Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   delayed write failed Virus schwarzer Bildschirm (https://www.trojaner-board.de/107661-delayed-write-failed-virus-schwarzer-bildschirm.html)

Olivia81 06.01.2012 12:09
delayed write failed Virus schwarzer Bildschirm
 
hallo,
ich habe seit gestern einen schwarzen Bildschirm, Fehlermeldungen mit "delayed write failure" und im Internet werde ich auf eigenartige Seite wie zB gefälschte Bundespolizei Websites geschickt. Meine sämtlichen Dateien sind verschwunden, obwohl die Festplatte zur Hälfte belegt ist.
Ich bin einer Youtube-Anleitung gefolgt, jetzt sehe ich wieder ein paar vereinzelte Dateien - aber längst nicht alles - und der Computer funktioniert definitiv nicht einwandfrei (klicke ich auf Start sehe ich die Programme nicht), er ist sehr langsam und hängt sich öfters auf. Malewarebytes lässt sich nicht mehr installieren, das lässt das System nicht zu. Außerdem erhalte ich Fehlermeldungen wie zB "Microsoft Visual C - Runtime error". Ich bin schon ziemlich verzweifelt... avira antivir sagt, dass mein System sauber ist.
Es wäre großartig, wenn mir jemand helfen könnte!!!
Vielen lieben Dank!

OTL Logfile:
Code:
OTL logfile created on: 06.01.2012 02:27:42 - Run 2
OTL by OldTimer - Version 3.2.31.0    Folder = C:\Users\Schatzipu\Desktop
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19019)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,97 Gb Total Physical Memory | 1,24 Gb Available Physical Memory | 41,90% Memory free
6,13 Gb Paging File | 4,33 Gb Available in Paging File | 70,68% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 286,87 Gb Total Space | 117,08 Gb Free Space | 40,81% Space Free | Partition Type: NTFS
Unable to calculate disk information.
 
Computer Name: SCHATZIPU-PC | User Name: Schatzipu | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Schatzipu\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Users\Schatzipu\Desktop\HiJackThis204.exe (Trend Micro Inc.)
PRC - C:\Users\Schatzipu\AppData\Local\Akamai\netsession_win.exe (Akamai Technologies, Inc)
PRC - C:\Programme\Avira\AntiVir Desktop\avshadow.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Avira\AntiVir Desktop\avcenter.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\ESET\ESET Online Scanner\OnlineCmdLineScanner.exe ()
PRC - C:\Programme\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe (Research In Motion Limited)
PRC - C:\Programme\Internet Explorer\iexplore.exe (Microsoft Corporation)
PRC - C:\Programme\T-Online\T-Online_Software_6\Basis-Software\Basis1\ToADiMon.exe (Deutsche Telekom AG, Marmiko IT-Solutions GmbH)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Programme\Sony\VAIO Power Management\SPMgr.exe (Sony Corporation)
PRC - C:\Programme\Sony\VAIO Power Management\SPMService.exe (Sony Corporation)
PRC - C:\Programme\Sony\Network Utility\NSUService.exe (Sony Corporation)
PRC - C:\Windows\RTKAUDIOSERVICE.EXE (Realtek Semiconductor)
PRC - C:\Programme\Sony\VAIO Event Service\VESMgr.exe (Sony Corporation)
PRC - C:\Programme\Sony\VAIO Event Service\VESMgrSub.exe (Sony Corporation)
PRC - C:\Programme\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe (Sony Corporation)
PRC - C:\Programme\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe (Sony Corporation)
PRC - C:\Programme\Sony\VAIO Update 4\VAIOUpdt.exe (Sony Corporation)
PRC - C:\Programme\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe (Sony Corporation)
PRC - C:\Programme\Intel\WiFi\bin\EvtEng.exe (Intel(R) Corporation)
PRC - C:\Programme\Common Files\Intel\WirelessCommon\RegSrvc.exe (Intel(R) Corporation)
PRC - C:\Programme\Apoint\Apoint.exe (Alps Electric Co., Ltd.)
PRC - C:\Programme\Apoint\ApntEx.exe (Alps Electric Co., Ltd.)
PRC - C:\Programme\Apoint\ApMsgFwd.exe (Alps Electric Co., Ltd.)
PRC - C:\Windows\System32\conime.exe (Microsoft Corporation)
PRC - C:\Programme\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe ()
PRC - C:\Programme\Common Files\InterVideo\RegMgr\iviRegMgr.exe (InterVideo)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Programme\ESET\ESET Online Scanner\OnlineCmdLineScanner.exe ()
MOD - C:\Programme\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Programme\Common Files\Apple\Apple Application Support\libxml2.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.IdentityMode#\99086ab77e1106d5c5560b2779f78255\System.IdentityModel.Selectors.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceModel\28614de814ab3dee1116a28b74d1f61d\System.ServiceModel.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Seri#\e93822edb472a839dbbe63ea5a28d153\System.Runtime.Serialization.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.IdentityModel\d45da410afb075d5f4ccfebf99180bd1\System.IdentityModel.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\SMDiagnostics\0d68d05599b6aa5110da103e5103f674\SMDiagnostics.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\d2f51b9bd3ada1f95da3d411dccd0a14\System.Web.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\19f5c72f22f18275e3fa45a2a8e04140\System.Windows.Forms.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\618be9fca90bc21db0010bae1e84dad4\System.Drawing.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\5c64322812ad3369c7618e5f52d13a72\System.Xml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\e84d59fe1ddbb9bc68fc7f5920364fbc\System.Configuration.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\e757b4f83931d47c785b0aaacf7cce81\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\fb0a3a6e527462455beda91d7ea58de5\mscorlib.ni.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\SPMDam\3.1.0.6020__1b3c579b6925895f\SPMDam.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\SPMCommon\3.1.0.6020__e3c7096ba83f9295\SPMCommon.dll ()
MOD - C:\Windows\System32\atitmmxx.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\System.ServiceModel.resources\3.0.0.0_de_b77a5c561934e089\System.ServiceModel.resources.dll ()
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (Akamai) -- c:\program files\common files\akamai/netsession_win_b427739.dll ()
SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
SRV - (FLEXnet Licensing Service) -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.)
SRV - (VAIO Power Management) -- C:\Program Files\Sony\VAIO Power Management\SPMService.exe (Sony Corporation)
SRV - (NSUService) -- C:\Program Files\Sony\Network Utility\NSUService.exe (Sony Corporation)
SRV - (RtkAudioService) -- C:\Windows\RTKAUDIOSERVICE.EXE (Realtek Semiconductor)
SRV - (VAIO Event Service) -- C:\Programme\Sony\VAIO Event Service\VESMgr.exe (Sony Corporation)
SRV - (VCFw) -- C:\Program Files\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe (Sony Corporation)
SRV - (Vcsw) -- C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe (Sony Corporation)
SRV - (VcmIAlzMgr) -- C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe (Sony Corporation)
SRV - (VcmXmlIfHelper) -- C:\Program Files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper.exe (Sony Corporation)
SRV - (VzCdbSvc) -- C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe (Sony Corporation)
SRV - (VAIO Entertainment TV Device Arbitration Service) -- C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzHardwareResourceManager\VzHardwareResourceManager\VzHardwareResourceManager.exe (Sony Corporation)
SRV - (SOHDms) -- C:\Program Files\Sony\VAIO Media plus\SOHDms.exe (Sony Corporation)
SRV - (SOHCImp) -- C:\Program Files\Sony\VAIO Media plus\SOHCImp.exe (Sony Corporation)
SRV - (SOHDs) -- C:\Program Files\Sony\VAIO Media plus\SOHDs.exe (Sony Corporation)
SRV - (SPTISRV) -- C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe (Sony Corporation)
SRV - (MSCSPTISRV) -- C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe (Sony Corporation)
SRV - (PACSPTISVR) -- C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe (Sony Corporation)
SRV - (EvtEng) -- C:\Programme\Intel\WiFi\bin\EvtEng.exe (Intel(R) Corporation)
SRV - (RegSrvc) -- C:\Programme\Common Files\Intel\WirelessCommon\RegSrvc.exe (Intel(R) Corporation)
SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (AdobeActiveFileMonitor6.0) -- C:\Programme\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe ()
SRV - (IviRegMgr) -- C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe (InterVideo)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (fwliruoc) -- C:\Users\SCHATZ~1\AppData\Local\Temp\fwliruoc.sys (GMER)
DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH)
DRV - (avkmgr) -- C:\Windows\System32\drivers\avkmgr.sys (Avira GmbH)
DRV - (MTOnlPktAlyX) -- C:\Programme\T-Online\T-Online_Software_6\Basis-Software\Basis1\MTOnlPktAlyx.sys (Deutsche Telekom AG AG, Marmiko IT-Solutions GmbH)
DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (atikmdag) -- C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (DMICall) -- C:\Windows\System32\drivers\DMICall.sys (Sony Corporation)
DRV - (rimsptsk) -- C:\Windows\System32\drivers\rimsptsk.sys (REDC)
DRV - (RTHDMIAzAudService) -- C:\Windows\System32\drivers\RtHDMIV.sys (Realtek Semiconductor Corp.)
DRV - (risdptsk) -- C:\Windows\System32\drivers\risdptsk.sys (REDC)
DRV - (WimFltr) -- C:\Windows\System32\drivers\WimFltr.sys (Microsoft Corporation)
DRV - (NETw5v32) Intel(R) -- C:\Windows\System32\drivers\NETw5v32.sys (Intel Corporation)
DRV - (SFEP) -- C:\Windows\System32\drivers\SFEP.sys (Sony Corporation)
DRV - (ApfiltrService) -- C:\Windows\System32\drivers\Apfiltr.sys (Alps Electric Co., Ltd.)
DRV - (XAudio) -- C:\Windows\System32\drivers\XAudio.sys (Conexant Systems, Inc.)
DRV - (regi) -- C:\Windows\System32\drivers\regi.sys (InterVideo)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKLM\..\URLSearchHook: {7e111a5c-3d11-4f56-9463-5310c3c69025} - C:\Programme\Freeware.de\prxtbFree.dll (Conduit Ltd.)
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [Binary data over 100 bytes]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.orf.at/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Ask.com"
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.selectedEngine: "Ask.com"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..extensions.enabledItems: ffxtlbr@Facemoods.com:1.2.1
FF - prefs.js..extensions.enabledItems: {82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}:5.6.0.8442
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Users\Schatzipu\Desktop\Ulli\Programme\divx\DivX Player\npDivxPlayerPlugin.dll (DivX, Inc)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Picasa2\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.0.61118.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.69: C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.3.69: C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.69: C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=:  File not found
FF - HKLM\Software\MozillaPlugins\@RIM.com/WebSLLauncher,version=1.0: C:\Program Files\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll ()
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.17\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.06.26 08:52:01 | 000,000,000 | -H-D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.17\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.06.26 08:52:01 | 000,000,000 | -H-D | M]
 
[2010.07.29 10:09:23 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\Schatzipu\AppData\Roaming\mozilla\Extensions
[2011.12.13 22:06:46 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\Schatzipu\AppData\Roaming\mozilla\Firefox\Profiles\dkk0kp2n.default\extensions
[2010.11.09 17:05:16 | 000,000,000 | -H-D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Schatzipu\AppData\Roaming\mozilla\Firefox\Profiles\dkk0kp2n.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011.03.27 20:51:16 | 000,000,000 | -H-D | M] (Facemoods) -- C:\Users\Schatzipu\AppData\Roaming\mozilla\Firefox\Profiles\dkk0kp2n.default\extensions\ffxtlbr@Facemoods.com
[2011.07.15 20:20:40 | 000,002,397 | -H-- | M] () -- C:\Users\Schatzipu\AppData\Roaming\Mozilla\Firefox\Profiles\dkk0kp2n.default\searchplugins\askcom.xml
[2011.12.13 22:06:46 | 000,000,000 | -H-D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2011.10.21 20:02:55 | 000,000,000 | -H-D | M] (Skype Click to Call) -- C:\Programme\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2011.03.20 09:59:52 | 000,000,000 | -H-D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
[2011.10.21 20:02:55 | 000,000,000 | -H-D | M] (Skype Click to Call) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2011.03.20 09:59:52 | 000,000,000 | -H-D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
[2011.03.20 09:58:50 | 000,472,808 | -H-- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2011.06.26 08:51:54 | 000,001,392 | -H-- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011.06.26 08:51:54 | 000,002,344 | -H-- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2011.06.26 08:51:54 | 000,006,805 | -H-- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2011.06.26 08:51:54 | 000,001,178 | -H-- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2011.06.26 08:51:54 | 000,001,105 | -H-- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2010.05.29 21:24:35 | 000,000,027 | -H-- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O2 - BHO: (CescrtHlpr Object) - {64182481-4F71-486b-A045-B233BD0DA8FC} - C:\Programme\facemoods.com\facemoods\1.4.17.6\bh\facemoods.dll (facemoods.com BHO)
O2 - BHO: (Freeware.de Toolbar) - {7e111a5c-3d11-4f56-9463-5310c3c69025} - C:\Programme\Freeware.de\prxtbFree.dll (Conduit Ltd.)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O3 - HKCU\..\Toolbar\WebBrowser: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKCU\..\Toolbar\WebBrowser: (Freeware.de Toolbar) - {7E111A5C-3D11-4F56-9463-5310C3C69025} - C:\Programme\Freeware.de\prxtbFree.dll (Conduit Ltd.)
O4 - HKLM..\Run: [Apoint] C:\Programme\Apoint\Apoint.exe (Alps Electric Co., Ltd.)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [facemoods] C:\Program Files\facemoods.com\facemoods\1.4.17.6\facemoodssrv.exe (facemoods.com)
O4 - HKLM..\Run: [RIMBBLaunchAgent.exe] C:\Programme\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe (Research In Motion Limited)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [ToADiMon.exe] C:\Program Files\T-Online\T-Online_Software_6\Basis-Software\Basis1\ToADiMon.exe (Deutsche Telekom AG, Marmiko IT-Solutions GmbH)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [Akamai NetSession Interface] C:\Users\Schatzipu\AppData\Local\Akamai\netsession_win.exe (Akamai Technologies, Inc)
O4 - Startup: C:\Users\Schatzipu\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Terminkalender2.lnk = C:\Softwarenetz\Terminkalender2\kalender2.exe (softwarenetz.de)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoSecCPL = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoDevMgrPage = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoConfigPage = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoVirtMemPage = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoFileSysPage = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoNetSetup = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoNetSetupIDPage = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoNetSetupSecurityPage = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoWorkgroupContents = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoEntireNetwork = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoFileSharingControl = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: An vorhandenes PDF anfügen - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Auswahl in Adobe PDF konvertieren - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Auswahl in vorhandene PDF-Datei konvertieren - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Bild an &Bluetooth-Gerät senden... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html File not found
O8 - Extra context menu item: In Adobe PDF konvertieren - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Seite an &Bluetooth-Gerät senden... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O8 - Extra context menu item: Verknüpfungsziel in Adobe PDF konvertieren - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKCU\..Trusted Domains: maxdome.de ([www] https in Vertrauenswürdige Sites)
O16 - DPF: {0972B098-DEE9-4279-AC7E-4BAAA029102D} hxxp://assets.photobox.com/assets/aurigma/ImageUploader5.cab?20111123062837 (PhotoboxPhotowaysUploader5 Control)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{CCB0A9D0-05AD-4A90-9C7C-06497781FE78}: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\VESWinlogon: DllName - (VESWinlogon.dll) - C:\Windows\System32\VESWinlogon.dll (Sony Corporation)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img24.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img24.jpg
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | -H-- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.01.06 00:25:34 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\Schatzipu\Desktop\OTL.exe
[2012.01.06 00:14:42 | 000,000,000 | ---D | C] -- C:\Program Files\ESET
[2012.01.05 21:47:46 | 000,060,416 | -H-- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2012.01.05 21:46:47 | 000,000,000 | --SD | C] -- C:\ComboFix
[2012.01.05 21:31:51 | 000,000,000 | -H-D | C] -- C:\Qoobox
[2012.01.05 21:31:25 | 000,000,000 | -HSD | C] -- C:\ProgramData\{32364CEA-7855-4A3C-B674-53D8E9B97936}
[2012.01.05 21:31:15 | 035,944,352 | -H-- | C] (TuneUp Software) -- C:\Users\Schatzipu\Desktop\TuneUpUtilities2012_de-DE.exe
[2012.01.05 21:15:56 | 000,388,608 | -H-- | C] (Trend Micro Inc.) -- C:\Users\Schatzipu\Desktop\HiJackThis204.exe
[2012.01.05 21:12:41 | 010,847,608 | ---- | C] (Malwarebytes Corporation                                    ) -- C:\Users\Schatzipu\Desktop\mbam-setup-1.60.0.1800.exe
[2012.01.05 20:40:07 | 000,000,000 | -H-D | C] -- C:\Users\Schatzipu\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Check
[2012.01.04 11:23:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2012.01.04 11:19:57 | 000,000,000 | -H-D | C] -- C:\Program Files\iPod
[2012.01.03 12:19:28 | 000,000,000 | -H-D | C] -- C:\Users\Schatzipu\Desktop\Der Racheplan
[2011.12.20 21:33:53 | 000,000,000 | -H-D | C] -- C:\Users\Schatzipu\AppData\Roaming\Avira
[2011.12.20 20:28:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
[2011.12.20 20:27:52 | 000,028,520 | -H-- | C] (Avira GmbH) -- C:\Windows\System32\drivers\ssmdrv.sys
[2011.12.20 20:27:51 | 000,134,856 | -H-- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avipbb.sys
[2011.12.20 20:27:51 | 000,074,640 | -H-- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avgntflt.sys
[2011.12.20 20:27:51 | 000,036,000 | -H-- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avkmgr.sys
[2011.12.20 20:27:44 | 000,000,000 | -H-D | C] -- C:\ProgramData\Avira
[2011.12.20 20:27:44 | 000,000,000 | -H-D | C] -- C:\Program Files\Avira
[2 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.01.06 02:29:12 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012.01.06 02:29:12 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012.01.06 02:22:06 | 000,001,098 | -H-- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.01.06 00:50:35 | 000,302,592 | ---- | M] () -- C:\Users\Schatzipu\Desktop\x1qc2ymg.exe
[2012.01.06 00:47:18 | 000,000,000 | ---- | M] () -- C:\Users\Schatzipu\defogger_reenable
[2012.01.06 00:46:36 | 000,050,477 | ---- | M] () -- C:\Users\Schatzipu\Desktop\Defogger.exe
[2012.01.06 00:29:14 | 000,184,832 | -H-- | M] () -- C:\Users\Schatzipu\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.01.06 00:25:37 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Schatzipu\Desktop\OTL.exe
[2012.01.05 23:57:52 | 010,847,608 | ---- | M] (Malwarebytes Corporation                                    ) -- C:\Users\Schatzipu\Desktop\mbam-setup-1.60.0.1800.exe
[2012.01.05 23:28:30 | 000,001,094 | -H-- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.01.05 23:27:45 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.01.05 23:27:40 | 3186,663,424 | -HS- | M] () -- C:\hiberfil.sys
[2012.01.05 23:26:43 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat
[2012.01.05 21:37:46 | 000,000,890 | -H-- | M] () -- C:\Users\Schatzipu\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0.9387475142808446.exe.lnk
[2012.01.05 21:37:26 | 000,002,032 | -H-- | M] () -- C:\Users\Schatzipu\AppData\Local\d3d9caps.dat
[2012.01.05 21:35:29 | 000,000,890 | -H-- | M] () -- C:\Users\Schatzipu\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0.9858427682719441.exe.lnk
[2012.01.05 21:31:15 | 035,944,352 | -H-- | M] (TuneUp Software) -- C:\Users\Schatzipu\Desktop\TuneUpUtilities2012_de-DE.exe
[2012.01.05 21:15:57 | 000,388,608 | -H-- | M] (Trend Micro Inc.) -- C:\Users\Schatzipu\Desktop\HiJackThis204.exe
[2012.01.05 20:44:31 | 002,270,652 | -H-- | M] () -- C:\Windows\System32\perfh009.dat
[2012.01.05 20:44:31 | 001,697,126 | -H-- | M] () -- C:\Windows\System32\perfc009.dat
[2012.01.05 20:44:29 | 005,945,910 | -H-- | M] () -- C:\Windows\System32\perfh007.dat
[2012.01.05 20:44:29 | 001,878,310 | -H-- | M] () -- C:\Windows\System32\perfc007.dat
[2011.12.29 18:35:10 | 007,429,846 | -H-- | M] () -- C:\Users\Schatzipu\Desktop\323k16-11_3.pdf
[2011.12.28 11:11:21 | 000,000,069 | -H-- | M] () -- C:\Windows\NeroDigital.ini
[2011.12.20 12:58:43 | 000,733,528 | -H-- | M] () -- C:\Users\Schatzipu\Desktop\Reihenendhaus-2743990[1].pdf
[2011.12.10 15:24:06 | 000,020,464 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2011.12.09 12:40:20 | 000,134,856 | -H-- | M] (Avira GmbH) -- C:\Windows\System32\drivers\avipbb.sys
[2011.12.09 12:40:20 | 000,074,640 | -H-- | M] (Avira GmbH) -- C:\Windows\System32\drivers\avgntflt.sys
[2011.12.09 12:40:20 | 000,036,000 | -H-- | M] (Avira GmbH) -- C:\Windows\System32\drivers\avkmgr.sys
[2 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.01.06 00:50:34 | 000,302,592 | ---- | C] () -- C:\Users\Schatzipu\Desktop\x1qc2ymg.exe
[2012.01.06 00:47:18 | 000,000,000 | ---- | C] () -- C:\Users\Schatzipu\defogger_reenable
[2012.01.06 00:46:42 | 000,050,477 | ---- | C] () -- C:\Users\Schatzipu\Desktop\Defogger.exe
[2012.01.05 21:50:57 | 3186,663,424 | -HS- | C] () -- C:\hiberfil.sys
[2012.01.05 21:37:46 | 000,000,890 | -H-- | C] () -- C:\Users\Schatzipu\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0.9387475142808446.exe.lnk
[2012.01.05 21:35:29 | 000,000,890 | -H-- | C] () -- C:\Users\Schatzipu\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0.9858427682719441.exe.lnk
[2011.12.29 18:35:10 | 007,429,846 | -H-- | C] () -- C:\Users\Schatzipu\Desktop\323k16-11_3.pdf
[2011.12.20 12:58:41 | 000,733,528 | -H-- | C] () -- C:\Users\Schatzipu\Desktop\Reihenendhaus-2743990[1].pdf
[2011.11.20 16:13:10 | 000,108,360 | -H-- | C] () -- C:\Windows\System32\mlfcache.dat
[2011.03.19 09:26:06 | 000,089,088 | -H-- | C] () -- C:\Windows\System32\mbr.exe
[2010.07.29 10:09:17 | 000,000,000 | -H-- | C] () -- C:\Windows\nsreg.dat
[2010.06.24 08:00:31 | 000,000,032 | -H-- | C] () -- C:\ProgramData\ezsid.dat
[2009.12.26 11:19:35 | 000,000,441 | -H-- | C] () -- C:\Windows\T1.ini
[2009.12.11 17:51:28 | 000,000,085 | -HS- | C] () -- C:\ProgramData\.zreglib
[2009.09.06 11:06:44 | 000,000,763 | -H-- | C] () -- C:\Windows\cdplayer.ini
[2009.06.07 17:49:50 | 000,000,069 | -H-- | C] () -- C:\Windows\NeroDigital.ini
[2009.03.22 21:36:52 | 000,101,417 | -H-- | C] () -- C:\Users\Schatzipu\AppData\Roaming\com.kennettnet.MusicRescue4.Profiles.plist
[2009.03.22 20:52:27 | 000,890,191 | -H-- | C] () -- C:\Users\Schatzipu\AppData\Roaming\com.kennettnet.MusicRescue4.plist
[2009.01.19 19:46:00 | 000,000,056 | -H-- | C] () -- C:\Windows\System32\ezsidmv.dat
[2009.01.06 20:41:35 | 000,184,832 | -H-- | C] () -- C:\Users\Schatzipu\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008.11.10 03:04:36 | 000,106,605 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2008.11.10 03:04:36 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2008.11.09 13:25:37 | 000,000,097 | -H-- | C] () -- C:\Users\Schatzipu\AppData\Local\fusioncache.dat
[2008.11.08 17:05:38 | 000,002,032 | -H-- | C] () -- C:\Users\Schatzipu\AppData\Local\d3d9caps.dat
[2008.08.22 11:35:07 | 000,000,000 | -H-- | C] () -- C:\Windows\VAIOUpdt.INI
[2008.08.22 11:27:12 | 000,344,064 | -H-- | C] () -- C:\Windows\System32\SSMSIppCustom.dll
[2008.08.22 10:56:35 | 000,000,209 | -H-- | C] () -- C:\Windows\ODBCINST.INI
[2008.08.11 19:55:33 | 003,107,788 | -H-- | C] () -- C:\Windows\System32\atiumdva.dat
[2008.08.11 19:55:33 | 000,174,819 | -H-- | C] () -- C:\Windows\System32\atiicdxx.dat
[2008.08.11 19:55:33 | 000,159,744 | -H-- | C] () -- C:\Windows\System32\atitmmxx.dll
[2008.08.11 19:55:33 | 000,090,112 | -H-- | C] () -- C:\Windows\System32\atibrtmon.exe
[2008.08.11 19:55:33 | 000,081,920 | -H-- | C] () -- C:\Windows\System32\ATIODE.exe
[2008.08.11 19:55:33 | 000,040,960 | -H-- | C] () -- C:\Windows\System32\ATIODCLI.exe
[2008.08.11 10:29:29 | 000,000,012 | ---- | C] () -- C:\Windows\bthservsdp.dat
[2008.08.11 10:10:07 | 000,000,000 | -H-- | C] () -- C:\Windows\ativpsrm.bin
[2008.01.21 08:15:58 | 005,945,910 | -H-- | C] () -- C:\Windows\System32\perfh007.dat
[2008.01.21 08:15:58 | 001,878,310 | -H-- | C] () -- C:\Windows\System32\perfc007.dat
[2008.01.21 08:15:58 | 000,290,748 | -H-- | C] () -- C:\Windows\System32\perfi007.dat
[2008.01.21 08:15:58 | 000,036,916 | -H-- | C] () -- C:\Windows\System32\perfd007.dat
[2007.09.12 00:57:44 | 003,596,288 | -H-- | C] () -- C:\Windows\System32\qt-dx331.dll
[2007.04.16 02:24:16 | 000,023,752 | -H-- | C] () -- C:\Windows\System32\providers.bin
[2007.03.12 21:31:28 | 001,732,608 | -H-- | C] () -- C:\Windows\System32\BCGPStyle2007Luna.dll
[2006.11.02 13:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006.11.02 13:47:37 | 002,266,048 | -H-- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006.11.02 13:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006.11.02 11:33:01 | 002,270,652 | -H-- | C] () -- C:\Windows\System32\perfh009.dat
[2006.11.02 11:33:01 | 001,697,126 | -H-- | C] () -- C:\Windows\System32\perfc009.dat
[2006.11.02 11:33:01 | 000,287,440 | -H-- | C] () -- C:\Windows\System32\perfi009.dat
[2006.11.02 11:33:01 | 000,030,674 | -H-- | C] () -- C:\Windows\System32\perfd009.dat
[2006.11.02 11:23:21 | 000,215,943 | -H-- | C] () -- C:\Windows\System32\dssec.dat
[2006.11.02 09:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006.11.02 09:19:00 | 000,000,741 | -H-- | C] () -- C:\Windows\System32\NOISE.DAT
[2006.11.02 08:40:29 | 000,013,750 | -H-- | C] () -- C:\Windows\System32\pacerprf.ini
[2006.11.02 08:25:31 | 000,673,088 | -H-- | C] () -- C:\Windows\System32\mlang.dat
[2001.11.14 12:56:00 | 001,802,240 | -H-- | C] () -- C:\Windows\System32\lcppn21.dll
 
