:\Windows\system32\DRIVERS\flpydisk.sys
2011/09/04 15:06:08.0678 4912        FltMgr          (a6a8da7ae4d53394ab22ac3ab6d3f5d3) C:\Windows\system32\drivers\fltmgr.sys
2011/09/04 15:06:08.0771 4912        Fs_Rec          (66a078591208baa210c7634b11eb392c) C:\Windows\system32\drivers\Fs_Rec.sys
2011/09/04 15:06:08.0880 4912        gagp30kx        (4e1cd0a45c50a8882616cae5bf82f3c5) C:\Windows\system32\drivers\gagp30kx.sys
2011/09/04 15:06:08.0943 4912        GEARAspiWDM    (8182ff89c65e4d38b2de4bb0fb18564e) C:\Windows\system32\DRIVERS\GEARAspiWDM.sys
2011/09/04 15:06:09.0005 4912        GRD            (1524d3a6850ee14e88d860c3696100c0) C:\Windows\system32\drivers\GRD.sys
2011/09/04 15:06:09.0099 4912        HdAudAddService (cb04c744be0a61b1d648faed182c3b59) C:\Windows\system32\drivers\HdAudio.sys
2011/09/04 15:06:09.0161 4912        HDAudBus        (0db613a7e427b5663563677796fd5258) C:\Windows\system32\DRIVERS\HDAudBus.sys
2011/09/04 15:06:09.0286 4912        HidBth          (1338520e78d90154ed6be8f84de5fceb) C:\Windows\system32\drivers\hidbth.sys
2011/09/04 15:06:09.0395 4912        HidIr          (ff3160c3a2445128c5a6d9b076da519e) C:\Windows\system32\drivers\hidir.sys
2011/09/04 15:06:09.0473 4912        HidUsb          (01e7971e9f4bd6ac6a08db52d0ea0418) C:\Windows\system32\DRIVERS\hidusb.sys
2011/09/04 15:06:09.0551 4912        HpCISSs        (df353b401001246853763c4b7aaa6f50) C:\Windows\system32\drivers\hpcisss.sys
2011/09/04 15:06:09.0598 4912        HTTP            (f31d27ccf514549a17e79bebe01b40b6) C:\Windows\system32\drivers\HTTP.sys
2011/09/04 15:06:09.0848 4912        i2omp          (324c2152ff2c61abae92d09f3cca4d63) C:\Windows\system32\drivers\i2omp.sys
2011/09/04 15:06:09.0941 4912        i8042prt        (bea9838cd25d36beba3f94386a761d60) C:\Windows\system32\DRIVERS\i8042prt.sys
2011/09/04 15:06:10.0004 4912        iaStor          (2358c53f30cb9dcd1d3843c4e2f299b2) C:\Windows\system32\drivers\iastor.sys
2011/09/04 15:06:10.0066 4912        iaStorV        (c957bf4b5d80b46c5017bf0101e6c906) C:\Windows\system32\drivers\iastorv.sys
2011/09/04 15:06:10.0160 4912        iirsp          (2d077bf86e843f901d8db709c95b49a5) C:\Windows\system32\drivers\iirsp.sys
2011/09/04 15:06:10.0253 4912        IKFileSec      (bb07262041a213fea5fccf0a9f90d85a) C:\Windows\system32\drivers\ikfilesec.sys
2011/09/04 15:06:10.0284 4912        IKSysFlt        (b2581314d54f8de4262f0a51f7ba63d0) C:\Windows\system32\drivers\iksysflt.sys
2011/09/04 15:06:10.0331 4912        IKSysSec        (6f544cd764f949170b46a4dab11673e2) C:\Windows\system32\drivers\iksyssec.sys
2011/09/04 15:06:10.0456 4912        IntcAzAudAddService (4de88b49c891f45cd9ea6d83a341d3e3) C:\Windows\system32\drivers\RTKVHDA.sys
2011/09/04 15:06:10.0581 4912        intelide        (97469037714070e45194ed318d636401) C:\Windows\system32\drivers\intelide.sys
2011/09/04 15:06:10.0612 4912        intelppm        (ce44cc04262f28216dd4341e9e36a16f) C:\Windows\system32\DRIVERS\intelppm.sys
2011/09/04 15:06:10.0659 4912        IpFilterDriver  (880c6f86cc3f551b8fea2c11141268c0) C:\Windows\system32\DRIVERS\ipfltdrv.sys
2011/09/04 15:06:10.0768 4912        IPMIDRV        (40f34f8aba2a015d780e4b09138b6c17) C:\Windows\system32\drivers\ipmidrv.sys
2011/09/04 15:06:10.0862 4912        IPNAT          (10077c35845101548037df04fd1a420b) C:\Windows\system32\DRIVERS\ipnat.sys
2011/09/04 15:06:10.0940 4912        IRENUM          (a82f328f4792304184642d6d397bb1e3) C:\Windows\system32\drivers\irenum.sys
2011/09/04 15:06:10.0986 4912        isapnp          (350fca7e73cf65bcef43fae1e4e91293) C:\Windows\system32\drivers\isapnp.sys
2011/09/04 15:06:11.0033 4912        iScsiPrt        (4dca456d4d5723f8fa9c6760d240b0df) C:\Windows\system32\DRIVERS\msiscsi.sys
2011/09/04 15:06:11.0096 4912        iteatapi        (bced60d16156e428f8df8cf27b0df150) C:\Windows\system32\drivers\iteatapi.sys
2011/09/04 15:06:11.0142 4912        iteraid        (06fa654504a498c30adca8bec4e87e7e) C:\Windows\system32\drivers\iteraid.sys
2011/09/04 15:06:11.0189 4912        JRAID          (c1632fe31d1824a43dea29725312e3fa) C:\Windows\system32\drivers\jraid.sys
2011/09/04 15:06:11.0252 4912        kbdclass        (c9b0cf786d5f151a43c7be8e243f2819) C:\Windows\system32\DRIVERS\kbdclass.sys
2011/09/04 15:06:11.0283 4912        kbdhid          (97ab2fb84e8e77d93cee85550f4cf7f9) C:\Windows\system32\DRIVERS\kbdhid.sys
2011/09/04 15:06:11.0376 4912        KSecDD          (11d0bc1f2afd8abbb5a3dc47a042de54) C:\Windows\system32\Drivers\ksecdd.sys
2011/09/04 15:06:11.0548 4912        lltdio          (fd015b4f95daa2b712f0e372a116fbad) C:\Windows\system32\DRIVERS\lltdio.sys
2011/09/04 15:06:11.0673 4912        LSI_FC          (a2262fb9f28935e862b4db46438c80d2) C:\Windows\system32\drivers\lsi_fc.sys
2011/09/04 15:06:11.0766 4912        LSI_SAS        (30d73327d390f72a62f32c103daf1d6d) C:\Windows\system32\drivers\lsi_sas.sys
2011/09/04 15:06:11.0829 4912        LSI_SCSI        (e1e36fefd45849a95f1ab81de0159fe3) C:\Windows\system32\drivers\lsi_scsi.sys
2011/09/04 15:06:11.0907 4912        luafv          (42885bb44b6e065b8575a8dd6c430c52) C:\Windows\system32\drivers\luafv.sys
2011/09/04 15:06:12.0000 4912        megasas        (d153b14fc6598eae8422a2037553adce) C:\Windows\system32\drivers\megasas.sys
2011/09/04 15:06:12.0094 4912        Modem          (21755967298a46fb6adfec9db6012211) C:\Windows\system32\drivers\modem.sys
2011/09/04 15:06:12.0172 4912        monitor        (47c09851f763f2e03bfadd581747ecec) C:\Windows\system32\DRIVERS\monitor.sys
2011/09/04 15:06:12.0219 4912        mouclass        (4a00b3cf90ad075193ca5aeece71154c) C:\Windows\system32\DRIVERS\mouclass.sys
2011/09/04 15:06:12.0266 4912        mouhid          (8d9b701d716843c39e93b3432cb721fc) C:\Windows\system32\DRIVERS\mouhid.sys
2011/09/04 15:06:12.0312 4912        MountMgr        (01f1e5a3e4877c931cbb31613fec16a6) C:\Windows\system32\drivers\mountmgr.sys
2011/09/04 15:06:12.0375 4912        mpio            (583a41f26278d9e0ea548163d6139397) C:\Windows\system32\drivers\mpio.sys
2011/09/04 15:06:12.0437 4912        mpsdrv          (6e7a7f0c1193ee5648443fe2d4b789ec) C:\Windows\system32\drivers\mpsdrv.sys
2011/09/04 15:06:12.0484 4912        Mraid35x        (4fbbb70d30fd20ec51f80061703b001e) C:\Windows\system32\drivers\mraid35x.sys
2011/09/04 15:06:12.0546 4912        MRxDAV          (08f0c494a69cf3106ee7ffc48d8e5ac7) C:\Windows\system32\drivers\mrxdav.sys
2011/09/04 15:06:12.0593 4912        mrxsmb          (dc5632cbc8a3d02ce1114debb64b7037) C:\Windows\system32\DRIVERS\mrxsmb.sys
2011/09/04 15:06:12.0640 4912        mrxsmb10        (f813456c00b904dc3b6558cad7b13bba) C:\Windows\system32\DRIVERS\mrxsmb10.sys
2011/09/04 15:06:12.0671 4912        mrxsmb20        (30a67c7d8b80281028916ded6a64aec9) C:\Windows\system32\DRIVERS\mrxsmb20.sys
2011/09/04 15:06:12.0718 4912        msahci          (742aed7939e734c36b7e8d6228ce26b7) C:\Windows\system32\drivers\msahci.sys
2011/09/04 15:06:12.0765 4912        msdsm          (3fc82a2ae4cc149165a94699183d3028) C:\Windows\system32\drivers\msdsm.sys
2011/09/04 15:06:12.0812 4912        Msfs            (729eafefd4e7417165f353a18dbe947d) C:\Windows\system32\drivers\Msfs.sys
2011/09/04 15:06:12.0874 4912        msisadrv        (0a64168b63535520adfd6b959695404a) C:\Windows\system32\drivers\msisadrv.sys
2011/09/04 15:06:12.0952 4912        MSKSSRV        (892cedefa7e0ffe7be8da651b651d047) C:\Windows\system32\drivers\MSKSSRV.sys
2011/09/04 15:06:12.0999 4912        MSPCLOCK        (ae2cb1da69b2676b4cee2a501af5871c) C:\Windows\system32\drivers\MSPCLOCK.sys
2011/09/04 15:06:13.0014 4912        MSPQM          (f910da84fa90c44a3addb7cd874463fd) C:\Windows\system32\drivers\MSPQM.sys
2011/09/04 15:06:13.0077 4912        MsRPC          (84571c0ae07647ba38d493f5f0015df7) C:\Windows\system32\drivers\MsRPC.sys
2011/09/04 15:06:13.0217 4912        mssmbios        (e09cedb1bca303b7f6ae22f512e56969) C:\Windows\system32\DRIVERS\mssmbios.sys
2011/09/04 15:06:13.0280 4912        MSTEE          (c826dd1373f38afd9ca46ec3c436a14e) C:\Windows\system32\drivers\MSTEE.sys
2011/09/04 15:06:13.0326 4912        Mup            (fa7aa70050cf5e2d15de00941e5665e5) C:\Windows\system32\Drivers\mup.sys
2011/09/04 15:06:13.0420 4912        NativeWifiP    (be8c26e61be5c5a49a6babd17aeed1b7) C:\Windows\system32\DRIVERS\nwifi.sys
2011/09/04 15:06:13.0498 4912        NDIS            (6e8dfface597629cef5df7d69217628f) C:\Windows\system32\drivers\ndis.sys
2011/09/04 15:06:13.0576 4912        NdisTapi        (81659cdcbd0f9a9e07e6878ad8c78d3f) C:\Windows\system32\DRIVERS\ndistapi.sys
2011/09/04 15:06:13.0623 4912        Ndisuio        (5de5ee546bf40838ebe0e01cb629df64) C:\Windows\system32\DRIVERS\ndisuio.sys
2011/09/04 15:06:13.0670 4912        NdisWan        (397402adcbb8946223a1950101f6cd94) C:\Windows\system32\DRIVERS\ndiswan.sys
2011/09/04 15:06:13.0716 4912        NDProxy        (1b24fa907af283199a81b3bb37e5e526) C:\Windows\system32\drivers\NDProxy.sys
2011/09/04 15:06:13.0763 4912        NetBIOS        (356dbb9f98e8dc1028dd3092fceeb877) C:\Windows\system32\DRIVERS\netbios.sys
2011/09/04 15:06:13.0794 4912        netbt          (231f6ccfdb7a604221f18fb0852c8560) C:\Windows\system32\DRIVERS\netbt.sys
2011/09/04 15:06:13.0888 4912        nfrd960        (2e7fb731d4790a1bc6270accefacb36e) C:\Windows\system32\drivers\nfrd960.sys
2011/09/04 15:06:13.0966 4912        Npfs            (4f9832beb9fafd8ceb0e541f1323b26e) C:\Windows\system32\drivers\Npfs.sys
2011/09/04 15:06:14.0044 4912        nsiproxy        (b488dfec274de1fc9d653870ef2587be) C:\Windows\system32\drivers\nsiproxy.sys
2011/09/04 15:06:14.0153 4912        Ntfs            (01db57ff55bcf719545570f3bd050000) C:\Windows\system32\drivers\Ntfs.sys
2011/09/04 15:06:14.0262 4912        ntrigdigi      (e875c093aec0c978a90f30c9e0dfbb72) C:\Windows\system32\drivers\ntrigdigi.sys
2011/09/04 15:06:14.0294 4912        Null            (ec5efb3c60f1b624648344a328bce596) C:\Windows\system32\drivers\Null.sys
2011/09/04 15:06:14.0606 4912        nvlddmkm        (f623c2b16fde938b908031aeba445344) C:\Windows\system32\DRIVERS\nvlddmkm.sys
2011/09/04 15:06:14.0996 4912        nvraid          (e69e946f80c1c31c53003bfbf50cbb7c) C:\Windows\system32\drivers\nvraid.sys
2011/09/04 15:06:15.0089 4912        nvrd32          (ed399014a8029de02ba5ae01da8cc9ee) C:\Windows\system32\drivers\nvrd32.sys
2011/09/04 15:06:15.0136 4912        nvstor          (9e0ba19a28c498a6d323d065db76dffc) C:\Windows\system32\drivers\nvstor.sys
2011/09/04 15:06:15.0183 4912        nvstor32        (703e3a7093b0fac0eebadbb8e931ecaf) C:\Windows\system32\drivers\nvstor32.sys
2011/09/04 15:06:15.0245 4912        nv_agp          (07c186427eb8fcc3d8d7927187f260f7) C:\Windows\system32\drivers\nv_agp.sys
2011/09/04 15:06:15.0448 4912        ohci1394        (8994cbfc215a9ef4495e6ae7992954fc) C:\Windows\system32\DRIVERS\ohci1394.sys
2011/09/04 15:06:15.0557 4912        Parport        (0fa9b5055484649d63c303fe404e5f4d) C:\Windows\system32\drivers\parport.sys
2011/09/04 15:06:15.0604 4912        partmgr        (555a5b2c8022983bc7467bc925b222ee) C:\Windows\system32\drivers\partmgr.sys
2011/09/04 15:06:15.0635 4912        Parvdm          (4f9a6a8a31413180d0fcb279ad5d8112) C:\Windows\system32\drivers\parvdm.sys
2011/09/04 15:06:15.0698 4912        pci            (a48c4d0acc933f7a37e52ab0761811ad) C:\Windows\system32\drivers\pci.sys
2011/09/04 15:06:15.0729 4912        pciide          (3a1efd3fd478c8a6d528ec297dbcb36f) C:\Windows\system32\drivers\pciide.sys
2011/09/04 15:06:15.0776 4912        pcmcia          (e6f3fb1b86aa519e7698ad05e58b04e5) C:\Windows\system32\drivers\pcmcia.sys
2011/09/04 15:06:15.0854 4912        PEAUTH          (6349f6ed9c623b44b52ea3c63c831a92) C:\Windows\system32\drivers\peauth.sys
2011/09/04 15:06:16.0088 4912        PptpMiniport    (c04dec5ace67c5247b150c4223970bb7) C:\Windows\system32\DRIVERS\raspptp.sys
2011/09/04 15:06:16.0150 4912        Processor      (0e3cef5d28b40cf273281d620c50700a) C:\Windows\system32\drivers\processr.sys
2011/09/04 15:06:16.0228 4912        PSched          (2c8bae55247c4e09352e870292e4d1ab) C:\Windows\system32\DRIVERS\pacer.sys
2011/09/04 15:06:16.0306 4912        ql2300          (ccdac889326317792480c0a67156a1ec) C:\Windows\system32\drivers\ql2300.sys
2011/09/04 15:06:16.0384 4912        ql40xx          (81a7e5c076e59995d54bc1ed3a16e60b) C:\Windows\system32\drivers\ql40xx.sys
2011/09/04 15:06:16.0462 4912        QWAVEdrv        (d2b3e2b7426dc23e185fbc73c8936c12) C:\Windows\system32\drivers\qwavedrv.sys
2011/09/04 15:06:16.0493 4912        RasAcd          (bd7b30f55b3649506dd8b3d38f571d2a) C:\Windows\system32\DRIVERS\rasacd.sys
2011/09/04 15:06:16.0571 4912        Rasl2tp        (68b0019fee429ec49d29017af937e482) C:\Windows\system32\DRIVERS\rasl2tp.sys
2011/09/04 15:06:16.0634 4912        RasPppoe        (ccf4e9c6cbbac81437f88cb2ae0b6c96) C:\Windows\system32\DRIVERS\raspppoe.sys
2011/09/04 15:06:16.0680 4912        rdbss          (54129c5d9581bbec8bd1ebd3ba813f47) C:\Windows\system32\DRIVERS\rdbss.sys
2011/09/04 15:06:16.0727 4912        RDPCDD          (794585276b5d7fca9f3fc15543f9f0b9) C:\Windows\system32\DRIVERS\RDPCDD.sys
2011/09/04 15:06:16.0790 4912        rdpdr          (e8bd98d46f2ed77132ba927fccb47d8b) C:\Windows\system32\drivers\rdpdr.sys
2011/09/04 15:06:16.0836 4912        RDPENCDD        (980b56e2e273e19d3a9d72d5c420f008) C:\Windows\system32\drivers\rdpencdd.sys
2011/09/04 15:06:16.0914 4912        RDPWD          (8830e790a74a96605faba74f9665bb3c) C:\Windows\system32\drivers\RDPWD.sys
2011/09/04 15:06:17.0008 4912        rspndr          (97e939d2128fec5d5a3e6e79b290a2f4) C:\Windows\system32\DRIVERS\rspndr.sys
2011/09/04 15:06:17.0070 4912        RTL8169        (abbe0f54ba3a378262c9cb86cf7d91f8) C:\Windows\system32\DRIVERS\Rtlh86.sys
2011/09/04 15:06:17.0117 4912        sbp2port        (3ce8f073a557e172b330109436984e30) C:\Windows\system32\drivers\sbp2port.sys
2011/09/04 15:06:17.0180 4912        SCDEmu          (16b1abe7f3e35f21dac57592b6c5d464) C:\Windows\system32\drivers\SCDEmu.sys
2011/09/04 15:06:17.0304 4912        Secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\SECDRV.SYS