========== LOP Check ==========
 
[2011.09.29 23:40:09 | 000,000,000 | -H-D | M] -- C:\Users\Schatzipu\AppData\Roaming\Blackberry Desktop
[2010.12.09 11:23:08 | 000,000,000 | -H-D | M] -- C:\Users\Schatzipu\AppData\Roaming\de.myphotobook.creator.001F9DF2D0BAABEB11F42CCEE43224607B61109C.1
[2011.11.22 20:55:30 | 000,000,000 | -H-D | M] -- C:\Users\Schatzipu\AppData\Roaming\elsterformular
[2010.07.08 04:13:09 | 000,000,000 | -H-D | M] -- C:\Users\Schatzipu\AppData\Roaming\FreeVideoConverter
[2011.03.27 20:30:54 | 000,000,000 | -H-D | M] -- C:\Users\Schatzipu\AppData\Roaming\GetRightToGo
[2010.12.16 11:16:00 | 000,000,000 | -H-D | M] -- C:\Users\Schatzipu\AppData\Roaming\Imaxel
[2008.11.08 17:12:41 | 000,000,000 | -H-D | M] -- C:\Users\Schatzipu\AppData\Roaming\InterVideo
[2011.03.27 20:53:41 | 000,000,000 | -H-D | M] -- C:\Users\Schatzipu\AppData\Roaming\Kalenderchen
[2009.12.26 12:41:44 | 000,000,000 | -H-D | M] -- C:\Users\Schatzipu\AppData\Roaming\PRMT
[2009.12.26 12:19:05 | 000,000,000 | -H-D | M] -- C:\Users\Schatzipu\AppData\Roaming\PROject MT
[2011.09.29 13:53:28 | 000,000,000 | -H-D | M] -- C:\Users\Schatzipu\AppData\Roaming\Research In Motion
[2008.11.09 13:22:46 | 000,000,000 | -H-D | M] -- C:\Users\Schatzipu\AppData\Roaming\T-Online
[2012.01.05 23:26:43 | 000,032,564 | -H-- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 64 bytes -> C:\Users\Schatzipu\Desktop\P1040036.MOV:TOC.WMV

< End of report >
--- --- ---



HTML-Code:
defogger_disable by jpshortstuff (23.02.10.1)
Log created at 02:10 on 06/01/2012 (Schatzipu)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-
HTML-Code:
GMER Logfile:
[CODE]GMER 1.0.15.15641 - hxxp://www.gmer.net
Rootkit scan 2012-01-06 01:53:50
Windows 6.0.6001 Service Pack 1
Running: x1qc2ymg.exe; Driver: C:\Users\SCHATZ~1\AppData\Local\Temp\fwliruoc.sys


---- Registry - GMER 1.0.15 ----

Reg  HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\001e3dea7631                                       
Reg  HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\00214f49d362                                       
Reg  HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\00214f510f55                                       
Reg  HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\001e3dea7631 (not active ControlSet)                   
Reg  HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\00214f49d362 (not active ControlSet)                   
Reg  HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\00214f510f55 (not active ControlSet)                   

---- Files - GMER 1.0.15 ----

File  C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS09058.log                                              131072 bytes
File  C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS09059.log                                              131072 bytes
File  C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS0905A.log                                              131072 bytes
File  C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS0905B.log                                              131072 bytes
File  C:\Users\Schatzipu\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TF3UUWX6\fastbutton[2].htm  4809 bytes

---- EOF - GMER 1.0.15 ----
[/CODE]
--- --- ---

OTL Logfile:
Code:
OTL Extras logfile created on: 06.01.2012 00:26:42 - Run 1
OTL by OldTimer - Version 3.2.31.0    Folder = C:\Users\Schatzipu\Desktop
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19019)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,97 Gb Total Physical Memory | 1,35 Gb Available Physical Memory | 45,47% Memory free
6,13 Gb Paging File | 4,41 Gb Available in Paging File | 71,92% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 286,87 Gb Total Space | 117,78 Gb Free Space | 41,06% Space Free | Partition Type: NTFS
Unable to calculate disk information.
 