2011/09/04 15:06:17.0382 4912        Serenum        (68e44e331d46f0fb38f0863a84cd1a31) C:\Windows\system32\DRIVERS\serenum.sys
2011/09/04 15:06:17.0429 4912        Serial          (c70d69a918b178d3c3b06339b40c2e1b) C:\Windows\system32\DRIVERS\serial.sys
2011/09/04 15:06:17.0476 4912        sermouse        (2baf2abc0da0d50ebe8289c720977052) C:\Windows\system32\drivers\sermouse.sys
2011/09/04 15:06:17.0601 4912        sffdisk        (103b79418da647736ee95645f305f68a) C:\Windows\system32\drivers\sffdisk.sys
2011/09/04 15:06:17.0679 4912        sffp_mmc        (8fd08a310645fe872eeec6e08c6bf3ee) C:\Windows\system32\drivers\sffp_mmc.sys
2011/09/04 15:06:17.0710 4912        sffp_sd        (9cfa05fcfcb7124e69cfc812b72f9614) C:\Windows\system32\drivers\sffp_sd.sys
2011/09/04 15:06:17.0741 4912        sfloppy        (46ed8e91793b2e6f848015445a0ac188) C:\Windows\system32\drivers\sfloppy.sys
2011/09/04 15:06:17.0835 4912        sisagp          (d2a595d6eebeeaf4334f8e50efbc9931) C:\Windows\system32\drivers\sisagp.sys
2011/09/04 15:06:17.0882 4912        SiSRaid2        (cedd6f4e7d84e9f98b34b3fe988373aa) C:\Windows\system32\drivers\sisraid2.sys
2011/09/04 15:06:17.0928 4912        SiSRaid4        (df843c528c4f69d12ce41ce462e973a7) C:\Windows\system32\drivers\sisraid4.sys
2011/09/04 15:06:18.0006 4912        Smb            (46baf398809a0f3b2d3300a1760e4b91) C:\Windows\system32\DRIVERS\smb.sys
2011/09/04 15:06:18.0084 4912        spldr          (426f9b029aa9162ceccf65369457d046) C:\Windows\system32\drivers\spldr.sys
2011/09/04 15:06:18.0178 4912        sptd            (cdddec541bc3c96f91ecb48759673505) C:\Windows\system32\Drivers\sptd.sys
2011/09/04 15:06:18.0178 4912        Suspicious file (NoAccess): C:\Windows\system32\Drivers\sptd.sys. md5: cdddec541bc3c96f91ecb48759673505
2011/09/04 15:06:18.0194 4912        sptd - detected LockedFile.Multi.Generic (1)
2011/09/04 15:06:18.0240 4912        srv            (e86bf07b1d2ec33c52b3b31e5814001a) C:\Windows\system32\DRIVERS\srv.sys
2011/09/04 15:06:18.0303 4912        srv2            (e8c4d5bca3c7b5c2a040052aa467b5bf) C:\Windows\system32\DRIVERS\srv2.sys
2011/09/04 15:06:18.0350 4912        srvnet          (8ae0f61f71e97ace067cdab67c98746b) C:\Windows\system32\DRIVERS\srvnet.sys
2011/09/04 15:06:18.0443 4912        ssmdrv          (71d609c5dff067906d930bde031c4cfe) C:\Windows\system32\DRIVERS\ssmdrv.sys
2011/09/04 15:06:18.0521 4912        swenum          (9c539aaffb0b6d7bce984c74317ff29f) C:\Windows\system32\DRIVERS\swenum.sys
2011/09/04 15:06:18.0615 4912        Symc8xx        (192aa3ac01df071b541094f251deed10) C:\Windows\system32\drivers\symc8xx.sys
2011/09/04 15:06:18.0677 4912        Sym_hi          (8c8eb8c76736ebaf3b13b633b2e64125) C:\Windows\system32\drivers\sym_hi.sys
2011/09/04 15:06:18.0724 4912        Sym_u3          (8072af52b5fd103bbba387a1e49f62cb) C:\Windows\system32\drivers\sym_u3.sys
2011/09/04 15:06:18.0786 4912        tandpl          (126d7b3b4c7b724491c604060e1f4e14) C:\Windows\system32\drivers\tandpl.sys
2011/09/04 15:06:18.0927 4912        Tcpip          (52a8bd6294f7d1443c6184c67ae13af4) C:\Windows\system32\drivers\tcpip.sys
2011/09/04 15:06:19.0083 4912        Tcpip6          (52a8bd6294f7d1443c6184c67ae13af4) C:\Windows\system32\DRIVERS\tcpip.sys
2011/09/04 15:06:19.0223 4912        tcpipreg        (5ce0c4a7b12d0067dad527d72b68c726) C:\Windows\system32\drivers\tcpipreg.sys
2011/09/04 15:06:19.0270 4912        TDPIPE          (964248aef49c31fa6a93201a73ffaf50) C:\Windows\system32\drivers\tdpipe.sys
2011/09/04 15:06:19.0317 4912        TDTCP          (7d2c1ae1648a60fce4aa0f7982e419d3) C:\Windows\system32\drivers\tdtcp.sys
2011/09/04 15:06:19.0379 4912        tdx            (7973f7239486800cd79e4fdbab6a07df) C:\Windows\system32\DRIVERS\tdx.sys
2011/09/04 15:06:19.0410 4912        TermDD          (cfe870506361bac80a549749116ad870) C:\Windows\system32\DRIVERS\termdd.sys
2011/09/04 15:06:19.0535 4912        tssecsrv        (29f0eca726f0d51f7e048bdb0b372f29) C:\Windows\system32\DRIVERS\tssecsrv.sys
2011/09/04 15:06:19.0629 4912        tunmp          (a858917785681743c512950fdfa14db7) C:\Windows\system32\DRIVERS\tunmp.sys
2011/09/04 15:06:19.0676 4912        tunnel          (29f1d1d888ee61d20d5662e72aa34129) C:\Windows\system32\DRIVERS\tunnel.sys
2011/09/04 15:06:19.0754 4912        uagp35          (c3ade15414120033a36c0f293d4a4121) C:\Windows\system32\drivers\uagp35.sys
2011/09/04 15:06:19.0832 4912        udfs            (1811e1016d96e3ea0e170f7c23804e50) C:\Windows\system32\DRIVERS\udfs.sys
2011/09/04 15:06:19.0956 4912        uliagpkx        (75e6890ebfce0841d3291b02e7a8bdb0) C:\Windows\system32\drivers\uliagpkx.sys
2011/09/04 15:06:20.0019 4912        uliahci        (3cd4ea35a6221b85dcc25daa46313f8d) C:\Windows\system32\drivers\uliahci.sys
2011/09/04 15:06:20.0097 4912        UlSata          (8514d0e5cd0534467c5fc61be94a569f) C:\Windows\system32\drivers\ulsata.sys
2011/09/04 15:06:20.0144 4912        ulsata2        (38c3c6e62b157a6bc46594fada45c62b) C:\Windows\system32\drivers\ulsata2.sys
2011/09/04 15:06:20.0206 4912        umbus          (dc8828971d997de009647fce59e0ce8f) C:\Windows\system32\DRIVERS\umbus.sys
2011/09/04 15:06:20.0300 4912        USB28xxBGA      (9b01ce1eda6ad1acfd4f865d6cb0a790) C:\Windows\system32\DRIVERS\emBDA.sys
2011/09/04 15:06:20.0362 4912        USB28xxOEM      (c93e4f6bd1cbd163662e7c9be021b895) C:\Windows\system32\DRIVERS\emOEM.sys
2011/09/04 15:06:20.0424 4912        USBAAPL        (4b8a9c16b6d9258ed99c512aecb8c555) C:\Windows\system32\Drivers\usbaapl.sys
2011/09/04 15:06:20.0502 4912        usbccgp        (03b01e8dbd2da2b49157b7e51912aaf2) C:\Windows\system32\DRIVERS\usbccgp.sys
2011/09/04 15:06:20.0549 4912        usbcir          (e9476e6c486e76bc4898074768fb7131) C:\Windows\system32\drivers\usbcir.sys
2011/09/04 15:06:20.0612 4912        usbehci        (2f83363f98484f8edaf49f9b41520d14) C:\Windows\system32\DRIVERS\usbehci.sys
2011/09/04 15:06:20.0658 4912        usbhub          (14d2a4dcd92c0b3368667aed6893463d) C:\Windows\system32\DRIVERS\usbhub.sys
2011/09/04 15:06:20.0721 4912        usbohci        (51dc36722172d45f2f935ce5cc18a812) C:\Windows\system32\DRIVERS\usbohci.sys
2011/09/04 15:06:20.0799 4912        usbprint        (b51e52acf758be00ef3a58ea452fe360) C:\Windows\system32\DRIVERS\usbprint.sys
2011/09/04 15:06:20.0861 4912        usbscan        (b1f95285c08ddfe00c0b955462637ec7) C:\Windows\system32\DRIVERS\usbscan.sys
2011/09/04 15:06:20.0939 4912        USBSTOR        (7887ce56934e7f104e98c975f47353c5) C:\Windows\system32\DRIVERS\USBSTOR.SYS
2011/09/04 15:06:21.0002 4912        usbuhci        (325dbbacb8a36af9988ccf40eac228cc) C:\Windows\system32\DRIVERS\usbuhci.sys
2011/09/04 15:06:21.0095 4912        usbvideo        (46f3a2912ef88cd8e87d4f9b304cd949) C:\Windows\system32\Drivers\usbvideo.sys
2011/09/04 15:06:21.0189 4912        VBoxNetAdp      (b9d3c274e937a15fd2cef8aa1e4c3477) C:\Windows\system32\DRIVERS\VBoxNetAdp.sys
2011/09/04 15:06:21.0314 4912        vga            (7d92be0028ecdedec74617009084b5ef) C:\Windows\system32\DRIVERS\vgapnp.sys
2011/09/04 15:06:21.0360 4912        VgaSave        (17a8f877314e4067f8c8172cc6d9101c) C:\Windows\System32\drivers\vga.sys
2011/09/04 15:06:21.0438 4912        viaagp          (045d9961e591cf0674a920b6ba3ba5cb) C:\Windows\system32\drivers\viaagp.sys
2011/09/04 15:06:21.0485 4912        ViaC7          (56a4de5f02f2e88182b0981119b4dd98) C:\Windows\system32\drivers\viac7.sys
2011/09/04 15:06:21.0532 4912        viaide          (fd2e3175fcada350c7ab4521dca187ec) C:\Windows\system32\drivers\viaide.sys
2011/09/04 15:06:21.0594 4912        viamraid        (7dc3e1dc6e4f8be381c31bfea578412a) C:\Windows\system32\drivers\viamraid.sys
2011/09/04 15:06:21.0688 4912        vmm            (590c7a3a1133e51a7e1cef67366e75af) C:\Windows\system32\Drivers\vmm.sys
2011/09/04 15:06:21.0766 4912        volmgr          (cc8a64a532fd2844ee68f4061ed8a7fd) C:\Windows\system32\drivers\volmgr.sys
2011/09/04 15:06:21.0828 4912        volmgrx        (294da8d3f965f6a8db934a83c7b461ff) C:\Windows\system32\drivers\volmgrx.sys
2011/09/04 15:06:21.0860 4912        volsnap        (11ef6c1caef76b685233450a126125d6) C:\Windows\system32\drivers\volsnap.sys
2011/09/04 15:06:21.0922 4912        VPCNetS2        (f96a678debdccb0b4bb7f38cb2580589) C:\Windows\system32\DRIVERS\VMNetSrv.sys
2011/09/04 15:06:21.0969 4912        vsmraid        (d984439746d42b30fc65a4c3546c6829) C:\Windows\system32\drivers\vsmraid.sys
2011/09/04 15:06:22.0078 4912        WacomPen        (48dfee8f1af7c8235d4e626f0c4fe031) C:\Windows\system32\drivers\wacompen.sys
2011/09/04 15:06:22.0156 4912        Wanarp          (6798c1209a53b5a0ded8d437c45145ff) C:\Windows\system32\DRIVERS\wanarp.sys
2011/09/04 15:06:22.0187 4912        Wanarpv6        (6798c1209a53b5a0ded8d437c45145ff) C:\Windows\system32\DRIVERS\wanarp.sys
2011/09/04 15:06:22.0265 4912        Wd              (afc5ad65b991c1e205cf25cfdbf7a6f4) C:\Windows\system32\drivers\wd.sys
2011/09/04 15:06:22.0343 4912        Wdf01000        (7b5f66e4a2219c7d9daf9e738480e534) C:\Windows\system32\drivers\Wdf01000.sys
2011/09/04 15:06:22.0546 4912        WmiAcpi        (701a9f884a294327e9141d73746ee279) C:\Windows\system32\drivers\wmiacpi.sys
2011/09/04 15:06:22.0671 4912        WpdUsb          (2d27171b16a577ef14c1273668753485) C:\Windows\system32\DRIVERS\wpdusb.sys
2011/09/04 15:06:22.0733 4912        ws2ifsl        (84620aecdcfd2a7a14e6263927d8c0ed) C:\Windows\system32\drivers\ws2ifsl.sys
2011/09/04 15:06:22.0811 4912        WUDFRd          (ee0974d4042da9cf4c569ac4eca8c9c0) C:\Windows\system32\DRIVERS\WUDFRd.sys
2011/09/04 15:06:22.0874 4912        MBR (0x1B8)    (5c616939100b85e558da92b899a0fc36) \Device\Harddisk0\DR0
2011/09/04 15:06:22.0920 4912        Boot (0x1200)  (0a140da3497d9a9e788655e7a080b614) \Device\Harddisk0\DR0\Partition0
2011/09/04 15:06:22.0967 4912        Boot (0x1200)  (a3c54cb350ecb343b9505df3004dfd6c) \Device\Harddisk0\DR0\Partition1
2011/09/04 15:06:22.0998 4912        Boot (0x1200)  (443756b766fa81e5a2d93d886ca9e6fa) \Device\Harddisk0\DR0\Partition2
2011/09/04 15:06:23.0014 4912        ================================================================================
2011/09/04 15:06:23.0014 4912        Scan finished
2011/09/04 15:06:23.0014 4912        ================================================================================
2011/09/04 15:06:23.0045 4836        Detected object count: 1
2011/09/04 15:06:23.0045 4836        Actual detected object count: 1
2011/09/04 15:06:40.0611 4836        LockedFile.Multi.Generic(sptd) - User select action: Skip
2011/09/04 15:06:56.0195 5984        ================================================================================
2011/09/04 15:06:56.0195 5984        Scan started
2011/09/04 15:06:56.0195 5984        Mode: Manual;
2011/09/04 15:06:56.0195 5984        ================================================================================
2011/09/04 15:06:56.0866 5984        ACPI            (192bdbd1540645c4a2aa69f24cce197f) C:\Windows\system32\drivers\acpi.sys
2011/09/04 15:06:56.0913 5984        adp94xx        (2edc5bbac6c651ece337bde8ed97c9fb) C:\Windows\system32\drivers\adp94xx.sys
2011/09/04 15:06:56.0991 5984        adpahci        (b84088ca3cdca97da44a984c6ce1ccad) C:\Windows\system32\drivers\adpahci.sys
2011/09/04 15:06:57.0053 5984        adpu160m        (7880c67bccc27c86fd05aa2afb5ea469) C:\Windows\system32\drivers\adpu160m.sys
2011/09/04 15:06:57.0116 5984        adpu320        (9ae713f8e30efc2abccd84904333df4d) C:\Windows\system32\drivers\adpu320.sys
2011/09/04 15:06:57.0178 5984        AFD            (5d24caf8efd924a875698ff28384db8b) C:\Windows\system32\drivers\afd.sys
2011/09/04 15:06:57.0225 5984        agp440          (ef23439cdd587f64c2c1b8825cead7d8) C:\Windows\system32\drivers\agp440.sys
2011/09/04 15:06:57.0256 5984        aic78xx        (ae1fdf7bf7bb6c6a70f67699d880592a) C:\Windows\system32\drivers\djsvs.sys
2011/09/04 15:06:57.0303 5984        aliide          (90395b64600ebb4552e26e178c94b2e4) C:\Windows\system32\drivers\aliide.sys
2011/09/04 15:06:57.0350 5984        amdagp          (2b13e304c9dfdfa5eb582f6a149fa2c7) C:\Windows\system32\drivers\amdagp.sys
2011/09/04 15:06:57.0396 5984        amdide          (0577df1d323fe75a739c787893d300ea) C:\Windows\system32\drivers\amdide.sys
2011/09/04 15:06:57.0443 5984        AmdK7          (dc487885bcef9f28eece6fac0e5ddfc5) C:\Windows\system32\drivers\amdk7.sys
2011/09/04 15:06:57.0490 5984        AmdK8          (0ca0071da4315b00fc1328ca86b425da) C:\Windows\system32\DRIVERS\amdk8.sys
2011/09/04 15:06:57.0584 5984        arc            (5f673180268bb1fdb69c99b6619fe379) C:\Windows\system32\drivers\arc.sys
2011/09/04 15:06:57.0630 5984        arcsas          (957f7540b5e7f602e44648c7de5a1c05) C:\Windows\system32\drivers\arcsas.sys
2011/09/04 15:06:57.0708 5984        ASPI            (e54e27976e2c5a6465d44c10b1d87ac0) C:\Windows\System32\DRIVERS\ASPI32.sys
2011/09/04 15:06:57.0755 5984        AsyncMac        (e86cf7ce67d5de898f27ef884dc357d8) C:\Windows\system32\DRIVERS\asyncmac.sys
2011/09/04 15:06:57.0802 5984        atapi          (28d0c21db4ffed1bbfb42e9aa34e0c0d) C:\Windows\system32\drivers\atapi.sys
2011/09/04 15:06:57.0849 5984        AtiPcie        (a356e45e8432432c06981ea63a1e0fe8) C:\Windows\system32\DRIVERS\AtiPcie.sys
2011/09/04 15:06:57.0958 5984        avgio          (71a751d7f8b0219bcf827596fc5af318) C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgio.sys
2011/09/04 15:06:57.0989 5984        avgntflt        (cf8a756118fc374c494fb8c86c03bcc7) C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgntflt.sys
2011/09/04 15:06:58.0020 5984        avipbb          (fdba6800835b9628ef401f642284ce55) C:\Windows\system32\DRIVERS\avipbb.sys
2011/09/04 15:06:58.0083 5984        Beep            (ac3dd1708b22761ebd7cbe14dcc3b5d7) C:\Windows\system32\drivers\Beep.sys
2011/09/04 15:06:58.0176 5984        bowser          (913cd06fbe9105ce6077e90fd4418561) C:\Windows\system32\DRIVERS\bowser.sys
2011/09/04 15:06:58.0223 5984        BrFiltLo        (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\drivers\brfiltlo.sys