Computer Name: SCHATZIPU-PC | User Name: Schatzipu | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = ChromeHTML] -- Reg Error: Key error. File not found
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = htmlfile] -- Reg Error: Key error. File not found
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
http [open] -- "C:\Program Files\Google\Chrome\Application\chrome.exe" -- "%1"
https [open] -- "C:\Program Files\Google\Chrome\Application\chrome.exe" -- "%1"
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Fotoschau] -- "C:\Users\Schatzipu\Desktop\Thomas\Pixum\Pixum Fotobuch\Fotoschau.exe" -d "%1" ()
Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~2\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Directory [Pixum Fotobuch] -- "C:\Users\Schatzipu\Desktop\Thomas\Pixum\Pixum Fotobuch\Pixum Fotobuch.exe" "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0196D669-EAF3-41B0-8CB4-A8D1C8C2D2D1}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{042A3FEC-304D-49D9-B4D4-EE7DC1F7E2DD}" = lport=7777 | protocol=17 | dir=in | app=c:\windows\ehome\ehshell.exe |
"{08D543BC-0B71-45B5-8D4E-FA43DE6F04CA}" = lport=53 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{094B01A3-9244-4E99-AB52-0BF12266E3A3}" = lport=5353 | protocol=6 | dir=in | name=adobe csi cs4 |
"{0F7587BF-1DDF-405C-9539-D38EDCE3480F}" = lport=49181 | protocol=6 | dir=in | name=akamai netsession interface |
"{16036E4B-2CFF-432B-868B-D15A8E0A9184}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{1E545F73-0FB3-4621-B656-1AA48D0B3621}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{27750769-645F-4805-883D-5FCB172406FF}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{2D9E63EA-23C9-47C2-A5C3-656DFDD47EC6}" = lport=67 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{2DCB790A-9420-4529-9939-18B74FAAF637}" = rport=138 | protocol=17 | dir=out | app=system |
"{379ADF44-DD9E-4563-9172-28A99BAD0E1F}" = rport=445 | protocol=6 | dir=out | app=system |
"{38E7C5FD-C0C8-4B81-9898-055C76522733}" = lport=554 | protocol=6 | dir=in | app=c:\windows\ehome\ehshell.exe |
"{3B403F01-9522-47FF-9E3B-E1E0DE28536C}" = lport=445 | protocol=6 | dir=in | app=system |
"{41A01E0D-33F3-4103-9D69-C3C286B66474}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{41C06081-18D8-42F2-8D0E-88617FBE135D}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=c:\windows\system32\svchost.exe |
"{48682383-9735-4EB6-A99F-719AD55ED2D5}" = lport=4482 | protocol=17 | dir=in | name=blackberry desktop software wireless music sync discovery |
"{5DBA1C4F-159C-4A86-8F59-B7E4B74839C6}" = lport=138 | protocol=17 | dir=in | app=system |
"{5FC501E9-6EF7-4D12-8BAB-1DA7DE738381}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=c:\windows\system32\svchost.exe |
"{6369ADA7-880D-4D63-9F04-92B19065E6A2}" = lport=2869 | protocol=6 | dir=in | app=system |
"{64D8CC80-B496-4CBE-A586-739B6AFBC20C}" = lport=139 | protocol=6 | dir=in | app=system |
"{664CE76F-7755-4B6E-9BFB-7900A4BCE9C5}" = lport=5000 | protocol=17 | dir=in | name=akamai netsession interface |
"{766C18C2-9621-491B-B3CA-5CF4BE901221}" = lport=2869 | protocol=6 | dir=in | app=system |
"{83853758-9C85-495B-BF35-E2B81432674C}" = lport=3390 | protocol=6 | dir=in | app=system |
"{94EF2A1A-7B7E-4D2F-8E0B-94A8C00B2DFD}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=c:\windows\system32\svchost.exe |
"{A11B8FD2-F07A-4D94-ADE1-3ADE23BB24A8}" = lport=4481 | protocol=17 | dir=in | name=blackberry desktop software wireless music sync discovery |
"{A1A96D3B-E8EB-4833-AEA5-7A338F149913}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=c:\windows\system32\svchost.exe |
"{A1C24E0C-2B9D-44B6-A2CE-85822A2BDCC0}" = lport=68 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{AFA14113-686D-4FEC-8B08-8A3213F0B5B8}" = rport=10244 | protocol=6 | dir=out | app=system |
"{B4FF8BB2-C722-4406-A1ED-C3FA93C2FFD2}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{BAB41D5A-62AD-4DB2-91AA-90A89989CA30}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=c:\windows\system32\svchost.exe |
"{BAC4F2A0-5266-43CE-9B95-FEB00609BBDA}" = lport=137 | protocol=17 | dir=in | app=system |
"{C5EA3763-B557-4035-8E47-E23E03A057DD}" = lport=4482 | protocol=6 | dir=in | name=blackberry desktop software wireless music sync data transfer |
"{CA945BB4-B6C3-4B5D-8E31-A048D8BF3AEC}" = rport=139 | protocol=6 | dir=out | app=system |
"{CAE6B8AF-B799-49DB-B661-E13B5AC6A341}" = lport=10244 | protocol=6 | dir=in | app=system |
"{D8CD5712-3C35-4893-82E1-DD29F29B7DF5}" = lport=4481 | protocol=6 | dir=in | name=blackberry desktop software wireless music sync data transfer |
"{DA9A997C-514F-4CF0-A822-6B20596A2B9A}" = lport=547 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{E0B8A5FA-0774-462F-8984-B84AF120A701}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=c:\windows\system32\svchost.exe |
"{E54B90EF-112F-42B7-8E1B-0680E2F974A9}" = rport=137 | protocol=17 | dir=out | app=system |
"{E79733F0-B5F5-47E3-9E74-3A5B4E874FCE}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{E7CAD1C4-42AD-402B-9E06-EC8DD346D369}" = rport=2869 | protocol=6 | dir=out | app=system |
"{E9B94414-C511-4A24-A855-E24C3F56F8D7}" = lport=10243 | protocol=6 | dir=in | app=system |
"{ECBB7A47-1490-47D0-9016-FCCCB0762DCF}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=c:\windows\system32\svchost.exe |
"{F10335C4-B83C-4A96-8266-06B751142531}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=c:\windows\system32\svchost.exe |
"{F6A49A64-9878-4D8B-B530-4CF546FB7B36}" = rport=10243 | protocol=6 | dir=out | app=system |
"{F8A48E73-5287-4225-9ADE-5085E320CAAF}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0350BB2F-4058-4217-910C-46EEB88F3585}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{04616471-827E-4606-A7A5-4F585C8C2BEF}" = protocol=6 | dir=in | app=c:\program files\google\google talk\googletalk.exe |
"{049BCCAB-E8EF-4147-ACE6-F5C8CB486CB6}" = protocol=17 | dir=out | app=c:\program files\windows media player\wmplayer.exe |
"{06946765-7B55-40E1-8256-D42A4902FDB6}" = protocol=17 | dir=in | app=c:\users\schatzipu\appdata\local\akamai\netsession_win.exe |
"{107A98C6-8710-4018-8B3A-24C662DA0260}" = dir=out | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{14D5F335-E653-47B7-87BE-37093169CEC2}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{1A378D10-EDB9-4B09-95AF-5AA80CC7EA45}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{1AAE3AA4-7993-4422-B776-947FA1BD3378}" = dir=in | app=c:\program files\itunes\itunes.exe |
"{2CFA175E-B64D-41F6-ACA2-C5BC974A44BC}" = dir=in | app=c:\program files\common files\apple\apple application support\webkit2webprocess.exe |
"{4D6D2C6E-EAC1-42DC-A691-D064EB590877}" = protocol=6 | dir=in | app=c:\users\schatzipu\appdata\local\akamai\netsession_win.exe |
"{53191010-B8F2-4946-9DD7-FAD2464B62FB}" = protocol=17 | dir=in | app=c:\program files\google\google talk\googletalk.exe |
"{53900FB6-6D31-4622-B358-DFD48E077D60}" = protocol=6 | dir=out | app=system |
"{5500B751-3090-4AA9-BAF0-0C2B2A3B9179}" = protocol=6 | dir=in | app=c:\program files\windows media player\wmpnetwk.exe |
"{65DB8B04-FBB4-4FB1-BEEF-A33CF89093F4}" = protocol=17 | dir=in | app=c:\program files\windows media player\wmpnetwk.exe |
"{6C72EFE8-1AE5-4D13-8F5A-07BA0A542F60}" = protocol=6 | dir=out | svc=upnphost | app=c:\windows\system32\svchost.exe |
"{7528C45C-03F1-435E-AC95-ECCD6EB65E5A}" = protocol=17 | dir=in | app=c:\program files\research in motion\blackberry desktop\rim.desktop.exe |
"{872D59D4-9A81-42B5-9C78-49899D1C9932}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{8BEF2413-FBAE-4B0D-9ABF-60E015A71875}" = protocol=6 | dir=out | svc=mcx2svc | app=c:\windows\system32\svchost.exe |
"{913A7280-E14F-4898-A127-BE334F8F8EC9}" = protocol=58 | dir=in | name=@hnetcfg.dll,-148 |
"{9A5020D4-2DB3-4883-ADDC-713B5F0CEAB1}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{9F5A6E4C-06E6-4FE3-8846-8FF4ABB1BA1F}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{A46C2186-8C75-468F-82F8-B2A6783E3F68}" = protocol=6 | dir=in | app=c:\program files\common files\adobe\cs4servicemanager\cs4servicemanager.exe |
"{A6012719-5A3C-4511-95F5-0574D7CBD25F}" = protocol=17 | dir=out | app=c:\program files\windows media player\wmpnetwk.exe |
"{A6D8C879-0BB1-4B19-B0A6-3B47B17F5134}" = protocol=6 | dir=in | app=c:\program files\research in motion\blackberry desktop\rim.desktop.exe |
"{A992E8D7-8F81-4768-B414-AD106049DE4A}" = protocol=17 | dir=in | app=c:\program files\windows media player\wmplayer.exe |
"{AA84E1B4-CB15-4D5D-96FE-CDED9C6C6556}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{AE6A6B6D-7D0A-494B-B64F-73B6C048EC04}" = protocol=6 | dir=out | app=c:\program files\windows media player\wmplayer.exe |
"{B32D175E-53EC-4205-ADFA-5FB71286C46B}" = protocol=6 | dir=out | app=c:\windows\ehome\mcx2prov.exe |
"{C414FB55-1E1F-4535-8172-675B8AB7B9FF}" = protocol=17 | dir=out | app=c:\windows\ehome\ehshell.exe |
"{C4719A84-E663-4731-B812-A724D9889947}" = protocol=17 | dir=in | app=c:\program files\windows media player\wmplayer.exe |
"{C87FC0F5-D788-4BF6-862D-51CF8789035E}" = protocol=6 | dir=out | app=c:\program files\windows media player\wmplayer.exe |
"{CB820319-A79B-4F77-803B-59656CD25D09}" = protocol=17 | dir=in | app=c:\program files\common files\adobe\cs4servicemanager\cs4servicemanager.exe |
"{E1E6F2F8-07DF-492E-AFBE-26D6B35C8DCC}" = protocol=6 | dir=out | app=c:\program files\windows media player\wmpnetwk.exe |
"{E406003A-BE14-4783-A14E-34F0459FFAFB}" = protocol=6 | dir=out | app=c:\windows\ehome\ehshell.exe |
"{EFF3FDE2-F0A0-4574-B6D2-FBCC2A6ABA97}" = protocol=17 | dir=out | app=c:\program files\windows media player\wmplayer.exe |
"{F426BB59-C72F-476A-950A-7A12859CB116}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{F7324605-7FE4-4B0C-BE21-9321AA6EACAB}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"TCP Query User{41635211-99C9-474E-BF5F-DED3C0C39B6D}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"TCP Query User{6DAA5C48-AA65-4165-9FB2-104847F7C840}C:\program files\google\google earth\plugin\geplugin.exe" = protocol=6 | dir=in | app=c:\program files\google\google earth\plugin\geplugin.exe |
"TCP Query User{905D2DC1-98CA-4B67-96E6-EEC8D0BA8DB9}C:\program files\google\google earth\client\googleearth.exe" = protocol=6 | dir=in | app=c:\program files\google\google earth\client\googleearth.exe |
"UDP Query User{D255CB67-F941-4435-A7FB-50C20B88710C}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"UDP Query User{EBF708C3-E9FD-4954-917C-9EFA037FBEE9}C:\program files\google\google earth\plugin\geplugin.exe" = protocol=17 | dir=in | app=c:\program files\google\google earth\plugin\geplugin.exe |
"UDP Query User{ED98417B-9684-419B-815C-326091D143EB}C:\program files\google\google earth\client\googleearth.exe" = protocol=17 | dir=in | app=c:\program files\google\google earth\client\googleearth.exe |
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{018F8F57-B46B-B9B9-C452-DE8F5618434F}" = Catalyst Control Center Graphics Full Existing
"{01FDC9FC-4D4F-4DB0-ACD1-D3E8E1D52902}" = Sony Video Shared Library
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{05308C4E-7285-4066-BAE3-6B50DA6ED755}" = Adobe Update Manager CS4
"{054EFA56-2AC1-48F4-A883-0AB89874B972}" = Adobe Extension Manager CS4
"{07C93E59-2DE3-1565-28A9-8C848B26D0F5}" = CCC Help German
"{08E81ABD-79F7-49C2-881F-FD6CB0975693}" = Roxio Central Data
"{098727E1-775A-4450-B573-3F441F1CA243}" = kuler
"{098A2A49-7CF3-4F08-A38D-FB879117152A}" = Adobe Color NA Extra Settings CS4
"{0A6F9244-8C79-1296-3A43-097F67EB666A}" = Catalyst Control Center Localization Dutch
"{0D6013AB-A0C7-41DC-973C-E93129C9A29F}" = Adobe Color JA Extra Settings CS4
"{0DC0E85F-36E4-463B-B3EA-4CD8ED2222A1}" = Adobe Color EU Recommended Settings CS4
"{0F723FC1-7606-4867-866C-CE80AD292DAF}" = Adobe CSI CS4
"{11464943-4682-4F6B-A96D-D4E8C26DD111}_is1" = Kalenderchen 5
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP550_series" = Canon MP550 series MP Drivers
"{1316AEF2-E086-46C7-B1FB-8C9A39A2ABF9}" = VAIO Media plus
"{14291118-0C19-45EA-A4FA-5C1C0F5FDE09}" = Primo
"{15D5C238-4C2E-4AEA-A66D-D6989A4C586B}" = VAIO Launcher
"{1618734A-3957-4ADD-8199-F973763109A8}" = Adobe Anchor Service CS4
"{16E6D2C1-7C90-4309-8EC4-D2212690AAA4}" = AdobeColorCommonSetRGB
"{1790FDA2-938F-C886-8988-1ECB74E45517}" = Catalyst Control Center Localization Norwegian
"{1A655D51-1423-48A3-B748-8F5A0BE294C8}" = Microsoft Visual J# .NET Redistributable Package 1.1
"{1C815731-19F3-0770-8776-D78D6BEBC291}" = Catalyst Control Center Localization Hungarian
"{1EC06E70-BE43-DAAA-A217-E5C98869B1F8}" = Catalyst Control Center Localization Greek
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F54DAFA-9261-4A62-B59D-6C9F26B48FE4}" = Roxio Central Tools
"{2018C019-30D9-4240-8C01-0865C10DCF5A}" = Unterstützung für VAIO-Präsentation
"{20471B27-D702-4FE8-8DEC-0702CC8C0A85}" = WinDVD BD for VAIO
"{23825B69-36DF-4DAD-9CFD-118D11D80F16}" = VAIO Content Folder Setting
"{25BA8D5A-228A-7192-6FA1-890D9F1C679F}" = CCC Help Korean
"{26921B2E-3E62-47F9-A514-1FC4A83BD738}" = Intel(R) PROSet/Wireless WiFi-Software
"{26A24AE4-039D-4CA4-87B4-2F83216024FF}" = Java(TM) 6 Update 24
"{295C31E5-3F91-498E-9623-DA24D2FA2B6A}" = T-Online WLAN-Access Finder
"{2EA870FA-585F-4187-903D-CB9FFD21E2E0}" = DHTML Editing Component
"{326DC400-1FC4-4D7D-946D-06D1EAB93200}" = VAIO Guide
"{3364BD16-5A28-4862-86A1-A8FF5FD23919}" = Music Rescue
"{343666E2-A059-48AC-AD67-230BF74E2DB2}" = Apple Application Support
"{35D94F92-1D3A-43C5-8605-EA268B1A7BD9}" = PDF Settings CS4
"{363611D9-1106-41F2-B74E-BD8481C41219}" = Click to Disc
"{388E4B09-3E71-4649-8921-F44A3A2954A7}" = Microsoft Visual Studio 2005 Tools for Office Runtime
"{39D0E034-1042-4905-BECB-5502909FCB7C}" = Microsoft Works
"{3A4E8896-C2E7-4084-A4A4-B8FD1894E739}" = Adobe XMP Panels CS4
"{3B311FB9-5B6A-328C-D7AE-2445D639D886}" = CCC Help Norwegian
"{3B659FAD-E772-44A3-B7E7-560FF084669F}" = VAIO Smart Network
"{3D333C7C-102B-F474-9524-72AAA3F292B8}" = Catalyst Control Center Localization Danish
"{3DA8DF9A-044E-46C4-8531-DEDBB0EE37FF}" = Adobe WinSoft Linguistics Plugin
"{3E2C691B-B7E6-4053-B5C3-94B8BC407E7A}" = Adobe Premiere Elements 4.0
"{3EE33958-7381-4E7B-A4F3-6E43098E9E9C}" = Browser Address Error Redirector
"{441C8911-CEC0-19E6-6CAC-694553E06A28}" = myphotobook.de
"{4529BC6B-16AE-6829-4946-36C33DBF8DD1}" = Catalyst Control Center Localization French
"{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis
"{46C045BF-2B3F-4BC4-8E4C-00E0CF8BD9DB}" = Adobe AIR
"{46D7A7FB-305B-F77D-60F8-8FAE1C432374}" = Catalyst Control Center InstallProxy
"{4943EFF5-229F-435D-BEA9-BE3CAEA783A7}" = Adobe Service Manager Extension
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4DCEA9C1-4D6E-41BF-A854-28CFA8B56DBF}" = Click to Disc Editor
"{4EA55D20-27FB-45D7-8726-147E8A5F6C62}" = VAIO MusicBox
"{527EB2A4-BF51-B1B6-3F09-2032A861548E}" = Catalyst Control Center Graphics Light
"{537BF16E-7412-448C-95D8-846E85A1D817}" = Roxio Easy Media Creator 10 LJ
"{55C0F7C1-8B6D-CBBD-2B88-EE7261A87254}" = CCC Help Greek
"{573F1931-08F7-9222-704E-841C391794C5}" = ATI Catalyst Install Manager
"{57B955CE-B5D3-495D-AF1B-FAEE0540BFEF}" = VAIO Data Restore Tool
"{596BED91-A1D8-4DF1-8CD1-1C777F7588AC}" = VAIO DVD Menu Data Basic
"{5A3C1721-F8ED-11E0-8AFB-B8AC6F97B88E}" = Google Earth
"{5C5EE8F2-0B38-4C13-AE4E-A87A237FE718}" =
"{5C82DAE5-6EB0-4374-9254-BE3319BA4E82}" = Skype™ 3.6
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{5F5867F0-2D23-4338-A206-01A76C823924}" = VAIO Energie Verwaltung
"{629FD96D-5877-0832-2D31-0EFE781F870D}" = CCC Help Portuguese
"{6332AFF1-9D9A-429C-AA03-F82749FA4F49}" = SonicStage Mastering Studio
"{652C5DED-9B9F-93D0-5E94-931B8C38EF0E}" = Catalyst Control Center Localization Thai
"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
"{68243FF8-83CA-466B-B2B8-9F99DA5479C4}" = AdobeColorCommonSetCMYK
"{68A69CFF-130D-4CDE-AB0E-7374ECB144C8}" = Click to Disc
"{6A54CB6A-59D1-6A3A-08F3-E34ECF8905A9}" = Catalyst Control Center Graphics Previews Vista
"{6AA6EEA5-BF09-932B-AC25-0E9CCA4B709A}" = CCC Help Danish
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{6B1F20F2-6321-4669-A58C-33DF8E7517FF}" = VAIO Entertainment Platform
"{6C4EF0CA-A9DD-96CF-B722-CCDEB589DD26}" = Catalyst Control Center Localization Chinese Traditional
"{6C50525A-2D77-4C22-B058-9AA2F27ACFF2}" = VAIO Content Metadata Intelligent Analyzing Manager
"{6FA8BA2C-052B-4072-B8E2-2302C268BE9E}" = VAIO Movie Story Template Data
"{711D43D7-24FE-A2B7-CC52-A48BCAAF3926}" = Catalyst Control Center Graphics Previews Common
"{72042FA6-5609-489F-A8EA-3C2DD650F667}" = VAIO Control Center
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{73496381-83C9-7BE6-6EB6-4CF97C00E5FD}" = CCC Help Polish
"{73A4F29F-31AC-4EBD-AA1B-0CC5F18C8F83}" = Roxio Central Audio
"{75157F34-02C6-4831-BD66-3BC49E7A8394}" = BlackBerry Desktop Software 6.1
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour
"{79BBD55C-9FF6-D496-8AE6-E2EC2829F974}" = Catalyst Control Center Localization Czech
"{7CC28423-465C-F4B9-9379-343DF715BE62}" = CCC Help Swedish
"{7E823DA5-43A2-46E8-A75E-5A2A0FDE81A1}" = VAIO Content Metadata Manager Setting
"{80828DF5-270E-F8E6-6274-55ACA4C7E229}" = Catalyst Control Center Localization Japanese
"{8153ED9A-C94A-426E-9880-5E6775C08B62}" = Apple Mobile Device Support
"{820D3F45-F6EE-4AAF-81EF-CE21FF21D230}" = Adobe Type Support CS4
"{83877DB1-8B77-45BC-AB43-2BAC22E093E0}" = Adobe Bridge CS4
"{83CDA18E-0BF3-4ACA-872C-B4CDABF2360E}" = VAIO Update 4
"{84037798-D63A-F5CA-9FB2-829B362BF712}" = CCC Help Finnish
"{842B4B72-9E8F-4962-B3C1-1C422A5C4434}" = Suite Shared Configuration CS4
"{8470A1D9-536E-C7C1-AE2D-24B739B1665A}" = Catalyst Control Center Localization Russian
"{87532CAB-7932-4F84-8937-823337622807}" = Adobe Illustrator CS4
"{882683C6-8B60-5CBC-38A8-55ED185FD975}" = CCC Help Turkish
"{8843C5E1-51E5-DFA6-1AD8-757C8DCA7E37}" = CCC Help Russian
"{88C596E4-6882-8E76-EBEF-AB739F5A3B69}" = Catalyst Control Center Localization Italian
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8BD60AEF-3F9D-47AE-B80A-FB7FFCE335A0}" = VAIO Movie Story
"{8C467DE1-6E04-0888-B281-172909C96F37}" = Skins
"{8C7FB08D-7A84-22E0-F553-F6B827023E17}" = CCC Help Chinese Traditional
"{8CE08C3C-8FF4-45D9-925E-4F3CE2D7FA7D}" = Adobe Setup
"{8EDBA74D-0686-4C99-BFDD-F894678E5102}" = Adobe Common File Installer
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_HOMESTUDENTR_{A0516415-ED61-419A-981D-93596DA74165}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_HOMESTUDENTR_{322296D4-1EAE-4030-9FBC-D2787EB25FA2}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_HOMESTUDENTR_{26454C26-D259-4543-AA60-3189E09C5F76}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_HOMESTUDENTR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{931AB7EA-3656-4BB7-864D-022B09E3DD67}" = Adobe Linguistics CS4
"{93F32124-BB54-C599-CF55-E1E57565BCE3}" = CCC Help Czech
"{94D398EB-D2FD-4FD1-B8C4-592635E8A191}" = Adobe CMaps CS4
"{95120000-00AF-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (German)
"{96C951BB-47C8-8497-78F0-7D8D328B58E3}" = Catalyst Control Center Localization Portuguese
"{96D0B6C6-5A72-4B47-8583-A87E55F5FE81}" =
"{98FC7A64-774B-49B5-B046-4B4EBC053FA9}" = VAIO MusicBox Sample Music
"{9973498D-EA29-4A68-BE0B-C88D6E03E928}" = ArcSoft WebCam Companion 2
"{99D8CD4E-A5D2-A9DF-A152-B28EB5A71F85}" = Catalyst Control Center Localization German
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9C1C8A04-F8CA-4472-A92D-4288CE32DE86}" = SonicStage Mastering Studio Plugins
"{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = Alps Pointing-device for VAIO
"{A1D67F99-1968-488E-AF8E-DC9315C3E3D0}" = Pop Art Studio 4.0
"{A340C2DC-A941-445D-9E14-03B1F6798127}" = @promt Professional 8.5 EGGE Trial
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{A552C4EA-D41E-4C61-A0FB-C0E05440F7D7}" = VAIO Entertainment Platform
"{A63E7492-A0BC-4BB9-89A7-352965222380}" = VAIO Original Function Setting
"{A7DA438C-2E43-4C20-BFDA-C1F4A6208558}" = Setting Utility Series
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AA75988E-9EC1-EECE-CE00-D5D935974528}" = CCC Help Dutch
"{AC76BA86-1033-F400-BA7E-000000000003}" = Adobe Acrobat  8 Standard - English, Français, Deutsch
"{ACB5FD4A-6C58-972C-180C-9677C037E71D}" = Catalyst Control Center Localization Chinese Standard
"{ADBDB038-FF77-C672-04A1-7A0E67E8C73C}" = Catalyst Control Center Core Implementation
"{ADECE95F-585D-8B33-BF50-53C2BDA1E241}" = Catalyst Control Center Localization Korean
"{AE0FBCB5-3193-4583-C6CB-AA96F307EA70}" = ccc-utility
"{AFF10119-F154-4888-77F3-B149DE987976}" = Catalyst Control Center Localization Polish
"{B1275E23-717A-4D52-997A-1AD1E24BC7F3}" = T-Online 6.0
"{B25563A0-41F4-4A81-A6C1-6DBC0911B1F3}" = VAIO Movie Story
"{B29AD377-CC12-490A-A480-1452337C618D}" = Connect
"{B513C7B0-024A-498F-B0F5-00C67E2440A9}" = VAIO Content Metadata Intelligent Analyzing Manager
"{B6A26DE5-F2B5-4D58-9570-4FC760E00FCD}" = Roxio Central Copy
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{B7C03E84-AF46-42F4-809D-D4127D9086D0}" = VAIO Edit Components 6.4
"{B7DBF6E8-0D17-4BE4-853B-ACD6EFBD4A1F}" = iTunes
"{BACD22AE-5B6B-4F23-B506-3FCFF13AC137}" = VAIO Media plus
"{BB4E33EC-8181-4685-96F7-8554293DEC6A}" = Adobe Output Module
"{C1083DBC-C541-4E8C-91EA-D92397AB9A2C}" = OpenMG Secure Module 5.1.00
"{C52E3EC1-048C-45E1-8D53-10B0C6509683}" = Adobe Default Language CS4
"{C7477742-DDB4-43E5-AC8D-0259E1E661B1}" = VAIO Event Service
"{C767EE67-9AA4-1CBF-8FD4-87F52CBB041D}" = CCC Help Italian
"{C8E57F8C-64FE-28D7-0F65-7BE87AF49745}" = Catalyst Control Center Graphics Full New
"{C93F4E7C-1B31-449B-A304-EF277CF55E39}" = Catalyst Control Center - Branding
"{CAE07D54-A400-DAF9-912B-306DD941B61C}" = Catalyst Control Center Localization Finnish
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CB6CF566-E06F-2556-55EF-EE149FC6EE7F}" = CCC Help French
"{CB8A8696-93EC-414E-A752-850AB133F68A}" = VAIO Content Metadata XML Interface Library
"{CC75AB5C-2110-4A7F-AF52-708680D22FE8}" = Photoshop Camera Raw
"{CE2121C6-C94D-4A73-8EA4-6943F33EE335}" = Music Transfer
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D035FBF6-FDEF-487D-89CA-6F9DD07B783F}" = Dolby Control Center
"{D355ECA7-DBF5-F22E-4E1A-BF69CFC5CED8}" = CCC Help Japanese
"{D44DF260-2D5A-3277-97D6-C97D1A806CF5}" = CCC Help Thai
"{D5068583-D569-468B-9755-5FBF5848F46F}" = Sony Picture Utility
"{D60F97EC-EF06-4E1E-B0D1-C2CBABA62FA3}" = VAIO Wallpaper Contents
"{D7019E24-BF07-3690-18C7-3D0DE87D09AB}" = CCC Help Chinese Standard
"{D7FFE7EB-1A15-864C-B335-E768BF623B84}" = Catalyst Control Center Localization Swedish
"{DE1F799A-0A02-FF3B-8786-195E91D0DE94}" = CCC Help Spanish
"{DF7DB916-90E5-40F2-9010-B8125EB5FD6F}" = SonicStage Mastering Studio Audio Filter
"{E31010F6-DE18-0E9F-E028-FC709306C6F1}" = Catalyst Control Center Localization Turkish
"{E464702F-5433-46EC-8F65-159276C0A54F}" = WIDCOMM Bluetooth Software 6.2.0.4100
"{E5BD6683-301D-B224-FB7C-320299CD51F9}" = CCC Help Hungarian
"{E6A3770D-C87A-4505-B8C6-A4CF96AC395C}" = SonicStage Mastering Studio
"{E78BFA60-5393-4C38-82AB-E8019E464EB4}" = Microsoft .NET Framework 1.1 German Language Pack
"{E9730C7A-E5DA-8222-45FE-2D71E810BE46}" = Catalyst Control Center Localization Spanish
"{EA39F1F5-D4A1-C02A-0865-7F6A95A33A56}" = CCC Help English
"{EC37A846-53AC-4DA7-98FA-76A4E74AA900}" = Benutzerdefinierte Voreinstellungen für SonicStage Mastering Studio Audio Filter
"{ED439A64-F018-4DD4-8BA5-328D85AB09AB}" = Roxio Central Core
"{EE59BBF9-415C-45DB-8C4B-EE43CF635FEA}" = VAIO Content Metadata XML Interface Library
"{EEC010D0-1252-4E1D-BAD9-F1B8F414535C}" = PL-2303 Vista Driver Installer
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F0E64E2E-3A60-40D8-A55D-92F6831875DA}" = Adobe Search for Help
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F54AC413-D2C6-4A24-B324-370C223C6250}" = Adobe Photoshop Elements 6.0
"{F570A6CC-53ED-4AA9-8B08-551CD3E38D8B}" =
"{F85C7118-F3DC-4ED9-AB27-3E7931EA3D88}" = Adobe Premiere Elements 4.0 Templates
"{F8EF2B3F-C345-4F20-8FE4-791A20333CD5}" = Adobe ExtendScript Toolkit CS4
"{F93C84A6-0DC6-42AF-89FA-776F7C377353}" = Adobe PDF Library Files CS4
"{F958CA02-BB40-4007-894B-258729456EE4}" = QuickTime
"{FCDD51BB-CAD0-4BB1-B7DF-CE86D1032794}" = Adobe Fonts All
"{FD72E69E-CF34-4071-BFD6-FD081A365E2C}" = VAIO Content Metadata Intelligent Analyzing Manager
"{FE51662F-D8F6-43B5-99D9-D4894AF00F83}" = Roxio Easy Media Creator Home
"{FE697886-F392-4E0D-A0C0-47587BF60992}" = VAIO Content Metadata Manager Setting
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites
"Adobe Acrobat  8 Standard - English, Français, Deutsch" = Adobe Acrobat 8.1.4 Standard
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Photoshop Elements 6" = Adobe Photoshop Elements 6.0
"Adobe_2a31ae7a5c43ff52d8577782dd34e04" = Adobe Illustrator CS4
"Akamai" = Akamai NetSession Interface Service
"Alt WAV MP3 WMA OGG Converter 7.2 Shareware_is1" = Alt WAV MP3 WMA OGG Converter 7.2
"Avira AntiVir Desktop" = Avira Free Antivirus
"BFG-Big Fish Games Spiel-Suite" = Big Fish Games Spiel-Suite
"BlackBerry_Desktop" = BlackBerry Desktop Software 6.1
"CCleaner" = CCleaner
"CloneDVD2" = CloneDVD2
"CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_2BFA&SUBSYS_104D0200" = HDAUDIO SoftV92 Data Fax Modem with SmartCP
"conduitEngine" = Conduit Engine
"de.myphotobook.creator.001F9DF2D0BAABEB11F42CCEE43224607B61109C.1" = myphotobook.de
"DivX Setup.divx.com" = DivX-Setup
"dt icon module" =
"ElsterFormular 12.4.0.7094u" = ElsterFormular
"ESET Online Scanner" = ESET Online Scanner v3
"facemoods" = Facemoods Toolbar
"Fotobuchexpress24 - Fotobuch" = Fotobuchexpress24 - Fotobuch
"Free M4a to MP3 Converter_is1" = Free M4a to MP3 Converter 6.0
"Free Video Converter_is1" = Free Video Converter V 2.7
"Freeware.de Toolbar" = Freeware.de Toolbar
"gtfirstboot Setting Request" =
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"InstallShield_{20471B27-D702-4FE8-8DEC-0702CC8C0A85}" = WinDVD BD for VAIO
"InstallShield_{4DCEA9C1-4D6E-41BF-A854-28CFA8B56DBF}" = Click to Disc Editor
"InstallShield_{C1083DBC-C541-4E8C-91EA-D92397AB9A2C}" = OpenMG Secure Module 5.1.00
"iuVCR_is1" = iuVCR
"LHTTSGED" = L&H TTS3000 Deutsch
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"MarketingTools" = VAIO Marketing Tools
"MFU Module" =
"Microsoft .NET Framework 1.1  (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft Visual Studio 2005 Tools for Office Runtime" = Visual Studio 2005 Tools for Office Second Edition Runtime
"Mozilla Firefox (3.6.17)" = Mozilla Firefox (3.6.17)
"Picasa 3" = Picasa 3
"Pixum Fotobuch" = Pixum Fotobuch
"PremElem40" = Adobe Premiere Elements 4.0
"PremElem40Templates" = Adobe Premiere Elements 4.0 Templates
"ProInst" = Intel PROSet Wireless
"RealPlayer 6.0" = RealPlayer
"Registry Easy_is1" = Registry Easy v5.6
"Terminkalender2" = Softwarenetz Terminkalender2
"tv_enua" = Lernout & Hauspie TruVoice American English TTS Engine
"VAIO Help and Support" =
"VH Toolkit_is1" = VH Toolkit 1.0.30.0
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Akamai" = Akamai NetSession Interface
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 01.01.2012 08:38:26 | Computer Name = Schatzipu-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 7051
 