2011/09/04 15:06:58.0254 5984        BrFiltUp        (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\drivers\brfiltup.sys
2011/09/04 15:06:58.0332 5984        Brserid        (b304e75cff293029eddf094246747113) C:\Windows\system32\drivers\brserid.sys
2011/09/04 15:06:58.0395 5984        BrSerWdm        (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\system32\drivers\brserwdm.sys
2011/09/04 15:06:58.0442 5984        BrUsbMdm        (bd456606156ba17e60a04e18016ae54b) C:\Windows\system32\drivers\brusbmdm.sys
2011/09/04 15:06:58.0473 5984        BrUsbSer        (af72ed54503f717a43268b3cc5faec2e) C:\Windows\system32\drivers\brusbser.sys
2011/09/04 15:06:58.0520 5984        BTHMODEM        (ad07c1ec6665b8b35741ab91200c6b68) C:\Windows\system32\drivers\bthmodem.sys
2011/09/04 15:06:58.0660 5984        cdfs            (6c3a437fc873c6f6a4fc620b6888cb86) C:\Windows\system32\DRIVERS\cdfs.sys
2011/09/04 15:06:58.0707 5984        cdrom          (8d1866e61af096ae8b582454f5e4d303) C:\Windows\system32\DRIVERS\cdrom.sys
2011/09/04 15:06:58.0785 5984        circlass        (da8e0afc7baa226c538ef53ac2f90897) C:\Windows\system32\drivers\circlass.sys
2011/09/04 15:06:58.0832 5984        CLFS            (1b84fd0937d3b99af9ba38ddff3daf54) C:\Windows\system32\CLFS.sys
2011/09/04 15:06:58.0894 5984        cmdide          (45201046c776ffdaf3fc8a0029c581c8) C:\Windows\system32\drivers\cmdide.sys
2011/09/04 15:06:58.0941 5984        Compbatt        (82b8c91d327cfecf76cb58716f7d4997) C:\Windows\system32\drivers\compbatt.sys
2011/09/04 15:06:58.0988 5984        crcdisk        (2a213ae086bbec5e937553c7d9a2b22c) C:\Windows\system32\drivers\crcdisk.sys
2011/09/04 15:06:59.0050 5984        Crusoe          (22a7f883508176489f559ee745b5bf5d) C:\Windows\system32\drivers\crusoe.sys
2011/09/04 15:06:59.0144 5984        DfsC            (a7179de59ae269ab70345527894ccd7c) C:\Windows\system32\Drivers\dfsc.sys
2011/09/04 15:06:59.0222 5984        disk            (841af4c4d41d3e3b2f244e976b0f7963) C:\Windows\system32\drivers\disk.sys
2011/09/04 15:06:59.0331 5984        drmkaud        (ee472cd2c01f6f8e8aa1fa06ffef61b6) C:\Windows\system32\drivers\drmkaud.sys
2011/09/04 15:06:59.0409 5984        DXGKrnl        (2d13d9e98caf6321f219b28921af214c) C:\Windows\System32\drivers\dxgkrnl.sys
2011/09/04 15:06:59.0471 5984        E1G60          (f88fb26547fd2ce6d0a5af2985892c48) C:\Windows\system32\DRIVERS\E1G60I32.sys
2011/09/04 15:06:59.0518 5984        Ecache          (38573398f734b71b06cd2411494f234a) C:\Windows\system32\drivers\ecache.sys
2011/09/04 15:06:59.0627 5984        eeCtrl          (8f7dbc4be48f5388a6fe1f285e7948ef) C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys
2011/09/04 15:06:59.0768 5984        elxstor        (e8f3f21a71720c84bcf423b80028359f) C:\Windows\system32\drivers\elxstor.sys
2011/09/04 15:06:59.0830 5984        enodpl          (b4556f3d468c8dcb0b259d9d866cd4c4) C:\Windows\system32\drivers\enodpl.sys
2011/09/04 15:06:59.0924 5984        fastfat        (84a317cb0b3954d3768cdcd018dbf670) C:\Windows\system32\drivers\fastfat.sys
2011/09/04 15:06:59.0955 5984        fdc            (63bdada84951b9c03e641800e176898a) C:\Windows\system32\DRIVERS\fdc.sys
2011/09/04 15:07:00.0002 5984        FileInfo        (65773d6115c037ffd7ef8280ae85eb9d) C:\Windows\system32\drivers\fileinfo.sys
2011/09/04 15:07:00.0064 5984        Filetrace      (c226dd0de060745f3e042f58dcf78402) C:\Windows\system32\drivers\filetrace.sys
2011/09/04 15:07:00.0111 5984        flpydisk        (6603957eff5ec62d25075ea8ac27de68) C:\Windows\system32\DRIVERS\flpydisk.sys
2011/09/04 15:07:00.0189 5984        FltMgr          (a6a8da7ae4d53394ab22ac3ab6d3f5d3) C:\Windows\system32\drivers\fltmgr.sys
2011/09/04 15:07:00.0267 5984        Fs_Rec          (66a078591208baa210c7634b11eb392c) C:\Windows\system32\drivers\Fs_Rec.sys
2011/09/04 15:07:00.0298 5984        gagp30kx        (4e1cd0a45c50a8882616cae5bf82f3c5) C:\Windows\system32\drivers\gagp30kx.sys
2011/09/04 15:07:00.0360 5984        GEARAspiWDM    (8182ff89c65e4d38b2de4bb0fb18564e) C:\Windows\system32\DRIVERS\GEARAspiWDM.sys
2011/09/04 15:07:00.0438 5984        GRD            (1524d3a6850ee14e88d860c3696100c0) C:\Windows\system32\drivers\GRD.sys
2011/09/04 15:07:00.0501 5984        HdAudAddService (cb04c744be0a61b1d648faed182c3b59) C:\Windows\system32\drivers\HdAudio.sys
2011/09/04 15:07:00.0548 5984        HDAudBus        (0db613a7e427b5663563677796fd5258) C:\Windows\system32\DRIVERS\HDAudBus.sys
2011/09/04 15:07:00.0594 5984        HidBth          (1338520e78d90154ed6be8f84de5fceb) C:\Windows\system32\drivers\hidbth.sys
2011/09/04 15:07:00.0626 5984        HidIr          (ff3160c3a2445128c5a6d9b076da519e) C:\Windows\system32\drivers\hidir.sys
2011/09/04 15:07:00.0672 5984        HidUsb          (01e7971e9f4bd6ac6a08db52d0ea0418) C:\Windows\system32\DRIVERS\hidusb.sys
2011/09/04 15:07:00.0750 5984        HpCISSs        (df353b401001246853763c4b7aaa6f50) C:\Windows\system32\drivers\hpcisss.sys
2011/09/04 15:07:00.0938 5984        HTTP            (f31d27ccf514549a17e79bebe01b40b6) C:\Windows\system32\drivers\HTTP.sys
2011/09/04 15:07:00.0984 5984        i2omp          (324c2152ff2c61abae92d09f3cca4d63) C:\Windows\system32\drivers\i2omp.sys
2011/09/04 15:07:01.0031 5984        i8042prt        (bea9838cd25d36beba3f94386a761d60) C:\Windows\system32\DRIVERS\i8042prt.sys
2011/09/04 15:07:01.0094 5984        iaStor          (2358c53f30cb9dcd1d3843c4e2f299b2) C:\Windows\system32\drivers\iastor.sys
2011/09/04 15:07:01.0140 5984        iaStorV        (c957bf4b5d80b46c5017bf0101e6c906) C:\Windows\system32\drivers\iastorv.sys
2011/09/04 15:07:01.0406 5984        iirsp          (2d077bf86e843f901d8db709c95b49a5) C:\Windows\system32\drivers\iirsp.sys
2011/09/04 15:07:01.0718 5984        IKFileSec      (bb07262041a213fea5fccf0a9f90d85a) C:\Windows\system32\drivers\ikfilesec.sys
2011/09/04 15:07:01.0780 5984        IKSysFlt        (b2581314d54f8de4262f0a51f7ba63d0) C:\Windows\system32\drivers\iksysflt.sys
2011/09/04 15:07:01.0827 5984        IKSysSec        (6f544cd764f949170b46a4dab11673e2) C:\Windows\system32\drivers\iksyssec.sys
2011/09/04 15:07:01.0952 5984        IntcAzAudAddService (4de88b49c891f45cd9ea6d83a341d3e3) C:\Windows\system32\drivers\RTKVHDA.sys
2011/09/04 15:07:02.0061 5984        intelide        (97469037714070e45194ed318d636401) C:\Windows\system32\drivers\intelide.sys
2011/09/04 15:07:02.0123 5984        intelppm        (ce44cc04262f28216dd4341e9e36a16f) C:\Windows\system32\DRIVERS\intelppm.sys
2011/09/04 15:07:02.0170 5984        IpFilterDriver  (880c6f86cc3f551b8fea2c11141268c0) C:\Windows\system32\DRIVERS\ipfltdrv.sys
2011/09/04 15:07:02.0264 5984        IPMIDRV        (40f34f8aba2a015d780e4b09138b6c17) C:\Windows\system32\drivers\ipmidrv.sys
2011/09/04 15:07:02.0326 5984        IPNAT          (10077c35845101548037df04fd1a420b) C:\Windows\system32\DRIVERS\ipnat.sys
2011/09/04 15:07:02.0357 5984        IRENUM          (a82f328f4792304184642d6d397bb1e3) C:\Windows\system32\drivers\irenum.sys
2011/09/04 15:07:02.0404 5984        isapnp          (350fca7e73cf65bcef43fae1e4e91293) C:\Windows\system32\drivers\isapnp.sys
2011/09/04 15:07:02.0513 5984        iScsiPrt        (4dca456d4d5723f8fa9c6760d240b0df) C:\Windows\system32\DRIVERS\msiscsi.sys
2011/09/04 15:07:02.0778 5984        iteatapi        (bced60d16156e428f8df8cf27b0df150) C:\Windows\system32\drivers\iteatapi.sys
2011/09/04 15:07:02.0966 5984        iteraid        (06fa654504a498c30adca8bec4e87e7e) C:\Windows\system32\drivers\iteraid.sys
2011/09/04 15:07:03.0028 5984        JRAID          (c1632fe31d1824a43dea29725312e3fa) C:\Windows\system32\drivers\jraid.sys
2011/09/04 15:07:03.0075 5984        kbdclass        (c9b0cf786d5f151a43c7be8e243f2819) C:\Windows\system32\DRIVERS\kbdclass.sys
2011/09/04 15:07:03.0122 5984        kbdhid          (97ab2fb84e8e77d93cee85550f4cf7f9) C:\Windows\system32\DRIVERS\kbdhid.sys
2011/09/04 15:07:03.0168 5984        KSecDD          (11d0bc1f2afd8abbb5a3dc47a042de54) C:\Windows\system32\Drivers\ksecdd.sys
2011/09/04 15:07:03.0293 5984        lltdio          (fd015b4f95daa2b712f0e372a116fbad) C:\Windows\system32\DRIVERS\lltdio.sys
2011/09/04 15:07:03.0387 5984        LSI_FC          (a2262fb9f28935e862b4db46438c80d2) C:\Windows\system32\drivers\lsi_fc.sys
2011/09/04 15:07:03.0418 5984        LSI_SAS        (30d73327d390f72a62f32c103daf1d6d) C:\Windows\system32\drivers\lsi_sas.sys
2011/09/04 15:07:03.0480 5984        LSI_SCSI        (e1e36fefd45849a95f1ab81de0159fe3) C:\Windows\system32\drivers\lsi_scsi.sys
2011/09/04 15:07:03.0496 5984        luafv          (42885bb44b6e065b8575a8dd6c430c52) C:\Windows\system32\drivers\luafv.sys
2011/09/04 15:07:03.0590 5984        megasas        (d153b14fc6598eae8422a2037553adce) C:\Windows\system32\drivers\megasas.sys
2011/09/04 15:07:03.0652 5984        Modem          (21755967298a46fb6adfec9db6012211) C:\Windows\system32\drivers\modem.sys
2011/09/04 15:07:03.0730 5984        monitor        (47c09851f763f2e03bfadd581747ecec) C:\Windows\system32\DRIVERS\monitor.sys
2011/09/04 15:07:03.0777 5984        mouclass        (4a00b3cf90ad075193ca5aeece71154c) C:\Windows\system32\DRIVERS\mouclass.sys
2011/09/04 15:07:03.0808 5984        mouhid          (8d9b701d716843c39e93b3432cb721fc) C:\Windows\system32\DRIVERS\mouhid.sys
2011/09/04 15:07:03.0855 5984        MountMgr        (01f1e5a3e4877c931cbb31613fec16a6) C:\Windows\system32\drivers\mountmgr.sys
2011/09/04 15:07:03.0886 5984        mpio            (583a41f26278d9e0ea548163d6139397) C:\Windows\system32\drivers\mpio.sys
2011/09/04 15:07:03.0933 5984        mpsdrv          (6e7a7f0c1193ee5648443fe2d4b789ec) C:\Windows\system32\drivers\mpsdrv.sys
2011/09/04 15:07:03.0995 5984        Mraid35x        (4fbbb70d30fd20ec51f80061703b001e) C:\Windows\system32\drivers\mraid35x.sys
2011/09/04 15:07:04.0058 5984        MRxDAV          (08f0c494a69cf3106ee7ffc48d8e5ac7) C:\Windows\system32\drivers\mrxdav.sys
2011/09/04 15:07:04.0120 5984        mrxsmb          (dc5632cbc8a3d02ce1114debb64b7037) C:\Windows\system32\DRIVERS\mrxsmb.sys
2011/09/04 15:07:04.0167 5984        mrxsmb10        (f813456c00b904dc3b6558cad7b13bba) C:\Windows\system32\DRIVERS\mrxsmb10.sys
2011/09/04 15:07:04.0214 5984        mrxsmb20        (30a67c7d8b80281028916ded6a64aec9) C:\Windows\system32\DRIVERS\mrxsmb20.sys
2011/09/04 15:07:04.0260 5984        msahci          (742aed7939e734c36b7e8d6228ce26b7) C:\Windows\system32\drivers\msahci.sys
2011/09/04 15:07:04.0307 5984        msdsm          (3fc82a2ae4cc149165a94699183d3028) C:\Windows\system32\drivers\msdsm.sys
2011/09/04 15:07:04.0370 5984        Msfs            (729eafefd4e7417165f353a18dbe947d) C:\Windows\system32\drivers\Msfs.sys
2011/09/04 15:07:04.0432 5984        msisadrv        (0a64168b63535520adfd6b959695404a) C:\Windows\system32\drivers\msisadrv.sys
2011/09/04 15:07:04.0494 5984        MSKSSRV        (892cedefa7e0ffe7be8da651b651d047) C:\Windows\system32\drivers\MSKSSRV.sys
2011/09/04 15:07:04.0526 5984        MSPCLOCK        (ae2cb1da69b2676b4cee2a501af5871c) C:\Windows\system32\drivers\MSPCLOCK.sys
2011/09/04 15:07:04.0557 5984        MSPQM          (f910da84fa90c44a3addb7cd874463fd) C:\Windows\system32\drivers\MSPQM.sys
2011/09/04 15:07:04.0604 5984        MsRPC          (84571c0ae07647ba38d493f5f0015df7) C:\Windows\system32\drivers\MsRPC.sys
2011/09/04 15:07:04.0666 5984        mssmbios        (e09cedb1bca303b7f6ae22f512e56969) C:\Windows\system32\DRIVERS\mssmbios.sys
2011/09/04 15:07:04.0713 5984        MSTEE          (c826dd1373f38afd9ca46ec3c436a14e) C:\Windows\system32\drivers\MSTEE.sys
2011/09/04 15:07:04.0760 5984        Mup            (fa7aa70050cf5e2d15de00941e5665e5) C:\Windows\system32\Drivers\mup.sys
2011/09/04 15:07:04.0838 5984        NativeWifiP    (be8c26e61be5c5a49a6babd17aeed1b7) C:\Windows\system32\DRIVERS\nwifi.sys
2011/09/04 15:07:04.0931 5984        NDIS            (6e8dfface597629cef5df7d69217628f) C:\Windows\system32\drivers\ndis.sys
2011/09/04 15:07:04.0978 5984        NdisTapi        (81659cdcbd0f9a9e07e6878ad8c78d3f) C:\Windows\system32\DRIVERS\ndistapi.sys
2011/09/04 15:07:05.0009 5984        Ndisuio        (5de5ee546bf40838ebe0e01cb629df64) C:\Windows\system32\DRIVERS\ndisuio.sys
2011/09/04 15:07:05.0056 5984        NdisWan        (397402adcbb8946223a1950101f6cd94) C:\Windows\system32\DRIVERS\ndiswan.sys
2011/09/04 15:07:05.0103 5984        NDProxy        (1b24fa907af283199a81b3bb37e5e526) C:\Windows\system32\drivers\NDProxy.sys
2011/09/04 15:07:05.0150 5984        NetBIOS        (356dbb9f98e8dc1028dd3092fceeb877) C:\Windows\system32\DRIVERS\netbios.sys
2011/09/04 15:07:05.0228 5984        netbt          (231f6ccfdb7a604221f18fb0852c8560) C:\Windows\system32\DRIVERS\netbt.sys
2011/09/04 15:07:05.0352 5984        nfrd960        (2e7fb731d4790a1bc6270accefacb36e) C:\Windows\system32\drivers\nfrd960.sys
2011/09/04 15:07:05.0462 5984        Npfs            (4f9832beb9fafd8ceb0e541f1323b26e) C:\Windows\system32\drivers\Npfs.sys
2011/09/04 15:07:05.0540 5984        nsiproxy        (b488dfec274de1fc9d653870ef2587be) C:\Windows\system32\drivers\nsiproxy.sys
2011/09/04 15:07:05.0633 5984        Ntfs            (01db57ff55bcf719545570f3bd050000) C:\Windows\system32\drivers\Ntfs.sys
2011/09/04 15:07:05.0680 5984        ntrigdigi      (e875c093aec0c978a90f30c9e0dfbb72) C:\Windows\system32\drivers\ntrigdigi.sys
2011/09/04 15:07:05.0711 5984        Null            (ec5efb3c60f1b624648344a328bce596) C:\Windows\system32\drivers\Null.sys
2011/09/04 15:07:06.0086 5984        nvlddmkm        (f623c2b16fde938b908031aeba445344) C:\Windows\system32\DRIVERS\nvlddmkm.sys
2011/09/04 15:07:06.0288 5984        nvraid          (e69e946f80c1c31c53003bfbf50cbb7c) C:\Windows\system32\drivers\nvraid.sys
2011/09/04 15:07:06.0398 5984        nvrd32          (ed399014a8029de02ba5ae01da8cc9ee) C:\Windows\system32\drivers\nvrd32.sys
2011/09/04 15:07:06.0460 5984        nvstor          (9e0ba19a28c498a6d323d065db76dffc) C:\Windows\system32\drivers\nvstor.sys
2011/09/04 15:07:06.0522 5984        nvstor32        (703e3a7093b0fac0eebadbb8e931ecaf) C:\Windows\system32\drivers\nvstor32.sys