Error - 01.01.2012 08:38:26 | Computer Name = Schatzipu-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 7051
 
Error - 01.01.2012 08:38:27 | Computer Name = Schatzipu-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
 
Error - 01.01.2012 08:38:27 | Computer Name = Schatzipu-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 8517
 
Error - 01.01.2012 08:38:27 | Computer Name = Schatzipu-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 8517
 
Error - 02.01.2012 02:39:44 | Computer Name = Schatzipu-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
 
Error - 02.01.2012 02:39:44 | Computer Name = Schatzipu-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 1279
 
Error - 02.01.2012 02:39:44 | Computer Name = Schatzipu-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 1279
 
Error - 02.01.2012 02:39:45 | Computer Name = Schatzipu-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
 
Error - 02.01.2012 02:39:45 | Computer Name = Schatzipu-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 2433
 
[ Media Center Events ]
Error - 07.12.2009 11:11:34 | Computer Name = Schatzipu-PC | Source = Media Center Guide | ID = 0
Description = Ereignisinformationen: ERROR: SqmApiWrapper.TimerRecord failed; Win32
 GetLastError returned 10000105  Prozess: DefaultDomain Objektname: Media Center Guide

 
[ OSession Events ]
Error - 04.04.2010 04:09:56 | Computer Name = Schatzipu-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 263735
 seconds with 30660 seconds of active time.  This session ended with a crash.
 
Error - 28.03.2011 19:48:55 | Computer Name = Schatzipu-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.4518.1014, Microsoft Office Version: 12.0.6425.1000. This session lasted 45
 seconds with 0 seconds of active time.  This session ended with a crash.
 
Error - 18.07.2011 05:04:09 | Computer Name = Schatzipu-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.6425.1000, Microsoft Office Version: 12.0.6425.1000. This session lasted 55463
 seconds with 60 seconds of active time.  This session ended with a crash.
 
[ System Events ]
Error - 26.02.2011 13:23:32 | Computer Name = Schatzipu-PC | Source = ipnathlp | ID = 34001
Description = ICS_IPV6 konnte den IPv6-Stapel nicht konfigurieren.
 
Error - 26.02.2011 13:33:32 | Computer Name = Schatzipu-PC | Source = ipnathlp | ID = 34001
Description = ICS_IPV6 konnte den IPv6-Stapel nicht konfigurieren.
 
Error - 26.02.2011 13:37:46 | Computer Name = Schatzipu-PC | Source = ipnathlp | ID = 34001
Description = ICS_IPV6 konnte den IPv6-Stapel nicht konfigurieren.
 
Error - 26.02.2011 13:42:00 | Computer Name = Schatzipu-PC | Source = ipnathlp | ID = 34001
Description = ICS_IPV6 konnte den IPv6-Stapel nicht konfigurieren.
 
Error - 26.02.2011 13:55:10 | Computer Name = Schatzipu-PC | Source = ipnathlp | ID = 34001
Description = ICS_IPV6 konnte den IPv6-Stapel nicht konfigurieren.
 
Error - 26.02.2011 14:17:17 | Computer Name = Schatzipu-PC | Source = ipnathlp | ID = 34001
Description = ICS_IPV6 konnte den IPv6-Stapel nicht konfigurieren.
 
Error - 26.02.2011 14:24:24 | Computer Name = Schatzipu-PC | Source = ipnathlp | ID = 34001
Description = ICS_IPV6 konnte den IPv6-Stapel nicht konfigurieren.
 
Error - 26.02.2011 14:34:36 | Computer Name = Schatzipu-PC | Source = ipnathlp | ID = 34001
Description = ICS_IPV6 konnte den IPv6-Stapel nicht konfigurieren.
 
Error - 26.02.2011 14:34:36 | Computer Name = Schatzipu-PC | Source = ipnathlp | ID = 34001
Description = ICS_IPV6 konnte den IPv6-Stapel nicht konfigurieren.
 
Error - 27.02.2011 07:02:01 | Computer Name = Schatzipu-PC | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am 26.02.2011 um 20:34:48 unerwartet heruntergefahren.
 
 
< End of report >
--- --- ---



[/HTML]

cosinus 06.01.2012 23:50
Bitte nun routinemäßig einen Vollscan mit malwarebytes machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss! Außerdem müssen alle Funde entfernt werden.

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!



ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset





Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:
hier steht das Log

Olivia81 07.01.2012 21:57
hallo Arne,
vielen Dank für deine Hilfe.

Code:
Malwarebytes Anti-Malware 1.60.0.1800
www.malwarebytes.org

Datenbank Version: v2012.01.06.03

Windows Vista Service Pack 1 x86 NTFS
Internet Explorer 8.0.6001.19019
Schatzipu :: SCHATZIPU-PC [Administrator]

06.01.2012 19:07:30
mbam-log-2012-01-07 (08-47-21).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 438920
Laufzeit: 8 Stunde(n), 36 Minute(n), 21 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 1
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced|Start_ShowSearch (PUM.Hijack.StartMenu) -> Bösartig: (0) Gut: (1) -> Keine Aktion durchgeführt.

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 4
C:\Users\Schatzipu\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\11\485f354b-4403a439 (Trojan.Ransom.Gen) -> Keine Aktion durchgeführt.
C:\Users\Schatzipu\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\26\5a3c5d5a-64021947 (Trojan.Ransom.Gen) -> Keine Aktion durchgeführt.
C:\Users\Schatzipu\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0.9387475142808446.exe.lnk (Backdoor.Agent) -> Keine Aktion durchgeführt.
C:\Users\Schatzipu\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0.9858427682719441.exe.lnk (Backdoor.Agent) -> Keine Aktion durchgeführt.

(Ende)
Esset hat fast 10h zum Scan benötigt und folgendes gefunden:

Code:
C:\Program Files\GridinSoft Trojan Killer\trojankiller.exe        a variant of Win32/1AntiVirus application
C:\Users\Schatzipu\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\11\34a6dc8b-4df7a6e7        Java/Exploit.CVE-2011-3544.S trojan
C:\Users\Schatzipu\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\5\62feedc5-374c3116        Java/Exploit.CVE-2011-3544.S trojan
C:\Users\Schatzipu\Desktop\trojankiller2116-setup.exe        a variant of Win32/1AntiVirus application
C:\Users\Schatzipu\Desktop\download\SoftonicDownloader71282.exe        a variant of Win32/SoftonicDownloader.A application
C:\Users\Schatzipu\Downloads\SoftonicDownloader_fuer_gimp.exe        a variant of Win32/SoftonicDownloader.A application
Hier das Log-File:

Code:
ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
Grüße,
Olivia

cosinus 07.01.2012 22:03
Zitat:
Keine Aktion durchgeführt.
-> No action taken.
Die Funde müssen mit Malwarebytes entfernt waren! Bitte nachholen falls noch nicht getan!

Zitat:
C:\Users\Schatzipu\Downloads\SoftonicDownloader_fuer
Finger weg von Softonic!!

Irgendwie hab ich den Eindruck es ist ein Volkssport geworden sich sämtlichen Kram von Softonic zu laden. Lass die Finger von dieser Seite. Da ist immer irgendein Müll wie Toolbars oder der sinnlose Softonic Downloader drin. Warum lädst du die Software nicht von der Seite des Herstellers oder notfalls bei chip.de?

Olivia81 07.01.2012 22:12
Habe die Funde vor Start von Esset entfernt.

Code:
Malwarebytes Anti-Malware 1.60.0.1800
www.malwarebytes.org

Datenbank Version: v2012.01.06.03

Windows Vista Service Pack 1 x86 NTFS
Internet Explorer 8.0.6001.19019
Schatzipu :: SCHATZIPU-PC [Administrator]

06.01.2012 19:07:30
mbam-log-2012-01-06 (19-07-30).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 438920
Laufzeit: 8 Stunde(n), 36 Minute(n), 21 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 1
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced|Start_ShowSearch (PUM.Hijack.StartMenu) -> Bösartig: (0) Gut: (1) -> Erfolgreich ersetzt und in Quarantäne gestellt.

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 4
C:\Users\Schatzipu\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\11\485f354b-4403a439 (Trojan.Ransom.Gen) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Schatzipu\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\26\5a3c5d5a-64021947 (Trojan.Ransom.Gen) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Schatzipu\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0.9387475142808446.exe.lnk (Backdoor.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Schatzipu\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0.9858427682719441.exe.lnk (Backdoor.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)
Das mit Softonic war mir nicht bewusst. Wie soll ich es am Besten löschen?
Grüße,
Olivia

cosinus 07.01.2012 22:19
Mach bitte ein neues OTL-Log. Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:
hier steht das Log
CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
Code:
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT

Olivia81 07.01.2012 23:07
hi Arne,
hier das OTL logfile:

OTL Logfile:
Code:
OTL logfile created on: 07.01.2012 22:24:03 - Run 4
OTL by OldTimer - Version 3.2.31.0    Folder = C:\Users\Schatzipu\Desktop
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19019)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,97 Gb Total Physical Memory | 1,58 Gb Available Physical Memory | 53,31% Memory free
6,13 Gb Paging File | 4,60 Gb Available in Paging File | 75,03% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 286,87 Gb Total Space | 118,71 Gb Free Space | 41,38% Space Free | Partition Type: NTFS
Unable to calculate disk information.
 