2011/09/04 15:07:06.0585 5984        nv_agp          (07c186427eb8fcc3d8d7927187f260f7) C:\Windows\system32\drivers\nv_agp.sys
2011/09/04 15:07:06.0725 5984        ohci1394        (8994cbfc215a9ef4495e6ae7992954fc) C:\Windows\system32\DRIVERS\ohci1394.sys
2011/09/04 15:07:06.0819 5984        Parport        (0fa9b5055484649d63c303fe404e5f4d) C:\Windows\system32\drivers\parport.sys
2011/09/04 15:07:06.0866 5984        partmgr        (555a5b2c8022983bc7467bc925b222ee) C:\Windows\system32\drivers\partmgr.sys
2011/09/04 15:07:06.0897 5984        Parvdm          (4f9a6a8a31413180d0fcb279ad5d8112) C:\Windows\system32\drivers\parvdm.sys
2011/09/04 15:07:06.0959 5984        pci            (a48c4d0acc933f7a37e52ab0761811ad) C:\Windows\system32\drivers\pci.sys
2011/09/04 15:07:06.0990 5984        pciide          (3a1efd3fd478c8a6d528ec297dbcb36f) C:\Windows\system32\drivers\pciide.sys
2011/09/04 15:07:07.0037 5984        pcmcia          (e6f3fb1b86aa519e7698ad05e58b04e5) C:\Windows\system32\drivers\pcmcia.sys
2011/09/04 15:07:07.0100 5984        PEAUTH          (6349f6ed9c623b44b52ea3c63c831a92) C:\Windows\system32\drivers\peauth.sys
2011/09/04 15:07:07.0256 5984        PptpMiniport    (c04dec5ace67c5247b150c4223970bb7) C:\Windows\system32\DRIVERS\raspptp.sys
2011/09/04 15:07:07.0302 5984        Processor      (0e3cef5d28b40cf273281d620c50700a) C:\Windows\system32\drivers\processr.sys
2011/09/04 15:07:07.0380 5984        PSched          (2c8bae55247c4e09352e870292e4d1ab) C:\Windows\system32\DRIVERS\pacer.sys
2011/09/04 15:07:07.0458 5984        ql2300          (ccdac889326317792480c0a67156a1ec) C:\Windows\system32\drivers\ql2300.sys
2011/09/04 15:07:07.0505 5984        ql40xx          (81a7e5c076e59995d54bc1ed3a16e60b) C:\Windows\system32\drivers\ql40xx.sys
2011/09/04 15:07:07.0552 5984        QWAVEdrv        (d2b3e2b7426dc23e185fbc73c8936c12) C:\Windows\system32\drivers\qwavedrv.sys
2011/09/04 15:07:07.0599 5984        RasAcd          (bd7b30f55b3649506dd8b3d38f571d2a) C:\Windows\system32\DRIVERS\rasacd.sys
2011/09/04 15:07:07.0661 5984        Rasl2tp        (68b0019fee429ec49d29017af937e482) C:\Windows\system32\DRIVERS\rasl2tp.sys
2011/09/04 15:07:07.0692 5984        RasPppoe        (ccf4e9c6cbbac81437f88cb2ae0b6c96) C:\Windows\system32\DRIVERS\raspppoe.sys
2011/09/04 15:07:07.0739 5984        rdbss          (54129c5d9581bbec8bd1ebd3ba813f47) C:\Windows\system32\DRIVERS\rdbss.sys
2011/09/04 15:07:07.0770 5984        RDPCDD          (794585276b5d7fca9f3fc15543f9f0b9) C:\Windows\system32\DRIVERS\RDPCDD.sys
2011/09/04 15:07:07.0848 5984        rdpdr          (e8bd98d46f2ed77132ba927fccb47d8b) C:\Windows\system32\drivers\rdpdr.sys
2011/09/04 15:07:07.0911 5984        RDPENCDD        (980b56e2e273e19d3a9d72d5c420f008) C:\Windows\system32\drivers\rdpencdd.sys
2011/09/04 15:07:07.0989 5984        RDPWD          (8830e790a74a96605faba74f9665bb3c) C:\Windows\system32\drivers\RDPWD.sys
2011/09/04 15:07:08.0098 5984        rspndr          (97e939d2128fec5d5a3e6e79b290a2f4) C:\Windows\system32\DRIVERS\rspndr.sys
2011/09/04 15:07:08.0145 5984        RTL8169        (abbe0f54ba3a378262c9cb86cf7d91f8) C:\Windows\system32\DRIVERS\Rtlh86.sys
2011/09/04 15:07:08.0207 5984        sbp2port        (3ce8f073a557e172b330109436984e30) C:\Windows\system32\drivers\sbp2port.sys
2011/09/04 15:07:08.0254 5984        SCDEmu          (16b1abe7f3e35f21dac57592b6c5d464) C:\Windows\system32\drivers\SCDEmu.sys
2011/09/04 15:07:08.0348 5984        Secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\SECDRV.SYS
2011/09/04 15:07:08.0410 5984        Serenum        (68e44e331d46f0fb38f0863a84cd1a31) C:\Windows\system32\DRIVERS\serenum.sys
2011/09/04 15:07:08.0457 5984        Serial          (c70d69a918b178d3c3b06339b40c2e1b) C:\Windows\system32\DRIVERS\serial.sys
2011/09/04 15:07:08.0504 5984        sermouse        (2baf2abc0da0d50ebe8289c720977052) C:\Windows\system32\drivers\sermouse.sys
2011/09/04 15:07:08.0597 5984        sffdisk        (103b79418da647736ee95645f305f68a) C:\Windows\system32\drivers\sffdisk.sys
2011/09/04 15:07:08.0628 5984        sffp_mmc        (8fd08a310645fe872eeec6e08c6bf3ee) C:\Windows\system32\drivers\sffp_mmc.sys
2011/09/04 15:07:08.0660 5984        sffp_sd        (9cfa05fcfcb7124e69cfc812b72f9614) C:\Windows\system32\drivers\sffp_sd.sys
2011/09/04 15:07:08.0706 5984        sfloppy        (46ed8e91793b2e6f848015445a0ac188) C:\Windows\system32\drivers\sfloppy.sys
2011/09/04 15:07:08.0769 5984        sisagp          (d2a595d6eebeeaf4334f8e50efbc9931) C:\Windows\system32\drivers\sisagp.sys
2011/09/04 15:07:08.0816 5984        SiSRaid2        (cedd6f4e7d84e9f98b34b3fe988373aa) C:\Windows\system32\drivers\sisraid2.sys
2011/09/04 15:07:08.0862 5984        SiSRaid4        (df843c528c4f69d12ce41ce462e973a7) C:\Windows\system32\drivers\sisraid4.sys
2011/09/04 15:07:08.0940 5984        Smb            (46baf398809a0f3b2d3300a1760e4b91) C:\Windows\system32\DRIVERS\smb.sys
2011/09/04 15:07:09.0003 5984        spldr          (426f9b029aa9162ceccf65369457d046) C:\Windows\system32\drivers\spldr.sys
2011/09/04 15:07:09.0081 5984        sptd            (cdddec541bc3c96f91ecb48759673505) C:\Windows\system32\Drivers\sptd.sys
2011/09/04 15:07:09.0081 5984        Suspicious file (NoAccess): C:\Windows\system32\Drivers\sptd.sys. md5: cdddec541bc3c96f91ecb48759673505
2011/09/04 15:07:09.0096 5984        sptd - detected LockedFile.Multi.Generic (1)
2011/09/04 15:07:09.0159 5984        srv            (e86bf07b1d2ec33c52b3b31e5814001a) C:\Windows\system32\DRIVERS\srv.sys
2011/09/04 15:07:09.0237 5984        srv2            (e8c4d5bca3c7b5c2a040052aa467b5bf) C:\Windows\system32\DRIVERS\srv2.sys
2011/09/04 15:07:09.0268 5984        srvnet          (8ae0f61f71e97ace067cdab67c98746b) C:\Windows\system32\DRIVERS\srvnet.sys
2011/09/04 15:07:09.0330 5984        ssmdrv          (71d609c5dff067906d930bde031c4cfe) C:\Windows\system32\DRIVERS\ssmdrv.sys
2011/09/04 15:07:09.0393 5984        swenum          (9c539aaffb0b6d7bce984c74317ff29f) C:\Windows\system32\DRIVERS\swenum.sys
2011/09/04 15:07:09.0471 5984        Symc8xx        (192aa3ac01df071b541094f251deed10) C:\Windows\system32\drivers\symc8xx.sys
2011/09/04 15:07:09.0502 5984        Sym_hi          (8c8eb8c76736ebaf3b13b633b2e64125) C:\Windows\system32\drivers\sym_hi.sys
2011/09/04 15:07:09.0549 5984        Sym_u3          (8072af52b5fd103bbba387a1e49f62cb) C:\Windows\system32\drivers\sym_u3.sys
2011/09/04 15:07:09.0611 5984        tandpl          (126d7b3b4c7b724491c604060e1f4e14) C:\Windows\system32\drivers\tandpl.sys
2011/09/04 15:07:09.0720 5984        Tcpip          (52a8bd6294f7d1443c6184c67ae13af4) C:\Windows\system32\drivers\tcpip.sys
2011/09/04 15:07:09.0783 5984        Tcpip6          (52a8bd6294f7d1443c6184c67ae13af4) C:\Windows\system32\DRIVERS\tcpip.sys
2011/09/04 15:07:09.0845 5984        tcpipreg        (5ce0c4a7b12d0067dad527d72b68c726) C:\Windows\system32\drivers\tcpipreg.sys
2011/09/04 15:07:09.0908 5984        TDPIPE          (964248aef49c31fa6a93201a73ffaf50) C:\Windows\system32\drivers\tdpipe.sys
2011/09/04 15:07:09.0970 5984        TDTCP          (7d2c1ae1648a60fce4aa0f7982e419d3) C:\Windows\system32\drivers\tdtcp.sys
2011/09/04 15:07:10.0017 5984        tdx            (7973f7239486800cd79e4fdbab6a07df) C:\Windows\system32\DRIVERS\tdx.sys
2011/09/04 15:07:10.0095 5984        TermDD          (cfe870506361bac80a549749116ad870) C:\Windows\system32\DRIVERS\termdd.sys
2011/09/04 15:07:10.0235 5984        tssecsrv        (29f0eca726f0d51f7e048bdb0b372f29) C:\Windows\system32\DRIVERS\tssecsrv.sys
2011/09/04 15:07:10.0298 5984        tunmp          (a858917785681743c512950fdfa14db7) C:\Windows\system32\DRIVERS\tunmp.sys
2011/09/04 15:07:10.0344 5984        tunnel          (29f1d1d888ee61d20d5662e72aa34129) C:\Windows\system32\DRIVERS\tunnel.sys
2011/09/04 15:07:10.0407 5984        uagp35          (c3ade15414120033a36c0f293d4a4121) C:\Windows\system32\drivers\uagp35.sys
2011/09/04 15:07:10.0485 5984        udfs            (1811e1016d96e3ea0e170f7c23804e50) C:\Windows\system32\DRIVERS\udfs.sys
2011/09/04 15:07:10.0563 5984        uliagpkx        (75e6890ebfce0841d3291b02e7a8bdb0) C:\Windows\system32\drivers\uliagpkx.sys
2011/09/04 15:07:10.0625 5984        uliahci        (3cd4ea35a6221b85dcc25daa46313f8d) C:\Windows\system32\drivers\uliahci.sys
2011/09/04 15:07:10.0672 5984        UlSata          (8514d0e5cd0534467c5fc61be94a569f) C:\Windows\system32\drivers\ulsata.sys
2011/09/04 15:07:10.0719 5984        ulsata2        (38c3c6e62b157a6bc46594fada45c62b) C:\Windows\system32\drivers\ulsata2.sys
2011/09/04 15:07:10.0781 5984        umbus          (dc8828971d997de009647fce59e0ce8f) C:\Windows\system32\DRIVERS\umbus.sys
2011/09/04 15:07:10.0875 5984        USB28xxBGA      (9b01ce1eda6ad1acfd4f865d6cb0a790) C:\Windows\system32\DRIVERS\emBDA.sys
2011/09/04 15:07:10.0937 5984        USB28xxOEM      (c93e4f6bd1cbd163662e7c9be021b895) C:\Windows\system32\DRIVERS\emOEM.sys
2011/09/04 15:07:11.0046 5984        USBAAPL        (4b8a9c16b6d9258ed99c512aecb8c555) C:\Windows\system32\Drivers\usbaapl.sys
2011/09/04 15:07:11.0124 5984        usbccgp        (03b01e8dbd2da2b49157b7e51912aaf2) C:\Windows\system32\DRIVERS\usbccgp.sys
2011/09/04 15:07:11.0187 5984        usbcir          (e9476e6c486e76bc4898074768fb7131) C:\Windows\system32\drivers\usbcir.sys
2011/09/04 15:07:11.0249 5984        usbehci        (2f83363f98484f8edaf49f9b41520d14) C:\Windows\system32\DRIVERS\usbehci.sys
2011/09/04 15:07:11.0280 5984        usbhub          (14d2a4dcd92c0b3368667aed6893463d) C:\Windows\system32\DRIVERS\usbhub.sys
2011/09/04 15:07:11.0343 5984        usbohci        (51dc36722172d45f2f935ce5cc18a812) C:\Windows\system32\DRIVERS\usbohci.sys
2011/09/04 15:07:11.0390 5984        usbprint        (b51e52acf758be00ef3a58ea452fe360) C:\Windows\system32\DRIVERS\usbprint.sys
2011/09/04 15:07:11.0452 5984        usbscan        (b1f95285c08ddfe00c0b955462637ec7) C:\Windows\system32\DRIVERS\usbscan.sys
2011/09/04 15:07:11.0499 5984        USBSTOR        (7887ce56934e7f104e98c975f47353c5) C:\Windows\system32\DRIVERS\USBSTOR.SYS
2011/09/04 15:07:11.0561 5984        usbuhci        (325dbbacb8a36af9988ccf40eac228cc) C:\Windows\system32\DRIVERS\usbuhci.sys
2011/09/04 15:07:11.0624 5984        usbvideo        (46f3a2912ef88cd8e87d4f9b304cd949) C:\Windows\system32\Drivers\usbvideo.sys
2011/09/04 15:07:11.0702 5984        VBoxNetAdp      (b9d3c274e937a15fd2cef8aa1e4c3477) C:\Windows\system32\DRIVERS\VBoxNetAdp.sys
2011/09/04 15:07:11.0811 5984        vga            (7d92be0028ecdedec74617009084b5ef) C:\Windows\system32\DRIVERS\vgapnp.sys
2011/09/04 15:07:11.0842 5984        VgaSave        (17a8f877314e4067f8c8172cc6d9101c) C:\Windows\System32\drivers\vga.sys
2011/09/04 15:07:11.0889 5984        viaagp          (045d9961e591cf0674a920b6ba3ba5cb) C:\Windows\system32\drivers\viaagp.sys
2011/09/04 15:07:11.0936 5984        ViaC7          (56a4de5f02f2e88182b0981119b4dd98) C:\Windows\system32\drivers\viac7.sys
2011/09/04 15:07:11.0967 5984        viaide          (fd2e3175fcada350c7ab4521dca187ec) C:\Windows\system32\drivers\viaide.sys
2011/09/04 15:07:12.0029 5984        viamraid        (7dc3e1dc6e4f8be381c31bfea578412a) C:\Windows\system32\drivers\viamraid.sys
2011/09/04 15:07:12.0092 5984        vmm            (590c7a3a1133e51a7e1cef67366e75af) C:\Windows\system32\Drivers\vmm.sys
2011/09/04 15:07:12.0154 5984        volmgr          (cc8a64a532fd2844ee68f4061ed8a7fd) C:\Windows\system32\drivers\volmgr.sys
2011/09/04 15:07:12.0201 5984        volmgrx        (294da8d3f965f6a8db934a83c7b461ff) C:\Windows\system32\drivers\volmgrx.sys
2011/09/04 15:07:12.0248 5984        volsnap        (11ef6c1caef76b685233450a126125d6) C:\Windows\system32\drivers\volsnap.sys
2011/09/04 15:07:12.0294 5984        VPCNetS2        (f96a678debdccb0b4bb7f38cb2580589) C:\Windows\system32\DRIVERS\VMNetSrv.sys
2011/09/04 15:07:12.0326 5984        vsmraid        (d984439746d42b30fc65a4c3546c6829) C:\Windows\system32\drivers\vsmraid.sys
2011/09/04 15:07:12.0419 5984        WacomPen        (48dfee8f1af7c8235d4e626f0c4fe031) C:\Windows\system32\drivers\wacompen.sys
2011/09/04 15:07:12.0482 5984        Wanarp          (6798c1209a53b5a0ded8d437c45145ff) C:\Windows\system32\DRIVERS\wanarp.sys
2011/09/04 15:07:12.0513 5984        Wanarpv6        (6798c1209a53b5a0ded8d437c45145ff) C:\Windows\system32\DRIVERS\wanarp.sys
2011/09/04 15:07:12.0575 5984        Wd              (afc5ad65b991c1e205cf25cfdbf7a6f4) C:\Windows\system32\drivers\wd.sys
2011/09/04 15:07:12.0638 5984        Wdf01000        (7b5f66e4a2219c7d9daf9e738480e534) C:\Windows\system32\drivers\Wdf01000.sys
2011/09/04 15:07:13.0386 5984        WmiAcpi        (701a9f884a294327e9141d73746ee279) C:\Windows\system32\drivers\wmiacpi.sys
2011/09/04 15:07:13.0496 5984        WpdUsb          (2d27171b16a577ef14c1273668753485) C:\Windows\system32\DRIVERS\wpdusb.sys
2011/09/04 15:07:13.0527 5984        ws2ifsl        (84620aecdcfd2a7a14e6263927d8c0ed) C:\Windows\system32\drivers\ws2ifsl.sys
2011/09/04 15:07:13.0620 5984        WUDFRd          (ee0974d4042da9cf4c569ac4eca8c9c0) C:\Windows\system32\DRIVERS\WUDFRd.sys
2011/09/04 15:07:13.0698 5984        MBR (0x1B8)    (5c616939100b85e558da92b899a0fc36) \Device\Harddisk0\DR0
2011/09/04 15:07:13.0745 5984        Boot (0x1200)  (0a140da3497d9a9e788655e7a080b614) \Device\Harddisk0\DR0\Partition0
2011/09/04 15:07:13.0808 5984        Boot (0x1200)  (a3c54cb350ecb343b9505df3004dfd6c) \Device\Harddisk0\DR0\Partition1
2011/09/04 15:07:13.0886 5984        Boot (0x1200)  (443756b766fa81e5a2d93d886ca9e6fa) \Device\Harddisk0\DR0\Partition2
2011/09/04 15:07:13.0886 5984        ================================================================================
2011/09/04 15:07:13.0886 5984        Scan finished
2011/09/04 15:07:13.0886 5984        ================================================================================
2011/09/04 15:07:13.0917 5472        Detected object count: 1
2011/09/04 15:07:13.0917 5472        Actual detected object count: 1
2011/09/04 15:07:21.0998 5472        LockedFile.Multi.Generic(sptd) - User select action: Skip