Computer Name: SCHATZIPU-PC | User Name: Schatzipu | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Schatzipu\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Users\Schatzipu\AppData\Local\Akamai\netsession_win.exe (Akamai Technologies, Inc)
PRC - C:\Programme\Avira\AntiVir Desktop\avshadow.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe (Research In Motion Limited)
PRC - C:\Softwarenetz\Terminkalender2\kalender2.exe (softwarenetz.de)
PRC - C:\Programme\T-Online\T-Online_Software_6\Basis-Software\Basis2\profilemgr.exe (Deutsche Telekom AG)
PRC - C:\Programme\T-Online\T-Online_Software_6\Basis-Software\Basis2\sc_watch.exe (Deutsche Telekom AG)
PRC - C:\Programme\T-Online\T-Online_Software_6\Basis-Software\Basis2\kernel.exe (Deutsche Telekom AG)
PRC - C:\Programme\T-Online\T-Online_Software_6\Basis-Software\Basis1\ToADiMon.exe (Deutsche Telekom AG, Marmiko IT-Solutions GmbH)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Programme\Sony\VAIO Power Management\SPMgr.exe (Sony Corporation)
PRC - C:\Programme\Sony\VAIO Power Management\SPMService.exe (Sony Corporation)
PRC - C:\Programme\Sony\Network Utility\NSUService.exe (Sony Corporation)
PRC - C:\Windows\RTKAUDIOSERVICE.EXE (Realtek Semiconductor)
PRC - C:\Programme\Sony\VAIO Event Service\VESMgr.exe (Sony Corporation)
PRC - C:\Programme\Sony\VAIO Event Service\VESMgrSub.exe (Sony Corporation)
PRC - C:\Programme\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe (Sony Corporation)
PRC - C:\Programme\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe (Sony Corporation)
PRC - C:\Programme\Sony\VAIO Update 4\VAIOUpdt.exe (Sony Corporation)
PRC - C:\Programme\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe (Sony Corporation)
PRC - C:\Programme\Intel\WiFi\bin\EvtEng.exe (Intel(R) Corporation)
PRC - C:\Programme\Common Files\Intel\WirelessCommon\RegSrvc.exe (Intel(R) Corporation)
PRC - C:\Programme\Apoint\Apoint.exe (Alps Electric Co., Ltd.)
PRC - C:\Programme\Apoint\ApntEx.exe (Alps Electric Co., Ltd.)
PRC - C:\Programme\Apoint\ApMsgFwd.exe (Alps Electric Co., Ltd.)
PRC - C:\Windows\System32\conime.exe (Microsoft Corporation)
PRC - C:\Programme\Windows Defender\MSASCui.exe (Microsoft Corporation)
PRC - C:\Programme\Common Files\Marmiko Shared\MInfraIS\MInfraIS.exe (Deutsche Telekom AG, Marmiko IT-Solutions GmbH)
PRC - C:\Programme\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe ()
PRC - C:\Programme\Common Files\InterVideo\RegMgr\iviRegMgr.exe (InterVideo)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Programme\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Programme\Common Files\Apple\Apple Application Support\libxml2.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.IdentityMode#\99086ab77e1106d5c5560b2779f78255\System.IdentityModel.Selectors.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceModel\28614de814ab3dee1116a28b74d1f61d\System.ServiceModel.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Seri#\e93822edb472a839dbbe63ea5a28d153\System.Runtime.Serialization.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.IdentityModel\d45da410afb075d5f4ccfebf99180bd1\System.IdentityModel.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\SMDiagnostics\0d68d05599b6aa5110da103e5103f674\SMDiagnostics.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\d2f51b9bd3ada1f95da3d411dccd0a14\System.Web.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\19f5c72f22f18275e3fa45a2a8e04140\System.Windows.Forms.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\618be9fca90bc21db0010bae1e84dad4\System.Drawing.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\5c64322812ad3369c7618e5f52d13a72\System.Xml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\e84d59fe1ddbb9bc68fc7f5920364fbc\System.Configuration.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\e757b4f83931d47c785b0aaacf7cce81\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\fb0a3a6e527462455beda91d7ea58de5\mscorlib.ni.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\SPMDam\3.1.0.6020__1b3c579b6925895f\SPMDam.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\SPMCommon\3.1.0.6020__e3c7096ba83f9295\SPMCommon.dll ()
MOD - C:\Windows\System32\atitmmxx.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\System.ServiceModel.resources\3.0.0.0_de_b77a5c561934e089\System.ServiceModel.resources.dll ()
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (Akamai) -- c:\program files\common files\akamai/netsession_win_b427739.dll ()
SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
SRV - (FLEXnet Licensing Service) -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.)
SRV - (VAIO Power Management) -- C:\Program Files\Sony\VAIO Power Management\SPMService.exe (Sony Corporation)
SRV - (NSUService) -- C:\Program Files\Sony\Network Utility\NSUService.exe (Sony Corporation)
SRV - (RtkAudioService) -- C:\Windows\RTKAUDIOSERVICE.EXE (Realtek Semiconductor)
SRV - (VAIO Event Service) -- C:\Programme\Sony\VAIO Event Service\VESMgr.exe (Sony Corporation)
SRV - (VCFw) -- C:\Program Files\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe (Sony Corporation)
SRV - (Vcsw) -- C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe (Sony Corporation)
SRV - (VcmIAlzMgr) -- C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe (Sony Corporation)
SRV - (VcmXmlIfHelper) -- C:\Program Files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper.exe (Sony Corporation)
SRV - (VzCdbSvc) -- C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe (Sony Corporation)
SRV - (VAIO Entertainment TV Device Arbitration Service) -- C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzHardwareResourceManager\VzHardwareResourceManager\VzHardwareResourceManager.exe (Sony Corporation)
SRV - (SOHDms) -- C:\Program Files\Sony\VAIO Media plus\SOHDms.exe (Sony Corporation)
SRV - (SOHCImp) -- C:\Program Files\Sony\VAIO Media plus\SOHCImp.exe (Sony Corporation)
SRV - (SOHDs) -- C:\Program Files\Sony\VAIO Media plus\SOHDs.exe (Sony Corporation)
SRV - (SPTISRV) -- C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe (Sony Corporation)
SRV - (MSCSPTISRV) -- C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe (Sony Corporation)
SRV - (PACSPTISVR) -- C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe (Sony Corporation)
SRV - (EvtEng) -- C:\Programme\Intel\WiFi\bin\EvtEng.exe (Intel(R) Corporation)
SRV - (RegSrvc) -- C:\Programme\Common Files\Intel\WirelessCommon\RegSrvc.exe (Intel(R) Corporation)
SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (AdobeActiveFileMonitor6.0) -- C:\Programme\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe ()
SRV - (IviRegMgr) -- C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe (InterVideo)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH)
DRV - (avkmgr) -- C:\Windows\System32\drivers\avkmgr.sys (Avira GmbH)
DRV - (MTOnlPktAlyX) -- C:\Programme\T-Online\T-Online_Software_6\Basis-Software\Basis1\MTOnlPktAlyx.sys (Deutsche Telekom AG AG, Marmiko IT-Solutions GmbH)
DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (atikmdag) -- C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (DMICall) -- C:\Windows\System32\drivers\DMICall.sys (Sony Corporation)
DRV - (rimsptsk) -- C:\Windows\System32\drivers\rimsptsk.sys (REDC)
DRV - (RTHDMIAzAudService) -- C:\Windows\System32\drivers\RtHDMIV.sys (Realtek Semiconductor Corp.)
DRV - (risdptsk) -- C:\Windows\System32\drivers\risdptsk.sys (REDC)
DRV - (WimFltr) -- C:\Windows\System32\drivers\WimFltr.sys (Microsoft Corporation)
DRV - (NETw5v32) Intel(R) -- C:\Windows\System32\drivers\NETw5v32.sys (Intel Corporation)
DRV - (SFEP) -- C:\Windows\System32\drivers\SFEP.sys (Sony Corporation)
DRV - (ApfiltrService) -- C:\Windows\System32\drivers\Apfiltr.sys (Alps Electric Co., Ltd.)
DRV - (XAudio) -- C:\Windows\System32\drivers\XAudio.sys (Conexant Systems, Inc.)
DRV - (regi) -- C:\Windows\System32\drivers\regi.sys (InterVideo)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKLM\..\URLSearchHook: {7e111a5c-3d11-4f56-9463-5310c3c69025} - C:\Programme\Freeware.de\prxtbFree.dll (Conduit Ltd.)
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [Binary data over 100 bytes]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.orf.at/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Ask.com"
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.selectedEngine: "Ask.com"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..extensions.enabledItems: ffxtlbr@Facemoods.com:1.2.1
FF - prefs.js..extensions.enabledItems: {82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}:5.6.0.8442
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Users\Schatzipu\Desktop\Ulli\Programme\divx\DivX Player\npDivxPlayerPlugin.dll (DivX, Inc)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Picasa2\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.0.61118.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.69: C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.3.69: C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.69: C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=:  File not found
FF - HKLM\Software\MozillaPlugins\@RIM.com/WebSLLauncher,version=1.0: C:\Program Files\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll ()
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.17\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.06.26 08:52:01 | 000,000,000 | -H-D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.17\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.06.26 08:52:01 | 000,000,000 | -H-D | M]
 
[2010.07.29 10:09:23 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Schatzipu\AppData\Roaming\mozilla\Extensions
[2011.12.13 22:06:46 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Schatzipu\AppData\Roaming\mozilla\Firefox\Profiles\dkk0kp2n.default\extensions
[2010.11.09 17:05:16 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Schatzipu\AppData\Roaming\mozilla\Firefox\Profiles\dkk0kp2n.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011.03.27 20:51:16 | 000,000,000 | ---D | M] (Facemoods) -- C:\Users\Schatzipu\AppData\Roaming\mozilla\Firefox\Profiles\dkk0kp2n.default\extensions\ffxtlbr@Facemoods.com
[2011.07.15 20:20:40 | 000,002,397 | ---- | M] () -- C:\Users\Schatzipu\AppData\Roaming\Mozilla\Firefox\Profiles\dkk0kp2n.default\searchplugins\askcom.xml
[2011.12.13 22:06:46 | 000,000,000 | -H-D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2011.10.21 20:02:55 | 000,000,000 | -H-D | M] (Skype Click to Call) -- C:\Programme\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2011.03.20 09:59:52 | 000,000,000 | -H-D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
[2011.10.21 20:02:55 | 000,000,000 | -H-D | M] (Skype Click to Call) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2011.03.20 09:59:52 | 000,000,000 | -H-D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
[2011.03.20 09:58:50 | 000,472,808 | -H-- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2011.06.26 08:51:54 | 000,001,392 | -H-- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011.06.26 08:51:54 | 000,002,344 | -H-- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2011.06.26 08:51:54 | 000,006,805 | -H-- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2011.06.26 08:51:54 | 000,001,178 | -H-- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2011.06.26 08:51:54 | 000,001,105 | -H-- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2010.05.29 21:24:35 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O2 - BHO: (CescrtHlpr Object) - {64182481-4F71-486b-A045-B233BD0DA8FC} - C:\Programme\facemoods.com\facemoods\1.4.17.6\bh\facemoods.dll (facemoods.com BHO)
O2 - BHO: (Freeware.de Toolbar) - {7e111a5c-3d11-4f56-9463-5310c3c69025} - C:\Programme\Freeware.de\prxtbFree.dll (Conduit Ltd.)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O3 - HKCU\..\Toolbar\WebBrowser: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKCU\..\Toolbar\WebBrowser: (Freeware.de Toolbar) - {7E111A5C-3D11-4F56-9463-5310C3C69025} - C:\Programme\Freeware.de\prxtbFree.dll (Conduit Ltd.)
O4 - HKLM..\Run: [Apoint] C:\Programme\Apoint\Apoint.exe (Alps Electric Co., Ltd.)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [facemoods] C:\Program Files\facemoods.com\facemoods\1.4.17.6\facemoodssrv.exe (facemoods.com)
O4 - HKLM..\Run: [RIMBBLaunchAgent.exe] C:\Programme\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe (Research In Motion Limited)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [ToADiMon.exe] C:\Program Files\T-Online\T-Online_Software_6\Basis-Software\Basis1\ToADiMon.exe (Deutsche Telekom AG, Marmiko IT-Solutions GmbH)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [Akamai NetSession Interface] C:\Users\Schatzipu\AppData\Local\Akamai\netsession_win.exe (Akamai Technologies, Inc)
O4 - Startup: C:\Users\Schatzipu\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Terminkalender2.lnk = C:\Softwarenetz\Terminkalender2\kalender2.exe (softwarenetz.de)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoSecCPL = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoDevMgrPage = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoConfigPage = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoVirtMemPage = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoFileSysPage = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoNetSetup = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoNetSetupIDPage = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoNetSetupSecurityPage = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoWorkgroupContents = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoEntireNetwork = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoFileSharingControl = 0
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: An vorhandenes PDF anfügen - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Auswahl in Adobe PDF konvertieren - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Auswahl in vorhandene PDF-Datei konvertieren - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Bild an &Bluetooth-Gerät senden... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html File not found
O8 - Extra context menu item: In Adobe PDF konvertieren - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Seite an &Bluetooth-Gerät senden... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O8 - Extra context menu item: Verknüpfungsziel in Adobe PDF konvertieren - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKCU\..Trusted Domains: maxdome.de ([www] https in Vertrauenswürdige Sites)
O16 - DPF: {0972B098-DEE9-4279-AC7E-4BAAA029102D} hxxp://assets.photobox.com/assets/aurigma/ImageUploader5.cab?20111123062837 (PhotoboxPhotowaysUploader5 Control)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{CCB0A9D0-05AD-4A90-9C7C-06497781FE78}: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\VESWinlogon: DllName - (VESWinlogon.dll) - C:\Windows\System32\VESWinlogon.dll (Sony Corporation)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img24.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img24.jpg
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | -H-- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
MsConfig - StartUpFolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^BTTray.lnk - C:\Programme\WIDCOMM\Bluetooth Software\BTTray.exe - (Broadcom Corporation.)
MsConfig - StartUpReg: Acrobat Assistant 8.0 - hkey= - key= - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe (Adobe Systems Inc.)
MsConfig - StartUpReg: AdobeCS4ServiceManager - hkey= - key= - C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe (Adobe Systems Incorporated)
MsConfig - StartUpReg: AdobeUpdater - hkey= - key= - C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe (Adobe Systems Incorporated)
MsConfig - StartUpReg: AML - hkey= - key= - C:\Program Files\Sony\VAIO Launcher\AML.exe (Sony)
MsConfig - StartUpReg: DivXUpdate - hkey= - key= - C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
MsConfig - StartUpReg: InfoCockpit - hkey= - key= - C:\Program Files\T-Online\T-Online_Software_6\Info-Cockpit\IC_START.EXE (Deutsche Telekom AG, T-Com)
MsConfig - StartUpReg: ISBMgr.exe - hkey= - key= - C:\Program Files\Sony\ISB Utility\ISBMgr.exe (Sony Corporation)
MsConfig - StartUpReg: iTunesHelper - hkey= - key= - C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)
MsConfig - StartUpReg: MarketingTools - hkey= - key= - C:\Programme\Sony\Marketing Tools\MarketingTools.exe (Sony Corporation)
MsConfig - StartUpReg: NSUFloatingUI - hkey= - key= - C:\Program Files\Sony\Network Utility\LANUtil.exe (Sony Corporation)
MsConfig - StartUpReg: QuickTime Task - hkey= - key= - C:\Program Files\QuickTime\QTTask.exe (Apple Inc.)
MsConfig - StartUpReg: T-Online_Software_6 - hkey= - key= - Reg Error: Value error. File not found
MsConfig - StartUpReg: ToADiMon.exe - hkey= - key= - C:\Program Files\T-Online\T-Online_Software_6\Basis-Software\Basis1\ToADiMon.exe (Deutsche Telekom AG, Marmiko IT-Solutions GmbH)
MsConfig - State: "startup" - 2
 
SafeBootMin: AppMgmt -  File not found
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: NTDS -  File not found
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet: AppMgmt -  File not found
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: NTDS -  File not found
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Microsoft VM
ActiveX: {184956A0-ED27-B8F2-EDB1-D5462EF0011B} -
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} -
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {2F6EFCE6-10DF-49F9-9E64-9AE3775B2588} - Microsoft .NET Framework 1.1 Security Update (KB2416447)
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} -
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.8
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {729EA996-6CBA-951D-9B8C-5BCA3F03CEA0} -
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E78BFA60-5393-4C38-82AB-E8019E464EB4} - .NET Framework
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
Drivers32: msacm.ac3filter - C:\Windows\System32\ac3filter.acm ()
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\Windows\System32\DivX.dll (DivX, Inc.)
Drivers32: VIDC.dvsd - C:\Programme\Common Files\Sony Shared\VideoLib\sonydv.dll (Sony Corporation)
Drivers32: vidc.yv12 - C:\Windows\System32\DivX.dll (DivX, Inc.)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.01.07 10:33:42 | 000,000,000 | ---D | C] -- C:\Program Files\ESET
[2012.01.06 19:05:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.01.06 19:05:14 | 000,000,000 | ---D | C] -- C:\Malwarebytes' Anti-Malware
[2012.01.06 10:36:55 | 000,141,120 | ---- | C] (GridinSoft) -- C:\Users\Schatzipu\Desktop\unhider.exe
[2012.01.06 04:09:00 | 000,000,000 | ---D | C] -- C:\Users\Schatzipu\Desktop\tdsskiller
[2012.01.06 03:31:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GridinSoft
[2012.01.06 03:30:49 | 000,000,000 | ---D | C] -- C:\Program Files\GridinSoft Trojan Killer
[2012.01.06 03:30:35 | 023,550,168 | ---- | C] (GridinSoft, Inc.                                            ) -- C:\Users\Schatzipu\Desktop\trojankiller2116-setup.exe
[2012.01.06 00:25:34 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\Schatzipu\Desktop\OTL.exe
[2012.01.05 21:47:46 | 000,060,416 | -H-- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2012.01.05 21:46:47 | 000,000,000 | --SD | C] -- C:\ComboFix
[2012.01.05 21:31:51 | 000,000,000 | ---D | C] -- C:\Qoobox
[2012.01.05 21:31:25 | 000,000,000 | -HSD | C] -- C:\ProgramData\{32364CEA-7855-4A3C-B674-53D8E9B97936}
[2012.01.05 21:31:15 | 035,944,352 | ---- | C] (TuneUp Software) -- C:\Users\Schatzipu\Desktop\TuneUpUtilities2012_de-DE.exe
[2012.01.05 21:15:56 | 000,388,608 | ---- | C] (Trend Micro Inc.) -- C:\Users\Schatzipu\Desktop\HiJackThis204.exe
[2012.01.05 21:12:41 | 010,847,608 | ---- | C] (Malwarebytes Corporation                                    ) -- C:\Users\Schatzipu\Desktop\mbam-setup-1.60.0.1800.exe
[2012.01.05 20:40:07 | 000,000,000 | ---D | C] -- C:\Users\Schatzipu\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Check
[2012.01.04 11:23:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2012.01.04 11:19:57 | 000,000,000 | -H-D | C] -- C:\Program Files\iPod
[2012.01.03 12:19:28 | 000,000,000 | ---D | C] -- C:\Users\Schatzipu\Desktop\Der Racheplan
[2011.12.20 21:33:53 | 000,000,000 | ---D | C] -- C:\Users\Schatzipu\AppData\Roaming\Avira
[2011.12.20 20:28:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
[2011.12.20 20:27:52 | 000,028,520 | -H-- | C] (Avira GmbH) -- C:\Windows\System32\drivers\ssmdrv.sys
[2011.12.20 20:27:51 | 000,134,856 | -H-- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avipbb.sys
[2011.12.20 20:27:51 | 000,074,640 | -H-- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avgntflt.sys
[2011.12.20 20:27:51 | 000,036,000 | -H-- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avkmgr.sys
[2011.12.20 20:27:44 | 000,000,000 | -H-D | C] -- C:\Program Files\Avira
[2011.12.20 20:27:44 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira
[2 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.01.07 22:22:02 | 000,001,098 | -H-- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.01.07 20:50:57 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012.01.07 20:50:57 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012.01.07 16:22:22 | 000,001,094 | -H-- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.01.07 08:50:50 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.01.07 08:50:30 | 3184,599,040 | -HS- | M] () -- C:\hiberfil.sys
[2012.01.07 08:49:33 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat
[2012.01.06 19:05:22 | 000,000,660 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.01.06 19:04:05 | 010,847,608 | ---- | M] (Malwarebytes Corporation                                    ) -- C:\Users\Schatzipu\Desktop\mbam-setup-1.60.0.1800.exe
[2012.01.06 10:36:56 | 000,141,120 | ---- | M] (GridinSoft) -- C:\Users\Schatzipu\Desktop\unhider.exe
[2012.01.06 10:36:12 | 000,170,304 | ---- | M] () -- C:\Users\Schatzipu\Desktop\restore.exe
[2012.01.06 04:08:45 | 001,558,406 | ---- | M] () -- C:\Users\Schatzipu\Desktop\tdsskiller.zip
[2012.01.06 03:31:03 | 000,000,936 | ---- | M] () -- C:\Users\Public\Desktop\Trojan Killer.lnk
[2012.01.06 03:30:35 | 023,550,168 | ---- | M] (GridinSoft, Inc.                                            ) -- C:\Users\Schatzipu\Desktop\trojankiller2116-setup.exe
[2012.01.06 00:50:35 | 000,302,592 | ---- | M] () -- C:\Users\Schatzipu\Desktop\x1qc2ymg.exe
[2012.01.06 00:47:18 | 000,000,000 | ---- | M] () -- C:\Users\Schatzipu\defogger_reenable
[2012.01.06 00:46:36 | 000,050,477 | ---- | M] () -- C:\Users\Schatzipu\Desktop\Defogger.exe
[2012.01.06 00:29:14 | 000,184,832 | ---- | M] () -- C:\Users\Schatzipu\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.01.06 00:25:37 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Schatzipu\Desktop\OTL.exe
[2012.01.05 21:37:26 | 000,002,032 | ---- | M] () -- C:\Users\Schatzipu\AppData\Local\d3d9caps.dat
[2012.01.05 21:31:15 | 035,944,352 | ---- | M] (TuneUp Software) -- C:\Users\Schatzipu\Desktop\TuneUpUtilities2012_de-DE.exe
[2012.01.05 21:15:57 | 000,388,608 | ---- | M] (Trend Micro Inc.) -- C:\Users\Schatzipu\Desktop\HiJackThis204.exe
[2012.01.05 20:44:31 | 002,270,652 | -H-- | M] () -- C:\Windows\System32\perfh009.dat
[2012.01.05 20:44:31 | 001,697,126 | -H-- | M] () -- C:\Windows\System32\perfc009.dat
[2012.01.05 20:44:29 | 005,945,910 | -H-- | M] () -- C:\Windows\System32\perfh007.dat
[2012.01.05 20:44:29 | 001,878,310 | -H-- | M] () -- C:\Windows\System32\perfc007.dat
[2011.12.29 18:35:10 | 007,429,846 | ---- | M] () -- C:\Users\Schatzipu\Desktop\323k16-11_3.pdf
[2011.12.28 11:11:21 | 000,000,069 | -H-- | M] () -- C:\Windows\NeroDigital.ini
[2011.12.20 12:58:43 | 000,733,528 | ---- | M] () -- C:\Users\Schatzipu\Desktop\Reihenendhaus-2743990[1].pdf
[2011.12.10 15:24:06 | 000,020,464 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2011.12.09 12:40:20 | 000,134,856 | -H-- | M] (Avira GmbH) -- C:\Windows\System32\drivers\avipbb.sys
[2011.12.09 12:40:20 | 000,074,640 | -H-- | M] (Avira GmbH) -- C:\Windows\System32\drivers\avgntflt.sys
[2011.12.09 12:40:20 | 000,036,000 | -H-- | M] (Avira GmbH) -- C:\Windows\System32\drivers\avkmgr.sys
[2 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.01.06 19:05:22 | 000,000,660 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.01.06 10:36:11 | 000,170,304 | ---- | C] () -- C:\Users\Schatzipu\Desktop\restore.exe
[2012.01.06 04:08:38 | 001,558,406 | ---- | C] () -- C:\Users\Schatzipu\Desktop\tdsskiller.zip
[2012.01.06 03:31:03 | 000,000,936 | ---- | C] () -- C:\Users\Public\Desktop\Trojan Killer.lnk
[2012.01.06 00:50:34 | 000,302,592 | ---- | C] () -- C:\Users\Schatzipu\Desktop\x1qc2ymg.exe
[2012.01.06 00:47:18 | 000,000,000 | ---- | C] () -- C:\Users\Schatzipu\defogger_reenable
[2012.01.06 00:46:42 | 000,050,477 | ---- | C] () -- C:\Users\Schatzipu\Desktop\Defogger.exe
[2012.01.05 21:50:57 | 3184,599,040 | -HS- | C] () -- C:\hiberfil.sys
[2011.12.29 18:35:10 | 007,429,846 | ---- | C] () -- C:\Users\Schatzipu\Desktop\323k16-11_3.pdf
[2011.12.20 12:58:41 | 000,733,528 | ---- | C] () -- C:\Users\Schatzipu\Desktop\Reihenendhaus-2743990[1].pdf
[2011.11.20 16:13:10 | 000,108,360 | -H-- | C] () -- C:\Windows\System32\mlfcache.dat
[2011.03.19 09:26:06 | 000,089,088 | -H-- | C] () -- C:\Windows\System32\mbr.exe
[2010.07.29 10:09:17 | 000,000,000 | -H-- | C] () -- C:\Windows\nsreg.dat
[2010.06.24 08:00:31 | 000,000,032 | ---- | C] () -- C:\ProgramData\ezsid.dat
[2009.12.26 11:19:35 | 000,000,441 | -H-- | C] () -- C:\Windows\T1.ini
[2009.12.11 17:51:28 | 000,000,085 | -HS- | C] () -- C:\ProgramData\.zreglib
[2009.09.06 11:06:44 | 000,000,763 | -H-- | C] () -- C:\Windows\cdplayer.ini
[2009.06.07 17:49:50 | 000,000,069 | -H-- | C] () -- C:\Windows\NeroDigital.ini
[2009.03.22 21:36:52 | 000,101,417 | ---- | C] () -- C:\Users\Schatzipu\AppData\Roaming\com.kennettnet.MusicRescue4.Profiles.plist
[2009.03.22 20:52:27 | 000,890,191 | ---- | C] () -- C:\Users\Schatzipu\AppData\Roaming\com.kennettnet.MusicRescue4.plist
[2009.01.19 19:46:00 | 000,000,056 | -H-- | C] () -- C:\Windows\System32\ezsidmv.dat
[2009.01.06 20:41:35 | 000,184,832 | ---- | C] () -- C:\Users\Schatzipu\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008.11.10 03:04:36 | 000,106,605 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2008.11.10 03:04:36 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2008.11.09 13:25:37 | 000,000,097 | ---- | C] () -- C:\Users\Schatzipu\AppData\Local\fusioncache.dat
[2008.11.08 17:05:38 | 000,002,032 | ---- | C] () -- C:\Users\Schatzipu\AppData\Local\d3d9caps.dat
[2008.08.22 11:35:07 | 000,000,000 | -H-- | C] () -- C:\Windows\VAIOUpdt.INI
[2008.08.22 11:27:12 | 000,344,064 | -H-- | C] () -- C:\Windows\System32\SSMSIppCustom.dll
[2008.08.22 10:56:35 | 000,000,209 | -H-- | C] () -- C:\Windows\ODBCINST.INI
[2008.08.11 19:55:33 | 003,107,788 | -H-- | C] () -- C:\Windows\System32\atiumdva.dat
[2008.08.11 19:55:33 | 000,174,819 | -H-- | C] () -- C:\Windows\System32\atiicdxx.dat
[2008.08.11 19:55:33 | 000,159,744 | -H-- | C] () -- C:\Windows\System32\atitmmxx.dll
[2008.08.11 19:55:33 | 000,090,112 | -H-- | C] () -- C:\Windows\System32\atibrtmon.exe
[2008.08.11 19:55:33 | 000,081,920 | -H-- | C] () -- C:\Windows\System32\ATIODE.exe
[2008.08.11 19:55:33 | 000,040,960 | -H-- | C] () -- C:\Windows\System32\ATIODCLI.exe
[2008.08.11 10:29:29 | 000,000,012 | ---- | C] () -- C:\Windows\bthservsdp.dat
[2008.08.11 10:10:07 | 000,000,000 | -H-- | C] () -- C:\Windows\ativpsrm.bin
[2008.01.21 08:15:58 | 005,945,910 | -H-- | C] () -- C:\Windows\System32\perfh007.dat
[2008.01.21 08:15:58 | 001,878,310 | -H-- | C] () -- C:\Windows\System32\perfc007.dat
[2008.01.21 08:15:58 | 000,290,748 | -H-- | C] () -- C:\Windows\System32\perfi007.dat
[2008.01.21 08:15:58 | 000,036,916 | -H-- | C] () -- C:\Windows\System32\perfd007.dat
[2007.09.12 00:57:44 | 003,596,288 | -H-- | C] () -- C:\Windows\System32\qt-dx331.dll
[2007.04.16 02:24:16 | 000,023,752 | -H-- | C] () -- C:\Windows\System32\providers.bin
[2007.03.12 21:31:28 | 001,732,608 | -H-- | C] () -- C:\Windows\System32\BCGPStyle2007Luna.dll
[2006.11.02 13:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006.11.02 13:47:37 | 002,266,048 | -H-- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006.11.02 13:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006.11.02 11:33:01 | 002,270,652 | -H-- | C] () -- C:\Windows\System32\perfh009.dat
[2006.11.02 11:33:01 | 001,697,126 | -H-- | C] () -- C:\Windows\System32\perfc009.dat
[2006.11.02 11:33:01 | 000,287,440 | -H-- | C] () -- C:\Windows\System32\perfi009.dat
[2006.11.02 11:33:01 | 000,030,674 | -H-- | C] () -- C:\Windows\System32\perfd009.dat
[2006.11.02 11:23:21 | 000,215,943 | -H-- | C] () -- C:\Windows\System32\dssec.dat
[2006.11.02 09:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006.11.02 09:19:00 | 000,000,741 | -H-- | C] () -- C:\Windows\System32\NOISE.DAT
[2006.11.02 08:40:29 | 000,013,750 | -H-- | C] () -- C:\Windows\System32\pacerprf.ini
[2006.11.02 08:25:31 | 000,673,088 | -H-- | C] () -- C:\Windows\System32\mlang.dat
[2001.11.14 12:56:00 | 001,802,240 | -H-- | C] () -- C:\Windows\System32\lcppn21.dll
 
========== LOP Check ==========
 
[2011.09.29 23:40:09 | 000,000,000 | ---D | M] -- C:\Users\Schatzipu\AppData\Roaming\Blackberry Desktop
[2010.12.09 11:23:08 | 000,000,000 | ---D | M] -- C:\Users\Schatzipu\AppData\Roaming\de.myphotobook.creator.001F9DF2D0BAABEB11F42CCEE43224607B61109C.1
[2011.11.22 20:55:30 | 000,000,000 | ---D | M] -- C:\Users\Schatzipu\AppData\Roaming\elsterformular
[2010.07.08 04:13:09 | 000,000,000 | ---D | M] -- C:\Users\Schatzipu\AppData\Roaming\FreeVideoConverter
[2011.03.27 20:30:54 | 000,000,000 | ---D | M] -- C:\Users\Schatzipu\AppData\Roaming\GetRightToGo
[2010.12.16 11:16:00 | 000,000,000 | ---D | M] -- C:\Users\Schatzipu\AppData\Roaming\Imaxel
[2008.11.08 17:12:41 | 000,000,000 | ---D | M] -- C:\Users\Schatzipu\AppData\Roaming\InterVideo
[2011.03.27 20:53:41 | 000,000,000 | ---D | M] -- C:\Users\Schatzipu\AppData\Roaming\Kalenderchen
[2009.12.26 12:41:44 | 000,000,000 | ---D | M] -- C:\Users\Schatzipu\AppData\Roaming\PRMT
[2009.12.26 12:19:05 | 000,000,000 | ---D | M] -- C:\Users\Schatzipu\AppData\Roaming\PROject MT
[2011.09.29 13:53:28 | 000,000,000 | ---D | M] -- C:\Users\Schatzipu\AppData\Roaming\Research In Motion
[2008.11.09 13:22:46 | 000,000,000 | ---D | M] -- C:\Users\Schatzipu\AppData\Roaming\T-Online
[2012.01.07 08:49:34 | 000,032,564 | -H-- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2010.12.09 11:20:37 | 000,000,000 | ---D | M] -- C:\Users\Schatzipu\AppData\Roaming\Adobe
[2012.01.04 11:41:58 | 000,000,000 | ---D | M] -- C:\Users\Schatzipu\AppData\Roaming\Apple Computer
[2009.01.11 15:15:36 | 000,000,000 | ---D | M] -- C:\Users\Schatzipu\AppData\Roaming\ArcSoft
[2008.08.22 11:09:23 | 000,000,000 | ---D | M] -- C:\Users\Schatzipu\AppData\Roaming\ATI
[2011.12.20 21:33:53 | 000,000,000 | ---D | M] -- C:\Users\Schatzipu\AppData\Roaming\Avira
[2011.09.29 23:40:09 | 000,000,000 | ---D | M] -- C:\Users\Schatzipu\AppData\Roaming\Blackberry Desktop
[2010.12.09 11:23:08 | 000,000,000 | ---D | M] -- C:\Users\Schatzipu\AppData\Roaming\de.myphotobook.creator.001F9DF2D0BAABEB11F42CCEE43224607B61109C.1
[2010.06.28 08:46:20 | 000,000,000 | ---D | M] -- C:\Users\Schatzipu\AppData\Roaming\DivX
[2011.11.22 20:55:30 | 000,000,000 | ---D | M] -- C:\Users\Schatzipu\AppData\Roaming\elsterformular
[2010.07.08 04:13:09 | 000,000,000 | ---D | M] -- C:\Users\Schatzipu\AppData\Roaming\FreeVideoConverter
[2011.03.27 20:30:54 | 000,000,000 | ---D | M] -- C:\Users\Schatzipu\AppData\Roaming\GetRightToGo
[2008.11.09 15:27:04 | 000,000,000 | ---D | M] -- C:\Users\Schatzipu\AppData\Roaming\Google
[2008.01.21 02:43:07 | 000,000,000 | ---D | M] -- C:\Users\Schatzipu\AppData\Roaming\Identities
[2010.12.16 11:16:00 | 000,000,000 | ---D | M] -- C:\Users\Schatzipu\AppData\Roaming\Imaxel
[2008.08.22 10:52:32 | 000,000,000 | ---D | M] -- C:\Users\Schatzipu\AppData\Roaming\InstallShield
[2008.11.15 10:15:43 | 000,000,000 | ---D | M] -- C:\Users\Schatzipu\AppData\Roaming\Intel
[2008.11.08 17:12:41 | 000,000,000 | ---D | M] -- C:\Users\Schatzipu\AppData\Roaming\InterVideo
[2011.03.27 20:53:41 | 000,000,000 | ---D | M] -- C:\Users\Schatzipu\AppData\Roaming\Kalenderchen
[2008.08.22 11:17:21 | 000,000,000 | ---D | M] -- C:\Users\Schatzipu\AppData\Roaming\Macromedia
[2010.05.15 15:38:21 | 000,000,000 | ---D | M] -- C:\Users\Schatzipu\AppData\Roaming\Malwarebytes
[2006.11.02 13:37:34 | 000,000,000 | ---D | M] -- C:\Users\Schatzipu\AppData\Roaming\Media Center Programs
[2011.03.04 18:52:06 | 000,000,000 | --SD | M] -- C:\Users\Schatzipu\AppData\Roaming\Microsoft
[2010.07.29 10:09:23 | 000,000,000 | ---D | M] -- C:\Users\Schatzipu\AppData\Roaming\Mozilla
[2009.12.26 12:41:44 | 000,000,000 | ---D | M] -- C:\Users\Schatzipu\AppData\Roaming\PRMT
[2009.12.26 12:19:05 | 000,000,000 | ---D | M] -- C:\Users\Schatzipu\AppData\Roaming\PROject MT
[2008.11.28 09:09:38 | 000,000,000 | ---D | M] -- C:\Users\Schatzipu\AppData\Roaming\Real
[2011.09.29 13:53:28 | 000,000,000 | ---D | M] -- C:\Users\Schatzipu\AppData\Roaming\Research In Motion
[2012.01.03 20:51:47 | 000,000,000 | ---D | M] -- C:\Users\Schatzipu\AppData\Roaming\Skype
[2012.01.03 16:03:56 | 000,000,000 | ---D | M] -- C:\Users\Schatzipu\AppData\Roaming\skypePM
[2009.12.03 15:52:29 | 000,000,000 | ---D | M] -- C:\Users\Schatzipu\AppData\Roaming\Sony Corporation
[2008.11.09 13:22:46 | 000,000,000 | ---D | M] -- C:\Users\Schatzipu\AppData\Roaming\T-Online
 
< %APPDATA%\*.exe /s >
[2010.12.09 11:19:58 | 000,053,632 | ---- | M] (Adobe Systems Inc.) -- C:\Users\Schatzipu\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
[2011.09.25 21:32:22 | 003,126,944 | ---- | M] (Adobe Systems, Inc.) -- C:\Users\Schatzipu\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\fpupdateax\fpupdateax.exe
[2008.08.22 11:10:24 | 000,010,134 | R--- | M] () -- C:\Users\Schatzipu\AppData\Roaming\Microsoft\Installer\{14291118-0C19-45EA-A4FA-5C1C0F5FDE09}\ARPPRODUCTICON.exe
[2011.03.19 14:30:52 | 000,388,096 | R--- | M] (Trend Micro Inc.) -- C:\Users\Schatzipu\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
[2008.08.22 11:08:13 | 000,010,134 | R--- | M] () -- C:\Users\Schatzipu\AppData\Roaming\Microsoft\Installer\{46D7A7FB-305B-F77D-60F8-8FAE1C432374}\ARPPRODUCTICON.exe
 
< %SYSTEMDRIVE%\*.exe >
[2007.11.07 07:03:18 | 000,562,688 | -H-- | M] (Microsoft Corporation) -- C:\install.exe
 
 
< MD5 for: AGP440.SYS  >
[2008.01.21 03:23:01 | 000,056,376 | -H-- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\ERDNT\cache\agp440.sys
[2008.01.21 03:23:01 | 000,056,376 | -H-- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\drivers\agp440.sys
[2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys
[2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys
[2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_bbfe6647bbd2a4c6\AGP440.sys
[2006.11.02 10:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009.04.11 07:32:26 | 000,019,944 | -H-- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\SoftwareDistribution\Download\cd2b15b1a90e884578188440a1660b12\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys
[2008.01.21 03:23:00 | 000,021,560 | -H-- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\ERDNT\cache\atapi.sys
[2008.01.21 03:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\drivers\atapi.sys
[2008.01.21 03:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys
[2008.01.21 03:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys
[2006.11.02 10:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2006.11.02 10:46:03 | 000,011,776 | -H-- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\ERDNT\cache\cngaudit.dll
[2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll
[2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll
 
< MD5 for: IASTOR.SYS  >
[2008.04.22 01:20:41 | 000,312,344 | -H-- | M] (Intel Corporation) MD5=DB0CC620B27A928D968C1A1E9CD9CB87 -- C:\Windows\Drivers\INF\SATA Driver (Intel) (Non-RAID)\IaStor.sys
[2008.04.22 01:20:41 | 000,312,344 | -H-- | M] (Intel Corporation) MD5=DB0CC620B27A928D968C1A1E9CD9CB87 -- C:\Windows\System32\drivers\iaStor.sys
[2008.04.22 01:20:41 | 000,312,344 | ---- | M] (Intel Corporation) MD5=DB0CC620B27A928D968C1A1E9CD9CB87 -- C:\Windows\System32\DriverStore\FileRepository\iaahci.inf_77c04a30\iaStor.sys
[2008.04.22 01:20:41 | 000,312,344 | ---- | M] (Intel Corporation) MD5=DB0CC620B27A928D968C1A1E9CD9CB87 -- C:\Windows\System32\DriverStore\FileRepository\iastor.inf_054cd65f\iaStor.sys
 
< MD5 for: IASTORV.SYS  >
[2008.01.21 03:23:23 | 000,235,064 | -H-- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\drivers\iaStorV.sys
[2008.01.21 03:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_c9df7691\iaStorV.sys
[2008.01.21 03:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys
[2006.11.02 10:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2009.04.11 07:28:23 | 000,592,896 | -H-- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\SoftwareDistribution\Download\cd2b15b1a90e884578188440a1660b12\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_ffa3304f351bb3a3\netlogon.dll
[2008.01.21 03:24:05 | 000,592,384 | -H-- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\ERDNT\cache\netlogon.dll
[2008.01.21 03:24:05 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\System32\netlogon.dll
[2008.01.21 03:24:05 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2006.11.02 10:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys
[2008.01.21 03:23:21 | 000,045,112 | -H-- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\drivers\nvstor.sys
[2008.01.21 03:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys
[2008.01.21 03:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2008.01.21 03:24:50 | 000,177,152 | -H-- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\ERDNT\cache\scecli.dll
[2008.01.21 03:24:50 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\System32\scecli.dll
[2008.01.21 03:24:50 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll
[2009.04.11 07:28:24 | 000,177,152 | -H-- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\SoftwareDistribution\Download\cd2b15b1a90e884578188440a1660b12\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e\scecli.dll
 
< MD5 for: USER32.DLL  >
[2009.04.11 07:28:25 | 000,627,712 | -H-- | M] (Microsoft Corporation) MD5=75510147B94598407666F4802797C75A -- C:\Windows\SoftwareDistribution\Download\cd2b15b1a90e884578188440a1660b12\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6002.18005_none_cf23e54d6a7e4a7e\user32.dll
[2008.01.21 03:24:21 | 000,627,200 | -H-- | M] (Microsoft Corporation) MD5=B974D9F06DC7D1908E825DC201681269 -- C:\Windows\ERDNT\cache\user32.dll
[2008.01.21 03:24:21 | 000,627,200 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\user32.dll
[2008.01.21 03:24:21 | 000,627,200 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_cd386c416d5c7f32\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2008.01.21 03:24:49 | 000,025,088 | -H-- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\ERDNT\cache\userinit.exe
[2008.01.21 03:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe
[2008.01.21 03:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe
 