cosinus 04.09.2011 14:35
Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

hallohallo1 04.09.2011 15:07
Code:
ComboFix 11-09-03.01 - Fabian 04.09.2011  15:50:45.2.2 - x86
Microsoft® Windows Vista™ Home Premium  6.0.6000.0.1252.49.1031.18.3071.1930 [GMT 2:00]
ausgeführt von:: c:\users\Fabian\Downloads\ComboFix.exe
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\AutocompletePro
c:\program files\AutocompletePro\FireFoxExtension.exe
c:\program files\AutocompletePro\InstTracker.exe
c:\users\Fabian\AppData\Local\ApplicationHistory
c:\users\Fabian\AppData\Local\ApplicationHistory\csc.exe.3e4ac0af.ini
c:\users\Fabian\AppData\Local\ApplicationHistory\LearnWeb.exe.5cc4f719.ini
c:\users\Fabian\AppData\Local\ApplicationHistory\LearnWeb.exe.5cc4f719.ini.inuse
c:\users\Fabian\AppData\Local\ApplicationHistory\regasm.exe.11f1da13.ini
c:\users\Fabian\AppData\Local\ApplicationHistory\regHelp.exe.9ce4343f.ini.inuse
c:\windows\IsUn0407.exe
.
.
(((((((((((((((((((((((  Dateien erstellt von 2011-08-04 bis 2011-09-04  ))))))))))))))))))))))))))))))
.
.
2011-09-04 14:03 . 2011-09-04 14:03        --------        d-----w-        c:\users\Public\AppData\Local\temp
2011-09-04 14:03 . 2011-09-04 14:03        --------        d-----w-        c:\users\Gast\AppData\Local\temp
2011-09-04 14:03 . 2011-09-04 14:03        --------        d-----w-        c:\users\Default\AppData\Local\temp
2011-09-04 14:03 . 2011-09-04 14:03        --------        d-----w-        c:\users\asasas\AppData\Local\temp
2011-09-01 21:38 . 2011-09-01 21:38        --------        d-----w-        c:\users\Fabian\.hades
2011-09-01 16:04 . 2011-09-01 16:04        --------        d-----w-        c:\program files\ESET
2011-08-26 15:01 . 2011-09-04 09:57        --------        d-----w-        c:\program files\DemonFlyff
2011-08-25 17:25 . 2011-08-25 17:25        --------        d-----w-        C:\_OTL
2011-08-21 13:14 . 2011-08-21 13:15        --------        d-----w-        c:\users\Fabian\AppData\Local\No23 Recorder
2011-08-21 13:14 . 2011-08-22 14:36        --------        d-----w-        c:\users\Fabian\AppData\Roaming\kikin
2011-08-21 13:14 . 2011-08-22 14:36        --------        d-----w-        c:\program files\kikin
2011-08-06 15:55 . 2011-08-26 19:11        --------        d-----w-        c:\users\Fabian\AppData\Local\Amazon
2011-08-06 00:59 . 2011-08-06 00:59        --------        d-----w-        c:\programdata\Vokabel Trainer
2011-08-05 16:04 . 2011-08-05 22:51        --------        d-----w-        c:\program files\ICQ7.5
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-09-02 15:07 . 2011-07-19 11:14        404640        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl
2011-07-06 17:52 . 2010-09-02 19:02        41272        ----a-w-        c:\windows\system32\drivers\mbamswissarmy.sys
2011-07-06 17:52 . 2010-09-02 19:02        22712        ----a-w-        c:\windows\system32\drivers\mbam.sys
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-09 1232896]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2006-11-02 125440]
"DAEMON Tools"="c:\program files\DAEMON Tools\daemon.exe" [2007-04-03 165784]
"AlcoholAutomount"="c:\program files\Alcohol Soft\Alcohol 120\axcmd.exe" [2007-07-02 219520]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2010-04-01 357696]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="RtHDVCpl.exe" [2008-02-26 4939776]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 39792]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-07-21 266497]
"DAEMON Tools"="c:\program files\DAEMON Tools\daemon.exe" [2007-04-03 165784]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"HCWemmon"="HCWemmon.exe" [2007-03-29 61440]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-01-18 185896]
"NvSvc"="c:\windows\system32\nvsvc.dll" [2007-12-05 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-12-05 8530464]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-12-05 81920]
"Symantec PIF AlertEng"="c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 583048]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-03-11 49152]
"PWRISOVM.EXE"="c:\program files\PowerISO\PWRISOVM.EXE" [2009-11-09 180224]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"WPCUMI"="c:\windows\system32\WpcUmi.exe" [2006-11-02 176128]
"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-04-12 1135912]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-09-21 47904]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-09-08 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-09-24 421160]
"Malwarebytes' Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2011-07-06 1047656]
.
c:\users\Fabian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]
OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2008-10-25 98696]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=""
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-1054673845-2891796712-3211906163-1000]
"EnableNotificationsRef"=dword:00000001
.
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-04-16 135664]
R2 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\svcntaux.exe [x]
R3 ASPI;Advanced SCSI Programming Interface Driver;c:\windows\System32\DRIVERS\ASPI32.sys [2002-07-17 84832]
R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2010-04-16 135664]
R3 oad;Visibroker Activation Daemon;c:\progra~1\Borland\vbroker\bin\oad.exe [x]
R3 osagent;VisiBroker Smart Agent;c:\progra~1\Borland\vbroker\bin\osagent.exe [x]
R3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\system32\DRIVERS\VBoxNetAdp.sys [2010-03-25 99728]
R3 VBoxNetFlt;VBoxNetFlt Service;c:\windows\system32\DRIVERS\VBoxNetFlt.sys [x]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-12-29 691696]
S1 GRD;G DATA Rootkit Detector Driver;c:\windows\system32\drivers\GRD.sys [2007-12-26 16712]
S2 Automatisches LiveUpdate - Scheduler;Automatisches LiveUpdate - Scheduler;c:\program files\Symantec\LiveUpdate\ALUSchedulerSvc.exe [2007-09-26 554352]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - 34080359
*Deregistered* - 34080359
.
Inhalt des "geplante Tasks" Ordners
.
2011-09-04 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-04-16 14:50]
.
2011-09-04 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-04-16 14:50]
.
2011-08-05 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1054673845-2891796712-3211906163-1000Core.job
- c:\users\Fabian\AppData\Local\Google\Update\GoogleUpdate.exe [2011-06-29 10:33]
.
2011-09-04 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1054673845-2891796712-3211906163-1000UA.job
- c:\users\Fabian\AppData\Local\Google\Update\GoogleUpdate.exe [2011-06-29 10:33]
.
2011-09-03 c:\windows\Tasks\Norton Security Scan for Fabian.job
- c:\program files\Norton Security Scan\Engine\2.7.3.34\Nss.exe [2010-05-04 00:27]
.
2011-09-04 c:\windows\Tasks\User_Feed_Synchronization-{C27515C3-4436-493B-94A2-3C3CF69BDCC9}.job
- c:\windows\system32\msfeedssync.exe [2006-11-02 09:45]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page =
mStart Page =
mLocal Page =
IE: Free YouTube to Mp3 Converter - c:\users\Fabian\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: {{7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - c:\program files\ICQ7.5\ICQ.exe
LSP: c:\windows\system32\wpclsp.dll
TCP: DhcpNameServer = 192.168.0.1
FF - ProfilePath - c:\users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\
FF - prefs.js: browser.search.defaulturl -
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage -
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}
FF - Ext: Personas: personas@christopher.beard - %profile%\extensions\personas@christopher.beard
FF - user.js: yahoo.homepage.dontask - true
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
AddRemove-Delphi5 - c:\windows\IsUn0407.exe
AddRemove-SimCity 3000 - c:\windows\IsUn0407.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2011-09-04 16:03
Windows 6.0.6000  NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-1054673845-2891796712-3211906163-1000\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{71A06FB0-4C3D-0389-5C06-1FB541F5D4B7}*]
"oabhnckpkkalloggejejeppkpomcdj"=hex:64,61,61,66,6e,6d,66,6d,00,ff
"oafimlmgandppomdmjhajbkjollaof"=hex:6a,61,66,66,70,63,6a,70,6a,6e,67,61,6c,65,
  65,63,69,62,6a,61,00,fa
"naphkpapgopdcioehgjcbkckkdhi"=hex:6b,61,61,66,6c,70,61,68,6d,6c,6b,6e,64,69,
  6c,6b,63,61,65,65,62,6c,00,00
.
[HKEY_USERS\S-1-5-21-1054673845-2891796712-3211906163-1000\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{A62E457B-77DF-2B5B-D39B-1C9A28D9FF5F}*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-1054673845-2891796712-3211906163-1000\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{F87ED1E6-97B2-3220-9702-AE471FEC7AA8}*]
"haclgmicdgfkepeh"=hex:6b,61,67,69,61,6e,6b,62,6c,61,6f,63,65,6a,6b,6c,67,68,
  70,61,66,6a,00,00
.
Zeit der Fertigstellung: 2011-09-04  16:06:33
ComboFix-quarantined-files.txt  2011-09-04 14:06
ComboFix2.txt  2010-09-03 17:09
.
Vor Suchlauf: 29 Verzeichnis(se), 107.018.350.592 Bytes frei
Nach Suchlauf: 31 Verzeichnis(se), 106.984.919.040 Bytes frei
.
- - End Of File - - 0F5F947ECBC5796B686A5B6FFF2AE1C2

cosinus 04.09.2011 15:44
Combofix - Scripten

1. Starte das Notepad (Start / Ausführen / notepad[Enter])

2. Jetzt füge mit copy/paste den ganzen Inhalt der untenstehenden Codebox in das Notepad Fenster ein.

Hinweis: Falls Du Deinen Benutzernamen unkenntlich gemacht hast, musst Du das Ausgesternte in Deinen richtigen Benutzernamen wieder verwandeln, sonst funktioniert das Script nicht!!

Code:
Regnull::
[HKEY_USERS\S-1-5-21-1054673845-2891796712-3211906163-1000\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{71A06FB0-4C3D-0389-5C06-1FB541F5D4B7}*]
[HKEY_USERS\S-1-5-21-1054673845-2891796712-3211906163-1000\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{A62E457B-77DF-2B5B-D39B-1C9A28D9FF5F}*]
[HKEY_USERS\S-1-5-21-1054673845-2891796712-3211906163-1000\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{F87ED1E6-97B2-3220-9702-AE471FEC7AA8}*]
3. Speichere im Notepad als CFScript.txt auf dem Desktop.

4. Deaktivere den Guard Deines Antivirenprogramms und eine eventuell vorhandene Software Firewall.
(Auch Guards von Ad-, Spyware Programmen und den Tea Timer (wenn vorhanden) !)

5. Dann ziehe die CFScript.txt auf die cofi.exe, so wie es im unteren Bild zu sehen ist. Damit wird Combofix neu gestartet.

http://users.pandora.be/bluepatchy/m...s/CFScript.gif

6. Nach dem Neustart (es wird gefragt ob Du neustarten willst), poste bitte die folgenden Log Dateien:
Combofix.txt

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

hallohallo1 04.09.2011 20:02
So, das wäre gemacht. (Hat auch nur 3,5 Stunden gedauert :D)
Noch mal danke, dass du dir die Zeit nimmst hier drüber zu gucken und mir zu helfen!
Aber wie ist denn so dein "Zwischenbericht"?^^

Code:
ComboFix 11-09-03.01 - Fabian 04.09.2011  17:27:38.3.2 - x86
Microsoft® Windows Vista™ Home Premium  6.0.6000.0.1252.49.1031.18.3071.1631 [GMT 2:00]
ausgeführt von:: c:\users\Fabian\Downloads\ComboFix.exe
Benutzte Befehlsschalter :: c:\users\Fabian\Desktop\CFScript.txt
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\iun6002.exe
.
.
(((((((((((((((((((((((  Dateien erstellt von 2011-08-04 bis 2011-09-04  ))))))))))))))))))))))))))))))
.
.
2011-09-04 18:57 . 2011-09-04 18:57        --------        d-----w-        c:\users\Public\AppData\Local\temp
2011-09-04 18:57 . 2011-09-04 18:57        --------        d-----w-        c:\users\Gast\AppData\Local\temp
2011-09-04 18:57 . 2011-09-04 18:57        --------        d-----w-        c:\users\Default\AppData\Local\temp
2011-09-04 18:57 . 2011-09-04 18:57        --------        d-----w-        c:\users\asasas\AppData\Local\temp
2011-09-01 21:38 . 2011-09-01 21:38        --------        d-----w-        c:\users\Fabian\.hades
2011-09-01 16:04 . 2011-09-01 16:04        --------        d-----w-        c:\program files\ESET
2011-08-26 15:01 . 2011-09-04 09:57        --------        d-----w-        c:\program files\DemonFlyff
2011-08-25 17:25 . 2011-08-25 17:25        --------        d-----w-        C:\_OTL
2011-08-21 13:14 . 2011-08-21 13:15        --------        d-----w-        c:\users\Fabian\AppData\Local\No23 Recorder
2011-08-21 13:14 . 2011-08-22 14:36        --------        d-----w-        c:\users\Fabian\AppData\Roaming\kikin
2011-08-21 13:14 . 2011-08-22 14:36        --------        d-----w-        c:\program files\kikin
2011-08-06 15:55 . 2011-08-26 19:11        --------        d-----w-        c:\users\Fabian\AppData\Local\Amazon
2011-08-06 00:59 . 2011-08-06 00:59        --------        d-----w-        c:\programdata\Vokabel Trainer
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-09-02 15:07 . 2011-07-19 11:14        404640        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl
2011-07-06 17:52 . 2010-09-02 19:02        41272        ----a-w-        c:\windows\system32\drivers\mbamswissarmy.sys
2011-07-06 17:52 . 2010-09-02 19:02        22712        ----a-w-        c:\windows\system32\drivers\mbam.sys
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-09 1232896]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2006-11-02 125440]
"DAEMON Tools"="c:\program files\DAEMON Tools\daemon.exe" [2007-04-03 165784]
"AlcoholAutomount"="c:\program files\Alcohol Soft\Alcohol 120\axcmd.exe" [2007-07-02 219520]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2010-04-01 357696]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="RtHDVCpl.exe" [2008-02-26 4939776]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 39792]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-07-21 266497]
"DAEMON Tools"="c:\program files\DAEMON Tools\daemon.exe" [2007-04-03 165784]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"HCWemmon"="HCWemmon.exe" [2007-03-29 61440]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-01-18 185896]
"NvSvc"="c:\windows\system32\nvsvc.dll" [2007-12-05 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-12-05 8530464]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-12-05 81920]
"Symantec PIF AlertEng"="c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 583048]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-03-11 49152]
"PWRISOVM.EXE"="c:\program files\PowerISO\PWRISOVM.EXE" [2009-11-09 180224]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"WPCUMI"="c:\windows\system32\WpcUmi.exe" [2006-11-02 176128]
"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-04-12 1135912]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-09-21 47904]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-09-08 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-09-24 421160]
"Malwarebytes' Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2011-07-06 1047656]
.
c:\users\Fabian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]
OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2008-10-25 98696]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=""
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-1054673845-2891796712-3211906163-1000]
"EnableNotificationsRef"=dword:00000001
.
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-04-16 135664]
R2 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\svcntaux.exe [x]
R3 ASPI;Advanced SCSI Programming Interface Driver;c:\windows\System32\DRIVERS\ASPI32.sys [2002-07-17 84832]
R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2010-04-16 135664]
R3 oad;Visibroker Activation Daemon;c:\progra~1\Borland\vbroker\bin\oad.exe [x]
R3 osagent;VisiBroker Smart Agent;c:\progra~1\Borland\vbroker\bin\osagent.exe [x]
R3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\system32\DRIVERS\VBoxNetAdp.sys [2010-03-25 99728]
R3 VBoxNetFlt;VBoxNetFlt Service;c:\windows\system32\DRIVERS\VBoxNetFlt.sys [x]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-12-29 691696]
S1 GRD;G DATA Rootkit Detector Driver;c:\windows\system32\drivers\GRD.sys [2007-12-26 16712]
S2 Automatisches LiveUpdate - Scheduler;Automatisches LiveUpdate - Scheduler;c:\program files\Symantec\LiveUpdate\ALUSchedulerSvc.exe [2007-09-26 554352]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - 34080359
*Deregistered* - 34080359
.
Inhalt des "geplante Tasks" Ordners
.
2011-09-04 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-04-16 14:50]
.
2011-09-04 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-04-16 14:50]
.
2011-08-05 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1054673845-2891796712-3211906163-1000Core.job
- c:\users\Fabian\AppData\Local\Google\Update\GoogleUpdate.exe [2011-06-29 10:33]
.
2011-09-04 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1054673845-2891796712-3211906163-1000UA.job
- c:\users\Fabian\AppData\Local\Google\Update\GoogleUpdate.exe [2011-06-29 10:33]
.
2011-09-04 c:\windows\Tasks\Norton Security Scan for Fabian.job
- c:\program files\Norton Security Scan\Engine\2.7.3.34\Nss.exe [2010-05-04 00:27]
.
2011-09-04 c:\windows\Tasks\User_Feed_Synchronization-{C27515C3-4436-493B-94A2-3C3CF69BDCC9}.job
- c:\windows\system32\msfeedssync.exe [2006-11-02 09:45]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page =
mStart Page =
mLocal Page =
IE: Free YouTube to Mp3 Converter - c:\users\Fabian\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: {{7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - c:\program files\ICQ7.5\ICQ.exe
LSP: c:\windows\system32\wpclsp.dll
TCP: DhcpNameServer = 192.168.0.1
FF - ProfilePath - c:\users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\5vl12vjn.default\
FF - prefs.js: browser.search.defaulturl -
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage -
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}
FF - Ext: Personas: personas@christopher.beard - %profile%\extensions\personas@christopher.beard
FF - user.js: yahoo.homepage.dontask - true
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
AddRemove-Super_nude_patch_II_1.0 - c:\windows\iun6002.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2011-09-04 20:57
Windows 6.0.6000  NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
Zeit der Fertigstellung: 2011-09-04  21:00:11
ComboFix-quarantined-files.txt  2011-09-04 19:00
ComboFix2.txt  2011-09-04 14:06
ComboFix3.txt  2010-09-03 17:09
.
Vor Suchlauf: 30 Verzeichnis(se), 107.018.489.856 Bytes frei
Nach Suchlauf: 31 Verzeichnis(se), 106.986.168.320 Bytes frei
.
- - End Of File - - 27B317D5D873F1EF737149C33ED72849

cosinus 05.09.2011 09:39
Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM!


Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.
  • Starte die aswMBR.exe - (aswMBR.exe Anleitung)
    Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten".
  • Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
    Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
  • Klicke auf Scan.
  • Warte bitte bis Scan finished successfully im DOS-Fenster steht.
  • Drücke auf Save Log und speichere diese auf dem Desktop.
Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).

hallohallo1 05.09.2011 19:29
Osam:
Code:
Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 20:19:19 on 05.09.2011

OS: Windows Vista Home Premium Edition (Build 6000), 32-bit
Default Browser: Mozilla Corporation Firefox 3.6.21

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries


[Common]
-----( %SystemRoot%\Tasks )-----
"GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"GoogleUpdateTaskUserS-1-5-21-1054673845-2891796712-3211906163-1000Core.job" - "Google Inc." - C:\Users\Fabian\AppData\Local\Google\Update\GoogleUpdate.exe
"GoogleUpdateTaskUserS-1-5-21-1054673845-2891796712-3211906163-1000UA.job" - "Google Inc." - C:\Users\Fabian\AppData\Local\Google\Update\GoogleUpdate.exe
"Norton Security Scan for Fabian.job" - "Symantec Corporation" - C:\Program Files\Norton Security Scan\Engine\2.7.3.34\Nss.exe

[Control Panel Objects]
-----( %SystemRoot%\system32 )-----
"bdeadmin.cpl" - ? - C:\Windows\system32\bdeadmin.cpl
"DivXControlPanelApplet.cpl" - "DivX, Inc." - C:\Windows\system32\DivXControlPanelApplet.cpl
"FlashPlayerCPLApp.cpl" - "Adobe Systems Incorporated" - C:\Windows\system32\FlashPlayerCPLApp.cpl
"ODBCCP32.CPL" - "Microsoft Corporation" - C:\Windows\system32\ODBCCP32.CPL
"PhysX.cpl" - ? - C:\Windows\system32\PhysX.cpl
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"Adobe Gamma" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma.cpl
"mlcfg32.cpl" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\MLCFG32.CPL
"Pando" - "Pando Networks" - C:\Program Files\Pando Networks\Media Booster\PMB.cpl
"QuickTime" - "Apple Inc." - C:\Program Files\QuickTime\QTSystem\QuickTime.cpl