< MD5 for: WININIT.EXE  >
[2008.01.21 03:23:42 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\System32\wininit.exe
[2008.01.21 03:23:42 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6001.18000_none_30f2b8cf0450a6a2\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2009.04.11 07:28:13 | 000,314,368 | -H-- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\SoftwareDistribution\Download\cd2b15b1a90e884578188440a1660b12\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe
[2011.12.24 17:50:20 | 000,182,856 | ---- | M] () MD5=B382935AB01B27D0E14F267DBF288896 -- C:\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2008.01.21 03:24:49 | 000,314,880 | -H-- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\ERDNT\cache\winlogon.exe
[2008.01.21 03:24:49 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\System32\winlogon.exe
[2008.01.21 03:24:49 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2008.01.21 03:24:47 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\System32\drivers\ws2ifsl.sys
[2008.01.21 03:24:47 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6001.18000_none_4f86a0d4c7cda641\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
[2008.01.21 04:14:18 | 016,846,848 | -H-- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV
[2008.01.21 04:14:08 | 000,106,496 | -H-- | M] () -- C:\Windows\System32\config\DEFAULT.SAV
[2008.01.21 04:14:18 | 000,020,480 | -H-- | M] () -- C:\Windows\System32\config\SECURITY.SAV
[2006.11.02 11:34:08 | 010,133,504 | -H-- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV
[2006.11.02 11:34:08 | 001,826,816 | -H-- | M] () -- C:\Windows\System32\config\SYSTEM.SAV
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
[2 C:\Windows\system32\*.tmp files -> C:\Windows\system32\*.tmp -> ]
 
<          >
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 64 bytes -> C:\Users\Schatzipu\Desktop\P1040036.MOV:TOC.WMV

< End of report >
--- --- ---


Vielen Dank & liebe Grüße,
Olivia

cosinus 07.01.2012 23:48
Zitat:
[2012.01.05 21:46:47 | 000,000,000 | --SD | C] -- C:\ComboFix
[2012.01.05 21:31:51 | 000,000,000 | ---D | C] -- C:\Qoobox
Warum hast du Combofix ausgeführt? Hier stehen Dutzende Hinweise, dass du das nicht ohne Anweisung machen sollst!
Und warum verlierst du nicht ein Wort darüber? :(

Olivia81 07.01.2012 23:52
hi Arne,
sorry - habe im blindem Aktionismus einiges durchgeführt, weil einfach gar nichts mehr ging. ist es dennoch möglich, das System wieder herzustellen?
Grüße,
Olivia

cosinus 07.01.2012 23:53
POste das Log von Combofix

Olivia81 08.01.2012 00:03
Ich kann momentan auf Combofix nicht mehr zugreifen, auch das Logfile ist nicht auffindbar... gibt es jetzt noch eine Möglichkeit?
Grüße,
Olivia

cosinus 08.01.2012 01:00
c:\combofix.txt

Olivia81 08.01.2012 01:06
hallo Arne,
es ist leider nicht mehr da "die Datei kann nicht gefunden werden". habe die ganze Festplatte danach durchsucht.
Sorry nochmals.
Grüße,
Olivia

cosinus 08.01.2012 01:10
Ich brauch den Quarantäneordner von Combofix. Bitte folgendes machen:

1.) GANZ WICHTIG!! Virenscanner deaktivieren, der darf das Packen nicht beeinflussen!
2.) Ordner Quarantine in C:\Qoobox in eine Datei zippen
3.) die erstellte ZIP-Datei hier hochladen => http://www.trojaner-board.de/54791-a...ner-board.html

Hinweis: Die Datei bitte wie in der Anleitung zum UpChannel angegeben auch da hochladen. Bitte NICHT die ZIP-Datei hier als Anhang in den Thread posten!

4.) Wenns erfolgreich war Bescheid sagen
5.) Erst dann wieder den Virenscanner einschalten

Olivia81 08.01.2012 01:21
habe den Upload gerade vorgenommen.
Grüße,
Olivia

cosinus 08.01.2012 01:46
Mach mal bitte einen Rechtsklick => Eigenschaften auf C:\Qoobox
Schau wie groß der ist und poste diese Angabe

Olivia81 08.01.2012 01:50
Größe: 102 Bytes
Größe auf Datenträger: 4,00 KB
Inhalt: 1 Datei, 6 Ordner

Grüße,
Olivia

cosinus 08.01.2012 01:53
Dann lief CF anscheinend nicht richtig. Machen wir nachher nochmal vernünftig.

Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:
:OTL
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Ask.com"
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.selectedEngine: "Ask.com"
FF - prefs.js..extensions.enabledItems: ffxtlbr@Facemoods.com:1.2.1
[2011.03.27 20:51:16 | 000,000,000 | ---D | M] (Facemoods) -- C:\Users\Schatzipu\AppData\Roaming\mozilla\Firefox\Profiles\dkk0kp2n.default\extensions\ffxtlbr@Facemoods.com
[2011.07.15 20:20:40 | 000,002,397 | ---- | M] () -- C:\Users\Schatzipu\AppData\Roaming\Mozilla\Firefox\Profiles\dkk0kp2n.default\searchplugins\askcom.xml
O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O2 - BHO: (CescrtHlpr Object) - {64182481-4F71-486b-A045-B233BD0DA8FC} - C:\Programme\facemoods.com\facemoods\1.4.17.6\bh\facemoods.dll (facemoods.com BHO)
O2 - BHO: (Freeware.de Toolbar) - {7e111a5c-3d11-4f56-9463-5310c3c69025} - C:\Programme\Freeware.de\prxtbFree.dll (Conduit Ltd.)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O3 - HKCU\..\Toolbar\WebBrowser: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKCU\..\Toolbar\WebBrowser: (Freeware.de Toolbar) - {7E111A5C-3D11-4F56-9463-5310C3C69025} - C:\Programme\Freeware.de\prxtbFree.dll (Conduit Ltd.)
O4 - HKCU..\Run: [Akamai NetSession Interface] C:\Users\Schatzipu\AppData\Local\Akamai\netsession_win.exe (Akamai Technologies, Inc)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | -H-- | M] () - C:\autoexec.bat -- [ NTFS ]
[2012.01.05 20:40:07 | 000,000,000 | ---D | C] -- C:\Users\Schatzipu\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Check
:Commands
[emptytemp]
[resethosts]
Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

Olivia81 08.01.2012 02:08
Code:
All processes killed
========== OTL ==========
Prefs.js: "Ask.com" removed from browser.search.defaultengine
Prefs.js: "Ask.com" removed from browser.search.defaultenginename
Prefs.js: "Ask.com" removed from browser.search.order.1
Prefs.js: "Ask.com" removed from browser.search.selectedEngine
Prefs.js: ffxtlbr@Facemoods.com:1.2.1 removed from extensions.enabledItems
C:\Users\Schatzipu\AppData\Roaming\mozilla\Firefox\Profiles\dkk0kp2n.default\extensions\ffxtlbr@Facemoods.com\defaults\preferences folder moved successfully.
C:\Users\Schatzipu\AppData\Roaming\mozilla\Firefox\Profiles\dkk0kp2n.default\extensions\ffxtlbr@Facemoods.com\defaults folder moved successfully.
C:\Users\Schatzipu\AppData\Roaming\mozilla\Firefox\Profiles\dkk0kp2n.default\extensions\ffxtlbr@Facemoods.com\content\preferences folder moved successfully.
C:\Users\Schatzipu\AppData\Roaming\mozilla\Firefox\Profiles\dkk0kp2n.default\extensions\ffxtlbr@Facemoods.com\content\images folder moved successfully.
C:\Users\Schatzipu\AppData\Roaming\mozilla\Firefox\Profiles\dkk0kp2n.default\extensions\ffxtlbr@Facemoods.com\content folder moved successfully.
C:\Users\Schatzipu\AppData\Roaming\mozilla\Firefox\Profiles\dkk0kp2n.default\extensions\ffxtlbr@Facemoods.com\components folder moved successfully.
C:\Users\Schatzipu\AppData\Roaming\mozilla\Firefox\Profiles\dkk0kp2n.default\extensions\ffxtlbr@Facemoods.com\chrome folder moved successfully.
C:\Users\Schatzipu\AppData\Roaming\mozilla\Firefox\Profiles\dkk0kp2n.default\extensions\ffxtlbr@Facemoods.com folder moved successfully.
C:\Users\Schatzipu\AppData\Roaming\Mozilla\Firefox\Profiles\dkk0kp2n.default\searchplugins\askcom.xml moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{30F9B915-B755-4826-820B-08FBA6BD249D}\ deleted successfully.
C:\Programme\ConduitEngine\prxConduitEngine.dll moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{64182481-4F71-486b-A045-B233BD0DA8FC}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{64182481-4F71-486b-A045-B233BD0DA8FC}\ deleted successfully.
C:\Programme\facemoods.com\facemoods\1.4.17.6\bh\facemoods.dll moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7e111a5c-3d11-4f56-9463-5310c3c69025}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7e111a5c-3d11-4f56-9463-5310c3c69025}\ deleted successfully.
C:\Programme\Freeware.de\prxtbFree.dll moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}\ deleted successfully.
C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll moved successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{30F9B915-B755-4826-820B-08FBA6BD249D} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{30F9B915-B755-4826-820B-08FBA6BD249D}\ not found.
File C:\Program Files\ConduitEngine\prxConduitEngine.dll not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{47833539-D0C5-4125-9FA8-0819E2EAAC93} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{47833539-D0C5-4125-9FA8-0819E2EAAC93}\ not found.
C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll moved successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{7E111A5C-3D11-4F56-9463-5310C3C69025} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7E111A5C-3D11-4F56-9463-5310C3C69025}\ not found.
File C:\Programme\Freeware.de\prxtbFree.dll not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\Akamai NetSession Interface deleted successfully.
C:\Users\Schatzipu\AppData\Local\Akamai\netsession_win.exe moved successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
C:\autoexec.bat moved successfully.
C:\Users\Schatzipu\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Check folder moved successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: Administrator
->Temp folder emptied: 0 bytes
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Flash cache emptied: 56700 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: Gast
->Temp folder emptied: 224795 bytes
->Temporary Internet Files folder emptied: 4733360 bytes
->Flash cache emptied: 56700 bytes
 
User: Public
->Temp folder emptied: 0 bytes
 
User: Schatzipu
->Temp folder emptied: 2146785 bytes
->Temporary Internet Files folder emptied: 13249397 bytes
->Java cache emptied: 18173137 bytes
->Flash cache emptied: 3186801 bytes
 
User: Thomas
->Temp folder emptied: 0 bytes
 
User: virus
->Temp folder emptied: 31832 bytes
->Temporary Internet Files folder emptied: 59455 bytes
->Flash cache emptied: 56700 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 5694 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 1921367 bytes
RecycleBin emptied: 264386 bytes
 
Total Files Cleaned = 42,00 mb
 
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
OTL by OldTimer - Version 3.2.31.0 log created on 01082012_015827

Files\Folders moved on Reboot...
File\Folder C:\Windows\temp\TMP00000085B65C30CB6846347C not found!

Registry entries deleted on Reboot...
Grüße,
Olivia

cosinus 08.01.2012 02:17
Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten => http://www.trojaner-board.de/82358-t...entfernen.html

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.
Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition (meistens Laufwerk C:) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtkwmtcxexhp/setting...8_16-25-18.jpg


Falls du durch die Infektion auf deine Dokumente/Eigenen Dateien nicht zugreifen kannst, Verknüpfungen auf dem Desktop oder im Startmenü unter "alle Programme" fehlen, bitte unhide ausführen:
Downloade dir bitte unhide.exe und speichere diese Datei auf deinem Desktop.
Starte das Tool und es sollten alle Dateien und Ordner wieder sichtbar sein. ( Könnte eine Weile dauern )
http://www.trojaner-board.de/images/icons/icon4.gif Windows-Vista und Windows-7-User müssen das Tool per Rechtsklick als Administrator ausführen! http://www.trojaner-board.de/images/icons/icon4.gif

Olivia81 08.01.2012 02:32
hallo Arne,
ich kann den tdsskiller nicht starten, installiert ist er am desktop - doch nach doppelklick oder ausführen als administrator tut sich rein gar nichts??
Grüße,
Olivia

cosinus 08.01.2012 02:44
Probier es im abgesicherten Modus mit Netzwerk mal aus




Abgesicherter Modus zur Bereinigung
  • Windows mit F8-Taste beim Start in den abgesicherten Modus bringen.
  • Starte den Rechner in den abgesicherten Modus mit Netzwerktreibern:

    Windows im abgesicherten Modusstarten

Olivia81 08.01.2012 02:56
hallo Arne,
funktioniert leider auch nicht. gibt es eine Alternative?
Grüße,
Olivia

cosinus 08.01.2012 19:49
Wenn weder der TDSS-Killer noch CF laufen haben wir ein Problem, es können nömlich keine wichtigen Logs erstellt werden.

Probier mal bitte OSAM und aswMBR aus. OSAM ist verlinkt aswMBR ist hier eine Anleitung:

Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.
  • Starte die aswMBR.exe Vista und Win7 User aswMBR per Rechtsklick "als Administrator ausführen"
  • Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen) Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
  • Klicke auf Scan.
  • Warte bitte bis Scan finished successfully im DOS Fenster steht.
  • Drücke auf Save Log und speichere diese auf dem Desktop.
Poste mir die aswMBR.txt in deiner nächsten Antwort. Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte es erneut nicht klappen teile mir das bitte mit.

Olivia81 08.01.2012 21:02
hi Arne,
es ist leider zum Verzweifeln ... aswMBR lässt sich wie der tdsskiller nicht öffnen, ich kann das Programm installieren, ich werde gefragt, ob ich den Zugriff zulassen möchte und dann tut sich nichts mehr.

OSAM Logfile:
Code:
Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 20:58:18 on 08.01.2012

OS: Windows Vista Home Premium Edition Service Pack 1 (Build 6001), 32-bit
Default Browser: Microsoft Corporation Internet Explorer 8.00.6001.18702

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries


[Common]
-----( %SystemRoot%\Tasks )-----
"GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe

[Control Panel Objects]
-----( %SystemRoot%\system32 )-----
"DivXControlPanelApplet.cpl" - "DivX, Inc." - C:\Windows\system32\DivXControlPanelApplet.cpl
"FlashPlayerCPLApp.cpl" - "Adobe Systems Incorporated" - C:\Windows\system32\FlashPlayerCPLApp.cpl
"iproset.cpl" - "Intel(R) Corporation" - C:\Windows\system32\iproset.cpl
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"Adobe Gamma" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma.cpl
"PROSet Tools" - "Intel(R) Corporation" - C:\Windows\System32\iPROSet.cpl
"QuickTime" - "Apple Inc." - C:\Program Files\QuickTime\QTSystem\QuickTime.cpl
"ToSysCnf" - "Deutsche Telekom AG, Marmiko IT-Solutions GmbH" - C:\Program Files\T-Online\T-Online_Software_6\Basis-Software\Basis1\ToSysCnf.cpl

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"Apple Mobile USB Driver" (USBAAPL) - "Apple, Inc." - C:\Windows\System32\Drivers\usbaapl.sys
"avgntflt" (avgntflt) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avgntflt.sys
"avipbb" (avipbb) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avipbb.sys
"avkmgr" (avkmgr) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avkmgr.sys
"ElbyCDIO Driver" (ElbyCDIO) - "Elaborate Bytes AG" - C:\Windows\System32\Drivers\ElbyCDIO.sys
"IP in IP Tunnel Driver" (IpInIp) - ? - C:\Windows\System32\DRIVERS\ipinip.sys  (File not found)
"IPX Traffic Filter Driver" (NwlnkFlt) - ? - C:\Windows\System32\DRIVERS\nwlnkflt.sys  (File not found)
"IPX Traffic Forwarder Driver" (NwlnkFwd) - ? - C:\Windows\System32\DRIVERS\nwlnkfwd.sys  (File not found)
"MTOnlPktAlyX NDIS Protocol Driver" (MTOnlPktAlyX) - "Deutsche Telekom AG AG, Marmiko IT-Solutions GmbH" - C:\PROGRA~1\T-Online\T-ONLI~1\BASIS-~1\Basis1\MTOnlPktAlyX.SYS
"regi" (regi) - "InterVideo" - C:\Windows\system32\drivers\regi.sys
"Sony DMI Call service" (DMICall) - "Sony Corporation" - C:\Windows\System32\DRIVERS\DMICall.sys
"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\Windows\System32\DRIVERS\ssmdrv.sys
"WimFltr" (WimFltr) - "Microsoft Corporation" - C:\Windows\System32\DRIVERS\wimfltr.sys
"[verify-U]_System" ([verify-U]_System) - ? - C:\Windows\System32\drivers\[verify-U]-driver.sys  (File not found)

[Explorer]
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
-----( HKLM\Software\Classes\Protocols\Filter )-----
{807563E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
-----( HKLM\Software\Classes\Protocols\Handler )-----
{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
{0A9007C0-4076-11D3-8789-0000F8105754} "Microsoft Infotech Storage Protocol for IE 4.0" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll
{91774881-D725-4E58-B298-07617B9B86A8} "Skype IE add-on Pluggable Protocol" - ? - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll  (File not found)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks )-----
{AEB6717E-7E19-11d0-97EE-00C04FD91972} "{AEB6717E-7E19-11d0-97EE-00C04FD91972}" - ? -  (File not found | COM-object registry key not found)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{911051fa-c21c-4246-b470-070cd8df6dc4} ".cab or .zip files" - ? -  (File not found | COM-object registry key not found)
{D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802} "Acrobat Elements Context Menu" - "Adobe Systems Inc." - C:\Program Files\Adobe\Acrobat 8.0\Acrobat Elements\ContextMenu.dll
{1b24a030-9b20-49bc-97ac-1be4426f9e59} "ActiveDirectory Folder" - ? -  (File not found | COM-object registry key not found)
{34449847-FD14-4fc8-A75A-7432F5181EFB} "ActiveDirectory Folder" - ? -  (File not found | COM-object registry key not found)
{0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48} "Contacts folder" - ? -  (File not found | COM-object registry key not found)
{94586423-855F-4EB2-9F6A-D9DA5658DBE3} "Context menu" - ? - C:\PROGRA~1\FREEM4~1\m4a_menu.dll  (File found, but it contains no detailed information)
{2C2577C2-63A7-40e3-9B7F-586602617ECB} "Explorer Query Band" - ? -  (File not found | COM-object registry key not found)
{FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75} "IE User Assist" - ? -  (File not found | COM-object registry key not found)
{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF} "iTunes" - "Apple Inc." - C:\Program Files\iTunes\iTunesMiniPlayer.dll
{00020d75-0000-0000-c000-000000000046} "lnkfile" - ? -  (File not found | COM-object registry key not found)
{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\msohevi.dll
{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
{5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C} "Microsoft Office OneNote Namespace Extension for Windows Desktop Search" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\ONFILTER.DLL
{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
{7842554E-6BED-11D2-8CDB-B05550C10000} "Monitor Class" - "Broadcom Corporation." - C:\Windows\system32\btncopy.dll
{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4} "RealOne Player Context Menu Class" - "RealNetworks, Inc." - C:\Program Files\Real\RealPlayer\rpshell.dll
{C8494E42-ACDD-4739-B0FB-217361E4894F} "Sam Account Folder" - ? -  (File not found | COM-object registry key not found)
{E29F9716-5C08-4FCD-955A-119FDB5A522D} "Sam Account Folder" - ? -  (File not found | COM-object registry key not found)
{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira Operations GmbH & Co. KG" - C:\Program Files\Avira\AntiVir Desktop\shlext.dll
{da67b8ad-e81b-4c70-9b91b417b5e33527} "Windows Search Shell Service" - ? -  (File not found | COM-object registry key not found)
{E0D79304-84BE-11CE-9641-444553540000} "WinZip" - "WinZip Computing, S.L." - C:\Program Files\WinZip\wzshlstb.dll
{E0D79305-84BE-11CE-9641-444553540000} "WinZip" - "WinZip Computing, S.L." - C:\Program Files\WinZip\wzshlstb.dll
{E0D79306-84BE-11CE-9641-444553540000} "WinZip" - "WinZip Computing, S.L." - C:\Program Files\WinZip\wzshlstb.dll
{E0D79307-84BE-11CE-9641-444553540000} "WinZip" - "WinZip Computing, S.L." - C:\Program Files\WinZip\wzshlstb.dll