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"a6j3wedu" (a6j3wedu) - "Microsoft Corporation" - C:\Windows\system32\drivers\a6j3wedu.sys  (Hidden registry entry, rootkit activity | File signed by Microsoft)
"Advanced SCSI Programming Interface Driver" (ASPI) - ? - C:\Windows\System32\DRIVERS\ASPI32.sys
"ae7cwhut" (ae7cwhut) - "Microsoft Corporation" - C:\Windows\system32\drivers\ae7cwhut.sys  (Hidden registry entry, rootkit activity | File signed by Microsoft)
"aine0bck" (aine0bck) - ? - C:\Windows\system32\drivers\aine0bck.sys  (Hidden registry entry, rootkit activity | File not found)
"avgio" (avgio) - "Avira GmbH" - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgio.sys
"avgntflt" (avgntflt) - "Avira GmbH" - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgntflt.sys
"avipbb" (avipbb) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avipbb.sys
"catchme" (catchme) - ? - C:\Users\Fabian\AppData\Local\Temp\catchme.sys  (File not found)
"enodpl" (enodpl) - ? - C:\Windows\System32\drivers\enodpl.sys  (File found, but it contains no detailed information)
"File Security Driver" (IKFileSec) - "PCTools Research Pty Ltd." - C:\Windows\System32\drivers\ikfilesec.sys
"G DATA Rootkit Detector Driver" (GRD) - "G DATA Software" - C:\Windows\system32\drivers\GRD.sys
"IP in IP Tunnel Driver" (IpInIp) - ? - C:\Windows\System32\DRIVERS\ipinip.sys  (File not found)
"IPX Traffic Filter Driver" (NwlnkFlt) - ? - C:\Windows\System32\DRIVERS\nwlnkflt.sys  (File not found)
"IPX Traffic Forwarder Driver" (NwlnkFwd) - ? - C:\Windows\System32\DRIVERS\nwlnkfwd.sys  (File not found)
"SCDEmu" (SCDEmu) - "PowerISO Computing, Inc." - C:\Windows\system32\drivers\SCDEmu.sys
"sptd" (sptd) - "Duplex Secure Ltd." - C:\Windows\System32\Drivers\sptd.sys  (File is exclusively opened, access blocked)
"ssmdrv" (ssmdrv) - "AVIRA GmbH" - C:\Windows\System32\DRIVERS\ssmdrv.sys
"Symantec Eraser Control driver" (eeCtrl) - "Symantec Corporation" - C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys
"System Filter Driver" (IKSysFlt) - "PCTools Research Pty Ltd." - C:\Windows\System32\drivers\iksysflt.sys
"System Security Driver" (IKSysSec) - "PCTools Research Pty Ltd." - C:\Windows\System32\drivers\iksyssec.sys
"tandpl" (tandpl) - ? - C:\Windows\System32\drivers\tandpl.sys  (File found, but it contains no detailed information)
"uglyipod" (uglyipod) - ? - C:\Users\Fabian\AppData\Local\Temp\uglyipod.sys  (Hidden registry entry, rootkit activity | File not found)
"VBoxNetFlt Service" (VBoxNetFlt) - ? - C:\Windows\System32\DRIVERS\VBoxNetFlt.sys  (File not found)
"Virtual Machine Monitor" (vmm) - "Microsoft Corporation" - C:\Windows\system32\Drivers\vmm.sys
"VirtualBox Host-Only Ethernet Adapter" (VBoxNetAdp) - "Sun Microsystems, Inc." - C:\Windows\System32\DRIVERS\VBoxNetAdp.sys

[Explorer]
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}" - ? - C:\Program Files\OpenOffice.org 2.4\program\shlxthdl.dll
-----( HKLM\Software\Classes\Protocols\Filter )-----
{807563E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
-----( HKLM\Software\Classes\Protocols\Handler )-----
{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
{88FED34C-F0CA-4636-A375-3CB6248B04CD} "Local Groove Web Services Protocol" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
{0A9007C0-4076-11D3-8789-0000F8105754} "Microsoft Infotech Storage Protocol for IE 4.0" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks )-----
{B5A7F190-DDA6-4420-B3BA-52453494E6CD} "Groove GFS Stub Execution Hook" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{AEB6717E-7E19-11d0-97EE-00C04FD91972} "{AEB6717E-7E19-11d0-97EE-00C04FD91972}" - ? -  (File not found | COM-object registry key not found)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{911051fa-c21c-4246-b470-070cd8df6dc4} ".cab or .zip files" - ? -  (File not found | COM-object registry key not found)
{1b24a030-9b20-49bc-97ac-1be4426f9e59} "ActiveDirectory Folder" - ? -  (File not found | COM-object registry key not found)
{34449847-FD14-4fc8-A75A-7432F5181EFB} "ActiveDirectory Folder" - ? -  (File not found | COM-object registry key not found)
{0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48} "Contacts folder" - ? -  (File not found | COM-object registry key not found)
{2C2577C2-63A7-40e3-9B7F-586602617ECB} "Explorer Query Band" - ? -  (File not found | COM-object registry key not found)
{99FD978C-D287-4F50-827F-B2C658EDA8E7} "Groove Explorer Icon Overlay 1 (GFS Unread Stub)" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} "Groove Explorer Icon Overlay 2 (GFS Stub)" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{920E6DB1-9907-4370-B3A0-BAFC03D81399} "Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{16F3DD56-1AF5-4347-846D-7C10C4192619} "Groove Explorer Icon Overlay 3 (GFS Folder)" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{2916C86E-86A6-43FE-8112-43ABE6BF8DCC} "Groove Explorer Icon Overlay 4 (GFS Unread Mark)" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{2A541AE1-5BF6-4665-A8A3-CFA9672E4291} "Groove Folder Synchronization" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{72853161-30C5-4D22-B7F9-0BBC1D38A37E} "Groove GFS Browser Helper" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{6C467336-8281-4E60-8204-430CED96822D} "Groove GFS Context Menu Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{B5A7F190-DDA6-4420-B3BA-52453494E6CD} "Groove GFS Stub Execution Hook" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{A449600E-1DC6-4232-B948-9BD794D62056} "Groove GFS Stub Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{387E725D-DC16-4D76-B310-2C93ED4752A0} "Groove XML Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{73B24247-042E-4EF5-ADC2-42F62E6FD654} "ICQ Lite Shell Extension" - ? -  (File not found | COM-object registry key not found)
{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF} "iTunes" - "Apple Inc." - C:\Program Files\iTunes\iTunesMiniPlayer.dll
{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\msohevi.dll
{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
{5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C} "Microsoft Office OneNote Namespace Extension for Windows Desktop Search" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\ONFILTER.DLL
{00020d75-0000-0000-c000-000000000046} "Microsoft Office Outlook" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\MLSHEXT.DLL
{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "OpenOffice.org Column Handler" - ? - C:\Program Files\OpenOffice.org 2.4\program\shlxthdl.dll
{087B3AE3-E237-4467-B8DB-5A38AB959AC9} "OpenOffice.org Infotip Handler" - ? - C:\Program Files\OpenOffice.org 2.4\program\shlxthdl.dll
{63542C48-9552-494A-84F7-73AA6A7C99C1} "OpenOffice.org Property Sheet Handler" - ? - C:\Program Files\OpenOffice.org 2.4\program\shlxthdl.dll
{3B092F0C-7696-40E3-A80F-68D74DA84210} "OpenOffice.org Thumbnail Viewer" - ? - C:\Program Files\OpenOffice.org 2.4\program\shlxthdl.dll
{0006F045-0000-0000-C000-000000000046} "Outlook File Icon Extension" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\OLKFSTUB.DLL
{967B2D40-8B7D-4127-9049-61EA0C2C6DCE} "PowerISO" - "PowerISO Computing, Inc." - C:\Program Files\PowerISO\PWRISOSH.DLL
{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4} "RealOne Player Context Menu Class" - "RealNetworks, Inc." - C:\Program Files\Real\RealPlayer\rpshell.dll
{C8494E42-ACDD-4739-B0FB-217361E4894F} "Sam Account Folder" - ? -  (File not found | COM-object registry key not found)
{E29F9716-5C08-4FCD-955A-119FDB5A522D} "Sam Account Folder" - ? -  (File not found | COM-object registry key not found)
{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira GmbH" - C:\Program Files\Avira\AntiVir PersonalEdition Classic\shlext.dll
{280CFDE1-1354-4431-92F3-03073BA593FB} "TotalConverter Context Menu Shell Extension" - ? -  (File not found | COM-object registry key not found)
{8932AEFE-9DB6-4f43-AFB2-5682F55E773A} "VPCHostCopyHook" - "Microsoft Corporation" - C:\Program Files\Microsoft Virtual PC\VPCShExH.DLL
{da67b8ad-e81b-4c70-9b91b417b5e33527} "Windows Search Shell Service" - ? -  (File not found | COM-object registry key not found)
{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - ? - C:\Program Files\WinRAR\rarext.dll  (File found, but it contains no detailed information)

[Internet Explorer]
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
<binary data> "ITBar7Layout" - ? -  (File not found | COM-object registry key not found)
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} "Java Plug-in 1.6.0_03" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_19" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab
{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} "Java Plug-in 1.6.0_19" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_19" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_19.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
{48E73304-E1D6-4330-914C-F5F514E3486C} "An OneNote senden" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
{A93C41D8-01F8-4F8B-B14C-DE20B117E636} "HP Intelligente Auswahl" - "Hewlett-Packard Co." - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
{E763472E-A716-4CD9-89BD-DBDA6122F741} "HP Sammelmappe" - "Hewlett-Packard Co." - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
"ICQ7.5" - "ICQ, LLC." - C:\Program Files\ICQ7.5\ICQ.exe
{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} "Adobe PDF Reader" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
{72853161-30C5-4D22-B7F9-0BBC1D38A37E} "Groove GFS Browser Helper" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{053F9267-DC04-4294-A72C-58F732D338C0} "HP Print Clips" - "Hewlett-Packard Co." - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll
{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2ssv.dll
{3049C3E9-B461-4BC5-8870-4C09146192CA} "RealPlayer Download and Record Plugin for Internet Explorer" - "RealPlayer" - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll

[Logon]
-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"Adobe Gamma.lnk" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe  (Shortcut exists | File exists)
"OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE  (Shortcut exists | File exists)
"desktop.ini" - ? - C:\Users\Fabian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----
"AlcoholAutomount" - "Alcohol Soft Development Team" - "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
"DAEMON Tools" - "DT Soft Ltd." - "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
"DAEMON Tools Lite" - "DT Soft Ltd" - "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----
"StartupPrograms" - ? - rdpclip  (File not found)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"Adobe Reader Speed Launcher" - "Adobe Systems Incorporated" - "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
"AdobeCS4ServiceManager" - "Adobe Systems Incorporated" - "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
"AppleSyncNotifier" - "Apple Inc." - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
"avgnt" - "Avira GmbH" - "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
"DAEMON Tools" - "DT Soft Ltd." - "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
"DivXUpdate" - ? - "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
"GrooveMonitor" - "Microsoft Corporation" - "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
"HP Software Update" - "Hewlett-Packard Co." - C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
"iTunesHelper" - "Apple Inc." - "C:\Program Files\iTunes\iTunesHelper.exe"
"Malwarebytes' Anti-Malware (reboot)" - "Malwarebytes Corporation" - "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
"PWRISOVM.EXE" - "PowerISO Computing, Inc." - C:\Program Files\PowerISO\PWRISOVM.EXE
"QuickTime Task" - "Apple Inc." - "C:\Program Files\QuickTime\QTTask.exe" -atboottime
"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
"Symantec PIF AlertEng" - "Symantec Corporation" - "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
"TkBellExe" - "RealNetworks, Inc." - "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot

[Print Monitors]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----
"LIDIL hpzll5ha" - "Hewlett-Packard Company" - C:\Windows\system32\hpzll5ha.dll
"Send To Microsoft OneNote Monitor" - "Microsoft Corporation" - C:\Windows\system32\msonpmon.dll

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"AntiVir PersonalEdition Classic Guard" (AntiVirService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
"AntiVir PersonalEdition Classic Planer" (AntiVirScheduler) - "Avira GmbH" - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
"Apple Mobile Device" (Apple Mobile Device) - "Apple Inc." - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
"Automatisches LiveUpdate - Scheduler" (Automatisches LiveUpdate - Scheduler) - "Symantec Corporation" - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
"FLEXnet Licensing Service" (FLEXnet Licensing Service) - ? - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
"Google Update Service (gupdate)" (gupdate) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"Google Update-Dienst (gupdatem)" (gupdatem) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"InstallDriver Table Manager" (IDriverT) - "Macrovision Corporation" - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
"iPod-Dienst" (iPod Service) - "Apple Inc." - C:\Program Files\iPod\bin\iPodService.exe
"LckFldService" (LckFldService) - ? - C:\Windows\system32\LckFldService.exe  (File not found)
"LiveUpdate" (LiveUpdate) - "Symantec Corporation" - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
"LiveUpdate Notice Service" (LiveUpdate Notice Service) - "Symantec Corporation" - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
"LiveUpdate Notice Service Ex" (LiveUpdate Notice Ex) - ? - "c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon  (File not found)
"Machine Debug Manager" (MDM) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
"Microsoft Office Diagnostics Service" (odserv) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
"Microsoft Office Groove Audit Service" (Microsoft Office Groove Audit Service) - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe
"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"PC Tools Auxiliary Service" (sdAuxService) - ? - C:\Program Files\Spyware Doctor\svcntaux.exe  (File not found)
"PC Tools Security Service" (sdCoreService) - ? - C:\Program Files\Spyware Doctor\swdsvc.exe  (File not found)
"StarWind AE Service" (StarWindServiceAE) - "Rocket Division Software" - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
"Symantec Lic NetConnect service" (CLTNetCnService) - ? - "c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon  (File not found)
"Visibroker Activation Daemon" (oad) - ? - C:\PROGRA~1\Borland\vbroker\bin\oad.exe  (File not found)
"VisiBroker Smart Agent" (osagent) - ? - C:\PROGRA~1\Borland\vbroker\bin\osagent.exe  (File not found)

===[ Logfile end ]=========================================[ Logfile end ]===

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru

hallohallo1 05.09.2011 20:37
und das letzte noch. Sorry wegen dem Doppelpost :/

Code:
aswMBR version 0.9.8.986 Copyright(c) 2011 AVAST Software
Run date: 2011-09-05 20:20:38
-----------------------------
20:20:38.184    OS Version: Windows 6.0.6000
20:20:38.185    Number of processors: 2 586 0x4303
20:20:38.187    ComputerName: FABIAN-PC  UserName: Fabian
20:20:39.699    Initialize success
20:22:12.129    AVAST engine defs: 11090500
20:22:24.968    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
20:22:24.968    Disk 0 Vendor: ST3500630AS 3.AAD Size: 476940MB BusType: 3
20:22:27.011    Disk 0 MBR read successfully
20:22:27.027    Disk 0 MBR scan
20:22:27.042    Disk 0 Windows VISTA default MBR code
20:22:27.058    Disk 0 scanning sectors +976771072
20:22:27.152    Disk 0 scanning C:\Windows\system32\drivers
20:22:39.522    Service scanning
20:22:40.349    Service sptd C:\Windows\System32\Drivers\sptd.sys **LOCKED** 32
20:22:41.004    Modules scanning
20:22:48.368    Disk 0 trace - called modules:
20:22:48.414    ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll >>UNKNOWN [0x853221f8]<<
20:22:48.414    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x854fda48]
20:22:48.430    3 ntkrnlpa.exe[820b0cf5] -> nt!IofCallDriver -> [0x853917d8]
20:22:48.430    5 acpi.sys[8046932a] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0x8539f5f8]
20:22:48.446    \Driver\atapi[0x845915f8] -> IRP_MJ_CREATE -> 0x853221f8
20:22:49.538    AVAST engine scan C:\Windows
20:22:54.826    AVAST engine scan C:\Windows\system32
20:25:45.084    AVAST engine scan C:\Windows\system32\drivers
20:25:58.578    AVAST engine scan C:\Users\Fabian
21:28:09.814    AVAST engine scan C:\ProgramData
21:32:28.634    Scan finished successfully
21:36:48.358    Disk 0 MBR has been saved successfully to "C:\Users\Fabian\Desktop\MBR.dat"
21:36:48.374    The log file has been saved successfully to "C:\Users\Fabian\Desktop\aswMBR.txt"

cosinus 05.09.2011 22:08
GMER ging nicht?

hallohallo1 05.09.2011 22:41
Oh sorry, hab ich vergessen zu erwähnen. Nein, das ging nicht. Es ist die ersten 3 Mal abgestürzt dann hab ich es sein lassen. :daumenrunter:

cosinus 05.09.2011 22:48
Sieht aber sonst ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!


Anschließend über den OnlineScanner von ESET eine zusätzliche Meinung zu holen ist auch nicht verkehrt:


ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


hallohallo1 06.09.2011 19:18
Hab jetzt beim 2. Programm die Sachen, die angezeigt worden sind direkt gelöscht und erst jetzt gesehen, dass ich das erst tun soll nachdem du das sagst. Ist das schlimm :/ ?

Malwarebytes:
Code:
Malwarebytes' Anti-Malware 1.51.1.1800
www.malwarebytes.org

Datenbank Version: 7662

Windows 6.0.6000
Internet Explorer 7.0.6000.16809

06.09.2011 15:52:33
mbam-log-2011-09-06 (15-52-33).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|F:\|G:\|H:\|I:\|J:\|K:\|L:\|M:\|N:\|O:\|Z:\|)
Durchsuchte Objekte: 429292
Laufzeit: 1 Stunde(n), 40 Minute(n), 54 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)
SuperAntiSpyware
Code:
SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com

Generated 09/06/2011 at 08:11 PM

Application Version : 5.0.1118

Core Rules Database Version : 7645
Trace Rules Database Version: 5457

Scan type      : Complete Scan
Total Scan Time : 03:16:32

Operating System Information
Windows Vista Home Premium 32-bit (Build 6.00.6000)
UAC On - Administrator

Memory items scanned      : 663
Memory threats detected  : 0
Registry items scanned    : 38452
Registry threats detected : 0
File items scanned        : 321894
File threats detected    : 176

Adware.Tracking Cookie
        C:\Users\Fabian\AppData\Roaming\Microsoft\Windows\Cookies\fabian@ad.yieldmanager[2].txt
        C:\Users\Fabian\AppData\Roaming\Microsoft\Windows\Cookies\fabian@ad3.adfarm1.adition[1].txt
        C:\Users\Fabian\AppData\Roaming\Microsoft\Windows\Cookies\fabian@adfarm1.adition[2].txt
        C:\Users\Fabian\AppData\Roaming\Microsoft\Windows\Cookies\fabian@content.yieldmanager[2].txt
        C:\Users\Fabian\AppData\Roaming\Microsoft\Windows\Cookies\fabian@content.yieldmanager[3].txt
        C:\Users\Fabian\AppData\Roaming\Microsoft\Windows\Cookies\fabian@doubleclick[1].txt
        C:\Users\Fabian\AppData\Roaming\Microsoft\Windows\Cookies\fabian@eyewonder[2].txt
        C:\Users\Fabian\AppData\Roaming\Microsoft\Windows\Cookies\fabian@googleads.g.doubleclick[1].txt
        C:\Users\Fabian\AppData\Roaming\Microsoft\Windows\Cookies\fabian@tradedoubler[1].txt
        .doubleclick.net [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        ad2.adfarm1.adition.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .zanox.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        ad3.adfarm1.adition.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .heavemedia.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .heavemedia.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .heavemedia.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .twinkteenboys.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .twinkteenboys.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        studivz.adfarm1.adition.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .tradedoubler.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .tradedoubler.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .tradedoubler.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        ad.zanox.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .traffictrack.de [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .apmebf.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        track.effiliation.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        track.effiliation.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        track.effiliation.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        track.effiliation.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        track.effiliation.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .imrworldwide.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .imrworldwide.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .ad.adnet.de [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .ad.adnet.de [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .ad.adnet.de [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        eas.apm.emediate.eu [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .fastclick.net [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        adfarm1.adition.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .zanox-affiliate.de [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        www.zanox-affiliate.de [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .apmebf.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .game-advertising-online.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .ru4.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .viacom.adbureau.net [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .viacom.adbureau.net [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .atdmt.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .atdmt.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .bs.serving-sys.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .content.yieldmanager.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        adserver2.exgfnetwork.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        ad4.adfarm1.adition.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .unitymedia.de [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .unitymedia.de [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .112.2o7.net [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .specificclick.net [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .adviva.net [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        ad.adition.net [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        ad1.adfarm1.adition.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        track.adform.net [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        track.adform.net [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .adform.net [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .xiti.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .mediaplex.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .mediaplex.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        www.elitepvpers.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        www.elitepvpers.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        www.elitepvpers.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .elitepvpers.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .elitepvpers.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .elitepvpers.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        fl01.ct2.comclick.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        fl01.ct2.comclick.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        fl01.ct2.comclick.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        adserver.adreactor.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        statse.webtrendslive.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .liveperson.net [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .liveperson.net [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .ads.quartermedia.de [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .ads.quartermedia.de [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        adserver2.clipkit.de [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        www.mediamarkt.de [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .a.revenuemax.de [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .insightexpressai.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .insightexpressai.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .insightexpressai.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .insightexpressai.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .insightexpressai.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .insightexpressai.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .insightexpressai.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .im.banner.t-online.de [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        media.gan-online.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        ad.adserver01.de [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .adbrite.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .adbrite.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .adbrite.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .adbrite.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .adbrite.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .pro-market.net [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .mediaplex.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        stats.justhost.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .eyewonder.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .eyewonder.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .eyewonder.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .eyewonder.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .tribalfusion.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .adserver.adtechus.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        adx.chip.de [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        adx.chip.de [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .statcounter.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .liveperson.net [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\FABIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\5VL12VJN.DEFAULT\COOKIES.SQLITE ]
        C:\USERS\GAST\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\GAST@BS.SERVING-SYS[2].TXT
        C:\USERS\GAST\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\GAST@HMT.CONNEXPROMOTIONS[2].TXT
        C:\USERS\GAST\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\GAST@MSNPORTAL.112.2O7[1].TXT
        C:\USERS\GAST\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\GAST@SERVING-SYS[1].TXT
        .media.funpic.de [ C:\USERS\GAST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\83Y3ADWU.DEFAULT\COOKIES.SQLITE ]
        ad.zanox.com [ C:\USERS\GAST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\83Y3ADWU.DEFAULT\COOKIES.SQLITE ]
        .doubleclick.net [ C:\USERS\GAST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\83Y3ADWU.DEFAULT\COOKIES.TXT ]
        .indextools.com [ C:\USERS\GAST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\83Y3ADWU.DEFAULT\COOKIES.TXT ]
        eas.apm.emediate.eu [ C:\USERS\GAST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\83Y3ADWU.DEFAULT\COOKIES.TXT ]
        eas.apm.emediate.eu [ C:\USERS\GAST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\83Y3ADWU.DEFAULT\COOKIES.TXT ]
        eas.apm.emediate.eu [ C:\USERS\GAST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\83Y3ADWU.DEFAULT\COOKIES.TXT ]
        .indextools.com [ C:\USERS\GAST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\83Y3ADWU.DEFAULT\COOKIES.TXT ]
        .adtech.de [ C:\USERS\GAST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\83Y3ADWU.DEFAULT\COOKIES.TXT ]
        .komtrack.com [ C:\USERS\GAST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\83Y3ADWU.DEFAULT\COOKIES.TXT ]
        .komtrack.com [ C:\USERS\GAST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\83Y3ADWU.DEFAULT\COOKIES.TXT ]
        ad.zanox.com [ C:\USERS\GAST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\83Y3ADWU.DEFAULT\COOKIES.TXT ]
        ad.adition.net [ C:\USERS\GAST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\83Y3ADWU.DEFAULT\COOKIES.TXT ]
        ad.adition.net [ C:\USERS\GAST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\83Y3ADWU.DEFAULT\COOKIES.TXT ]
        ad.adition.de [ C:\USERS\GAST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\83Y3ADWU.DEFAULT\COOKIES.TXT ]
        .adfarm1.adition.com [ C:\USERS\GAST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\83Y3ADWU.DEFAULT\COOKIES.TXT ]

Trojan.Agent/Gen-Frauder
        C:\DEPHI\PROJECTS\PROJECT2.EXE
        C:\DEPHI\PROJECTS\PROJECT3.EXE
        C:\USERS\FABIAN\DESKTOP\GAMES\2-FEHLERMELDUNGEN\FEHLERMELDUNGEN.EXE

Trojan.Unclassified/Loader-Suspicious
        C:\USERS\FABIAN\DESKTOP\GAMES\NEUER ORDNER\TEEWORLDS-0.4.2-WIN32\DATA\LOADER.EXE

Adware.Vundo/Variant-X32[Header]
        C:\WINDOWS\SYSTEM32\WSIWIN32.DLL

hallohallo1 06.09.2011 23:18
ESET
Code:
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6528
# api_version=3.0.2
# EOSSerial=7a48f6434ad31d4989117994f2c86a79
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-09-01 07:57:14
# local_time=2011-09-01 09:57:14 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.0.6000 NT
# compatibility_mode=512 16777215 100 0 31376586 31376586 0 0
# compatibility_mode=1792 16777195 100 0 119130417 119130417 0 0
# compatibility_mode=2560 16777215 100 0 0 0 0 0
# compatibility_mode=5892 16776573 100 100 76735078 152425969 0 0
# compatibility_mode=8192 67108863 100 0 152 152 0 0
# scanned=324290
# found=11
# cleaned=0
# scan_time=13793
C:\Users\Fabian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\12\1dd6a40c-617b9dca        multiple threats (unable to clean)        00000000000000000000000000000000        I
C:\Users\Fabian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\3\974d443-44b4cfd1        probably a variant of Java/TrojanDownloader.Agent.AB trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Fabian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\47\140bd1ef-2391d66f        a variant of Java/Exploit.Agent.NAL trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Fabian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\49\1eff1eb1-2fd1f8ec        Java/TrojanDownloader.Agent.NBL trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Fabian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\54\694a16f6-20060773        multiple threats (unable to clean)        00000000000000000000000000000000        I
C:\Users\Fabian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\54\694a16f6-4c33b3ea        multiple threats (unable to clean)        00000000000000000000000000000000        I
C:\Users\Fabian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\55\44342237-155183ac        Java/Exploit.Agent.NAJ trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Fabian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\55\44342237-3767c220        Java/Exploit.Agent.NAJ trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Fabian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\56\e668b8-3fab79d9        multiple threats (unable to clean)        00000000000000000000000000000000        I
C:\Users\Fabian\Documents\ICQ\382996850\ReceivedFiles\373710178 zorro79\RSD 0.587\RSD 0.587\ccf2rsdf.exe        probably a variant of Win32/Agent.MXEKFBP trojan (unable to clean)        00000000000000000000000000000000        I
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\55\2b70da77-27c687e4        multiple threats (unable to clean)        00000000000000000000000000000000        I
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6528
# api_version=3.0.2
# EOSSerial=7a48f6434ad31d4989117994f2c86a79
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-09-06 10:16:06
# local_time=2011-09-07 12:16:06 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.0.6000 NT
# compatibility_mode=512 16777215 100 0 31818013 31818013 0 0
# compatibility_mode=1792 16777195 100 0 119571844 119571844 0 0
# compatibility_mode=2560 16777215 100 0 0 0 0 0
# compatibility_mode=5892 16776573 100 100 77176505 152867396 0 0
# compatibility_mode=8192 67108863 100 0 441579 441579 0 0
# scanned=285404
# found=10
# cleaned=0
# scan_time=12699
C:\Users\Fabian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\12\1dd6a40c-617b9dca        multiple threats (unable to clean)        00000000000000000000000000000000        I
C:\Users\Fabian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\3\974d443-44b4cfd1        probably a variant of Java/TrojanDownloader.Agent.AB trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Fabian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\47\140bd1ef-2391d66f        a variant of Java/Exploit.Agent.NAL trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Fabian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\49\1eff1eb1-2fd1f8ec        Java/TrojanDownloader.Agent.NBL trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Fabian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\54\694a16f6-20060773        multiple threats (unable to clean)        00000000000000000000000000000000        I
C:\Users\Fabian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\54\694a16f6-4c33b3ea        multiple threats (unable to clean)        00000000000000000000000000000000        I
C:\Users\Fabian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\55\44342237-155183ac        Java/Exploit.Agent.NAJ trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Fabian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\55\44342237-3767c220        Java/Exploit.Agent.NAJ trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Fabian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\56\e668b8-3fab79d9        multiple threats (unable to clean)        00000000000000000000000000000000        I
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\55\2b70da77-27c687e4        multiple threats (unable to clean)        00000000000000000000000000000000        I

cosinus 07.09.2011 10:21
Zitat:
C:\USERS\FABIAN\DESKTOP\GAMES\2-FEHLERMELDUNGEN\FEHLERMELDUNGEN.EXE
Was soll das sein?

Zitat:
C:\USERS\FABIAN\DESKTOP\GAMES\NEUER ORDNER\TEEWORLDS-0.4.2-WIN32\DATA\LOADER.EXE
Und das?

Zitat:
C:\WINDOWS\SYSTEM32\WSIWIN32.DLL
Bitte diese Dateien bei Virustotal auswerten lassen und von jeder den Ergebnislink posten. Falls Du die Dateien nicht siehst, musst Du sie evtl. vorher sichtbar machen.
Wenn eine Datei schon ausgewerte sein sollte, bitte eine weitere Auswertung starten.

hallohallo1 07.09.2011 13:31
Das mit der fehlermeldung ist ein Delphi-Programm. Bzw. ne Hausaufgabe, die wir mal vor Ewigkeiten aufbekommen haben..die hat dann anscheinend nicht funktioniert und deshalb hab ich das fehlermeldung genannt

hxxp://www.virustotal.com/file-scan/compact.html?id=cd184086ca31f6a548ef71f173ca4002b0d18bd60849b9fe81df61b03a69e704-1315397375

teeworlds ist so ein internetspiel wo kleine männchen gegeneinander kämpfen^^
und das 3. weiß ich nicht.

aber beide ließen sich trotz der anleitung sachen sichtbar zu machen, nicht finden :/

cosinus 07.09.2011 14:04
Zitat:
und das 3. weiß ich nicht.
Und die Virustotal-Auswertung dieser Datei? Ich wollte eigentlich dass du v.a. diese auswertest, oder ist das die?

hallohallo1 07.09.2011 14:19
Nein, denn die hat er ja nicht gefunden trotz sichtbarmachens

cosinus 07.09.2011 14:27
Hast du die Funde mit SASW denn schon entfernt?

hallohallo1 07.09.2011 14:31
Du meinst die Sachen, die SuperAntiSpyware angezeigt hat?
Das waren so 170 Sachen und ich hab die gelöscht

cosinus 07.09.2011 14:36
Ja dann ist es ja auch logsch warum du die Datei findest!!

Wie läuft der Rechner denn jetzt wieder, ist er wieder im Lot?

hallohallo1 07.09.2011 14:40
Ich denke, dass er in Ordnung läuft. Das mit dem BKA-Trojaner-"Pop-Up" war ja bereits vorm Starten des Threads weg gewesen durch die Systemwiederherstellung aber ich habe auch das Gefühl, dass nach all den Schritten der Computer insgesamt etwas schneller läuft.

Aber vielleicht bilde ich mir das auch nur ein

cosinus 07.09.2011 14:41
Dann wären wir durch! :abklatsch:

Die Programme, die hier zum Einsatz kamen, können alle wieder runter. CF kann über Start, Ausführen mit combofix /uninstall entfernt werden. Melde dich falls es da Fehlermeldungen zu gibt.
Malwarebytes zu behalten ist kein Fehler. Kannst ja 1x im Monat damit scannen, aber immer vorher ans Update denken.

Bitte abschließend die Updates prüfen, unten mein Leitfaden dazu. Um in Zukunft die Aktualität der installierten Programme besser im Überblick zu halten, kannst du zB Secunia PSI verwenden.
Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern.


Microsoftupdate

Windows XP: Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.

Windows Vista/7: Anleitung Windows-Update


PDF-Reader aktualisieren
Ein veralteter AdobeReader stellt ein großes Sicherheitsrisiko dar. Du solltest daher besser alte Versionen vom AdobeReader über Systemsteuerung => Software bzw. Programme und Funktionen deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst. (falls du AdobeReader installiert hast)

Ich empfehle einen alternativen PDF-Reader wie PDF Xchange Viewer, SumatraPDF oder Foxit PDF Reader, beide sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers, hier der direkte Downloadlink:

Mozilla und andere Browser => http://filepony.de/?q=Flash+Player
Internet Explorer => http://fpdownload.adobe.com/get/flas..._player_ax.exe

Natürlich auch darauf achten, dass andere installierte Browser wie zB Firefox, Opera oder Chrome aktuell sind.


Java-Update
Veraltete Java-Installationen sind ein Sicherheitsrisiko, daher solltest Du die alten Versionen löschen (falls vorhanden, am besten mit JavaRa) und auf die neuste aktualisieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.

hallohallo1 07.09.2011 15:19
Ok, werde ich dann heute Abend alles mal machen.
Vielen Dank für deine Hilfe ! :)


Alle Zeitangaben in WEZ +1. Es ist jetzt 10:14 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55