[Internet Explorer]
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
ITBar7Height "ITBar7Height" - ? -  (File not found | COM-object registry key not found)
<binary data> "ITBar7Layout" - ? -  (File not found | COM-object registry key not found)
<binary data> "{D4027C7F-154A-4066-A1AD-4243D8127440}" - ? -  (File not found | COM-object registry key not found)
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_24" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} "Java Plug-in 1.6.0_24" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_24" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_24.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
{7530BFB8-7293-4D34-9923-61A11451AFC5} "OnlineScanner Control" - "ESET" - C:\PROGRA~1\ESET\ESETON~1\ONLINE~1.OCX / hxxp://download.eset.com/special/eos/OnlineScanner.cab
{0972B098-DEE9-4279-AC7E-4BAAA029102D} "PhotoboxPhotowaysUploader5 Control" - "PhotoBox Photoways" - C:\Windows\Downloaded Program Files\ImageUploader5.ocx / hxxp://assets.photobox.com/assets/aurigma/ImageUploader5.cab?20111123062837
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
{48E73304-E1D6-4330-914C-F5F514E3486C} "An OneNote senden" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
{898EA8C8-E7FF-479B-8935-AEC46303B9E5} "Skype Click to Call" - ? - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll  (File not found)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2ssv.dll

[Logon]
-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\Users\Schatzipu\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
"Terminkalender2.lnk" - "softwarenetz.de" - C:\Softwarenetz\Terminkalender2\kalender2.exe  (Shortcut exists | File exists)
-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----
"StartupPrograms" - ? - rdpclip  (File not found)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"APSDaemon" - "Apple Inc." - "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"
"avgnt" - "Avira Operations GmbH & Co. KG" - "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
"facemoods" - "facemoods.com" - "C:\Program Files\facemoods.com\facemoods\1.4.17.6\facemoodssrv.exe" /md I
"iTunesHelper" - "Apple Inc." - "C:\Program Files\iTunes\iTunesHelper.exe"
"RIMBBLaunchAgent.exe" - "Research In Motion Limited" - C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
"ToADiMon.exe" - "Deutsche Telekom AG, Marmiko IT-Solutions GmbH" - C:\Program Files\T-Online\T-Online_Software_6\Basis-Software\Basis1\ToADiMon.exe -TOnlineAutodialStart

[Print Monitors]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----
"Send To Microsoft OneNote Monitor" - "Microsoft Corporation" - C:\Windows\system32\msonpmon.dll

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"Adobe Active File Monitor V6" (AdobeActiveFileMonitor6.0) - ? - C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe  (File found, but it contains no detailed information)
"Akamai NetSession Interface" (Akamai) - ? - c:\program files\common files\akamai\netsession_win_b427739.dll  (File found, but it contains no detailed information)
"Apple Mobile Device" (Apple Mobile Device) - "Apple Inc." - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
"Avira Echtzeit Scanner" (AntiVirService) - "Avira Operations GmbH & Co. KG" - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
"Avira Planer" (AntiVirSchedulerService) - "Avira Operations GmbH & Co. KG" - C:\Program Files\Avira\AntiVir Desktop\sched.exe
"VAIO Power Management" (VAIO Power Management) - "Sony Corporation" - C:\Program Files\Sony\VAIO Power Management\SPMService.exe
"Bluetooth Service" (btwdins) - "Broadcom Corporation." - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
"Dienst "Bonjour"" (Bonjour Service) - "Apple Inc." - C:\Program Files\Bonjour\mDNSResponder.exe
"FLEXnet Licensing Service" (FLEXnet Licensing Service) - "Acresso Software Inc." - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
"Google Software Updater" (gusvc) - "Google" - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
"Google Update Service (gupdate)" (gupdate) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"Google Update-Dienst (gupdatem)" (gupdatem) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"Intel® PROSet/Wireless Event Log" (EvtEng) - "Intel(R) Corporation" - C:\Program Files\Intel\WiFi\bin\EvtEng.exe
"Intel® PROSet/Wireless Registry Service" (RegSrvc) - "Intel(R) Corporation" - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
"iPod-Dienst" (iPod Service) - "Apple Inc." - C:\Program Files\iPod\bin\iPodService.exe
"IviRegMgr" (IviRegMgr) - "InterVideo" - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
"Microsoft Office Diagnostics Service" (odserv) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
"MSCSPTISRV" (MSCSPTISRV) - "Sony Corporation" - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
"NSUService" (NSUService) - "Sony Corporation" - C:\Program Files\Sony\Network Utility\NSUService.exe
"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"PACSPTISVR" (PACSPTISVR) - "Sony Corporation" - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
"Realtek Audio Service" (RtkAudioService) - "Realtek Semiconductor" - C:\Windows\RtkAudioService.exe
"Sony SPTI Service" (SPTISRV) - "Sony Corporation" - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
"VAIO Content Folder Watcher" (VCFw) - "Sony Corporation" - C:\Program Files\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe
"VAIO Content Metadata Intelligent Analyzing Manager" (VcmIAlzMgr) - "Sony Corporation" - C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe
"VAIO Content Metadata XML Interface" (VcmXmlIfHelper) - "Sony Corporation" - C:\Program Files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper.exe
"VAIO Entertainment Database Service" (VzCdbSvc) - "Sony Corporation" - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
"VAIO Entertainment TV Device Arbitration Service" (VAIO Entertainment TV Device Arbitration Service) - "Sony Corporation" - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzHardwareResourceManager\VzHardwareResourceManager\VzHardwareResourceManager.exe
"VAIO Entertainment UPnP Client Adapter" (Vcsw) - "Sony Corporation" - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
"VAIO Event Service" (VAIO Event Service) - "Sony Corporation" - C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
"VAIO Media plus Content Importer" (SOHCImp) - "Sony Corporation" - C:\Program Files\Sony\VAIO Media plus\SOHCImp.exe
"VAIO Media plus Device Searcher" (SOHDs) - "Sony Corporation" - C:\Program Files\Sony\VAIO Media plus\SOHDs.exe
"VAIO Media plus Digital Media Server" (SOHDms) - "Sony Corporation" - C:\Program Files\Sony\VAIO Media plus\SOHDms.exe

[Winlogon]
-----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify )-----
"VESWinlogon" - "Sony Corporation" - C:\Windows\system32\VESWinlogon.dll

[Winsock Providers]
-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries )-----
"mdnsNSP" - "Apple Inc." - C:\Program Files\Bonjour\mdnsNSP.dll

===[ Logfile end ]=========================================[ Logfile end ]===
--- --- ---

Vielen Dank nochmals für deine Hilfe. Hoffe, dass es einen Weg gibt, es noch irgendwie hinzubekommen... oder handelt es sich um einen unlösbaren Fall?
Grüße,
Olivia

cosinus 08.01.2012 21:59
Entweder haben die Schädlinge dein System zerstört oder da ist noch was aktiv.
Probier mal dein Glück hiermit: http://www.trojaner-board.de/83997-k...scue-disk.html

Nicht vergessen!! => Falls Kaspersky wenn findet die Ergebnisse in eine Textdatei auf einem Stick speichern und alles hier posten!

Olivia81 08.01.2012 23:40
Hallo Arne,
Habe die cd eingelegt, die Lizenzbedingungen mit a bestätigt und jetzt tut sich schon seit einiger zeit nichts mehr. Ist das normal oder bedeutet es, dass das System unwiederbringlich beschädigt ist?
Liebe Grüße
Olivia

Olivia81 09.01.2012 00:11
... Jetzt hat sich doch noch etwas getan, sieht nach einem längeren Scan aus...

Olivia81 09.01.2012 09:16
hi Arne,
hier das kaspersky rescue disc ergebnis:

Code:
Untersuchung von Objekten: wurde beendet vor 8 Stunden  (Ereignis: 2, Objekte: 0, Zeit: 00:00:20)       
09.01.12 00:05        Aufgabe wurde beendet                       
09.01.12 00:05        Aufgabe wurde gestartet                       
Untersuchung von Objekten: wurde abgeschlossen vor 21 Minuten  (Ereignis: 6, Objekte: 1449727, Zeit: 08:36:00)       
09.01.12 00:06        Aufgabe wurde gestartet                       
09.01.12 00:06        Gefunden: Rootkit.Boot.SST.b        /dev/sda               
09.01.12 00:06        Nicht desinfizierte Objekte: Rootkit.Boot.SST.b        /dev/sda        Zurückgestellt       
09.01.12 04:14        Gefunden: Rootkit.Boot.SST.b        /dev/sda               
09.01.12 08:42        Nicht desinfizierte Objekte: Rootkit.Boot.SST.b        /dev/sda        Vom Benutzer übersprungen       
09.01.12 08:42        Aufgabe wurde abgeschlossen
Grüße,
Olivia

cosinus 09.01.2012 11:19
Da ist ein Rootkit aktiv.

Wir sollten den MBR manuell fixen. Sichere für den Fall der Fälle alle wichtigen Daten.

Hast Du noch andere Betriebssysteme außer Vista installiert?
Wenn nicht: Schau mal hier => Vista Notfall/Recovery-CD 32-Bit - Dr. Windows

Lad das iso runter, brenn es zB mit ImgBurn per Imagebrennfunktion auf eine CD und starte damit den Rechner (von dieser CD booten)

Falls Du eine normale Vista-Installations-DVD hast, brauchst Du das o.g. Image nicht sondern kannst einfach von der Vista-DVD booten.

Klick auf Computerreparaturoptionen, weiter, Eingabeaufforderung - die Konsole öffnet sich. Da bitte bootrec.exe /fixboot eintippen (mit enter bestätigen), dann bootrec.exe /fixmbr eintippen (mit enter bestätigen) - Rechner neustarten, CD vorher rausnehmen. Führe im normalen Windowsmodus MBRcheck bzw. aswmbr (je nachdem welches Tool ich dir vorhin aufgab) und wenn es geht GMER nochmals aus und poste die neuen Logs.

Olivia81 09.01.2012 14:40
hi Arne,
habe alle Anweisungen ausgeführt.
In der Eingabeaufforderung erhalte ich bei dem ersten Befehl folgende Meldung:

"Auf dem Datenträger befindet sich kein erkanntes Dateisystem. Stellen Sie sicher, dass alle benötigten Dateisystemtreiber geladen sind und dass der Datenträger nicht beschädigt ist."

aswmbr lässt sich nach wie vor nicht starten.
Grüße,
Olivia

cosinus 09.01.2012 15:23
Na toll :balla:

Live-System PartedMagic / GParted

1. Lade Dir das ISO-Image von PartedMagic herunter, müssten ca. 180 MB sein
2. Brenn es per Imagebrennfunktion auf CD, geht zB mit ImgBurn unter Windows
3. Boote von der gebrannten CD, im Bootmenü von Option 1 starten und warten bis der Linux-Desktop oben ist

http://partedmagic.com/lib/exe/fetch...ia=desktop.png

4. Du müsstest ein Symbol PartitionEditor auf dem Desktop finden, das doppelklicken
5. Wenn das Tool die Partitionen aufgelistet hat, bitte einen Screenshot mit Hilfe der Taste DRUCK auf der Tastatur erstellen, diesen Screenshot hier posten (idR hast du einen Internetzugang mit PartedMagic, wenn nicht einfach den Screenshot auf einem Stick abspeichern und unter Windows hier posten)

Olivia81 09.01.2012 16:46
hi Arne,
habe das Iso-Image runtergeladen, weder ImgBurn noch CDBurner erkennen es als iso-file... die fehlermeldungen auf meinem laptop scheinen sich auch zu häufen, ich erhalte vom windows installer fehlermeldungen zu adobe acrobat und der internet explorer leitet mich an groupon sites weiter.
Grüße,
Olivia

cosinus 09.01.2012 16:52
Zitat:
....chip.de/downloads/5330299/pmagic_2011_11_24_i686.zip
Es ist ja auch eine ZIP und keine ISO! Dass man eine ZIP vorher entpacken muss sollte ja logisch sein.
In der ZIP ist die ISO, die muss per Imagebrennfunktion gebrannt werden

Olivia81 09.01.2012 17:25
Liste der Anhänge anzeigen (Anzahl: 1)
Hier der Screenshot!
Gruesse,
Olivia

cosinus 09.01.2012 19:17
Ahja, die dritte Partition /dev/sda3 scheint der Übeltäter zu sein.
Geh mal so vor:

1.) mit PartedMagic für den Fall der Fälle alles wichtige an Daten auf eine externe Platte sichern
2.) mit Hilfe von GParted die dritte Partition /dev/sda3 (1016 kiB, boot, hidden) löschen, Vorgang übernehmen durch einen Klick auf Apply oben rechts bei GParted
3.) Zur Kontrolle GParted beenden, nochmal starten und einen neuen Screenshot erstellen und hier posten (das GParted-Fenster darfst du ruhig größer machen!)

Olivia81 09.01.2012 20:29
Liste der Anhänge anzeigen (Anzahl: 1)
hallo Arne,
hier der neue Screenshot.
Gruesse,
Olivia

Olivia81 09.01.2012 21:57
Hallo Arne,
Ich kann das System jetzt nicht mehr hochfahren und erhalte folgende Meldung:
Operating System Not found
Grüße
Olivia

cosinus 09.01.2012 22:46
Wiederhol Schritt #30 bitte

Olivia81 09.01.2012 22:57
Erhalte die Meldung:
Element nicht gefunden.

cosinus 09.01.2012 23:01
Dann kannst du das noch probieren => Beheben und Reparieren von Startproblemen in Windows Vista mit dem Hilfsprogramm "Bootrec.exe" in der Windows-Wiederherstellungsumgebung

Olivia81 09.01.2012 23:16
Hat funktioniert, konnte das system wieder starten, avira hat jetzt im masterbootsektor von laufwerk g einen Virus BOO/TDss.O gefunden

cosinus 09.01.2012 23:20
Probier JETZT nochmal den TDSS-Killer

Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten => http://www.trojaner-board.de/82358-t...entfernen.html

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.
Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition (meistens Laufwerk C:) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtkwmtcxexhp/setting...8_16-25-18.jpg


Falls du durch die Infektion auf deine Dokumente/Eigenen Dateien nicht zugreifen kannst, Verknüpfungen auf dem Desktop oder im Startmenü unter "alle Programme" fehlen, bitte unhide ausführen:
Downloade dir bitte unhide.exe und speichere diese Datei auf deinem Desktop.
Starte das Tool und es sollten alle Dateien und Ordner wieder sichtbar sein. ( Könnte eine Weile dauern )
http://www.trojaner-board.de/images/icons/icon4.gif Windows-Vista und Windows-7-User müssen das Tool per Rechtsklick als Administrator ausführen! http://www.trojaner-board.de/images/icons/icon4.gif

Olivia81 09.01.2012 23:29
Code:
23:22:09.0114 5660        TDSS rootkit removing tool 2.6.25.0 Dec 23 2011 14:51:16
23:22:09.0426 5660        ============================================================
23:22:09.0426 5660        Current date / time: 2012/01/09 23:22:09.0426
23:22:09.0426 5660        SystemInfo:
23:22:09.0426 5660       
23:22:09.0426 5660        OS Version: 6.0.6001 ServicePack: 1.0
23:22:09.0426 5660        Product type: Workstation
23:22:09.0426 5660        ComputerName: SCHATZIPU-PC
23:22:09.0441 5660        UserName: Schatzipu
23:22:09.0441 5660        Windows directory: C:\Windows
23:22:09.0441 5660        System windows directory: C:\Windows
23:22:09.0441 5660        Processor architecture: Intel x86
23:22:09.0441 5660        Number of processors: 2
23:22:09.0441 5660        Page size: 0x1000
23:22:09.0441 5660        Boot type: Normal boot
23:22:09.0441 5660        ============================================================
23:22:10.0252 5660        Initialize success
23:24:11.0447 3524        ============================================================
23:24:11.0447 3524        Scan started
23:24:11.0447 3524        Mode: Manual;
23:24:11.0447 3524        ============================================================
23:24:12.0352 3524        ACPI            (fcb8c7210f0135e24c6580f7f649c73c) C:\Windows\system32\drivers\acpi.sys
23:24:12.0352 3524        ACPI - ok
23:24:12.0773 3524        adp94xx        (04f0fcac69c7c71a3ac4eb97fafc8303) C:\Windows\system32\drivers\adp94xx.sys
23:24:12.0804 3524        adp94xx - ok
23:24:13.0007 3524        adpahci        (60505e0041f7751bdbb80f88bf45c2ce) C:\Windows\system32\drivers\adpahci.sys
23:24:13.0023 3524        adpahci - ok
23:24:13.0070 3524        adpu160m        (8a42779b02aec986eab64ecfc98f8bd7) C:\Windows\system32\drivers\adpu160m.sys
23:24:13.0085 3524        adpu160m - ok
23:24:13.0350 3524        adpu320        (241c9e37f8ce45ef51c3de27515ca4e5) C:\Windows\system32\drivers\adpu320.sys
23:24:13.0397 3524        adpu320 - ok
23:24:13.0694 3524        AFD            (763e172a55177e478cb419f88fd0ba03) C:\Windows\system32\drivers\afd.sys
23:24:13.0740 3524        AFD - ok
23:24:13.0959 3524        agp440          (13f9e33747e6b41a3ff305c37db0d360) C:\Windows\system32\drivers\agp440.sys
23:24:13.0974 3524        agp440 - ok
23:24:14.0052 3524        aic78xx        (ae1fdf7bf7bb6c6a70f67699d880592a) C:\Windows\system32\drivers\djsvs.sys
23:24:14.0068 3524        aic78xx - ok
23:24:14.0396 3524        aliide          (9eaef5fc9b8e351afa7e78a6fae91f91) C:\Windows\system32\drivers\aliide.sys
23:24:14.0411 3524        aliide - ok
23:24:14.0754 3524        amdagp          (c47344bc706e5f0b9dce369516661578) C:\Windows\system32\drivers\amdagp.sys
23:24:14.0786 3524        amdagp - ok
23:24:14.0942 3524        amdide          (9b78a39a4c173fdbc1321e0dd659b34c) C:\Windows\system32\drivers\amdide.sys
23:24:14.0942 3524        amdide - ok
23:24:15.0051 3524        AmdK7          (18f29b49ad23ecee3d2a826c725c8d48) C:\Windows\system32\drivers\amdk7.sys
23:24:15.0066 3524        AmdK7 - ok
23:24:15.0254 3524        AmdK8          (93ae7f7dd54ab986a6f1a1b37be7442d) C:\Windows\system32\drivers\amdk8.sys
23:24:15.0300 3524        AmdK8 - ok
23:24:15.0784 3524        ApfiltrService  (9325e49d555d8f12ce1735227dbb3d80) C:\Windows\system32\DRIVERS\Apfiltr.sys
23:24:15.0800 3524        ApfiltrService - ok
23:24:16.0112 3524        arc            (5d2888182fb46632511acee92fdad522) C:\Windows\system32\drivers\arc.sys
23:24:16.0143 3524        arc - ok
23:24:16.0439 3524        arcsas          (5e2a321bd7c8b3624e41fdec3e244945) C:\Windows\system32\drivers\arcsas.sys
23:24:16.0455 3524        arcsas - ok
23:24:16.0860 3524        AsyncMac        (53b202abee6455406254444303e87be1) C:\Windows\system32\DRIVERS\asyncmac.sys
23:24:16.0876 3524        AsyncMac - ok
23:24:17.0110 3524        atapi          (2d9c903dc76a66813d350a562de40ed9) C:\Windows\system32\drivers\atapi.sys
23:24:17.0126 3524        atapi - ok
23:24:17.0890 3524        atikmdag        (9f66d1ba97911731133e46212539a08d) C:\Windows\system32\DRIVERS\atikmdag.sys
23:24:18.0420 3524        atikmdag - ok
23:24:18.0686 3524        avgntflt        (7713e4eb0276702faa08e52a6e23f2a6) C:\Windows\system32\DRIVERS\avgntflt.sys
23:24:18.0701 3524        avgntflt - ok
23:24:18.0826 3524        avipbb          (475fbb85956534720858ae72010c0a43) C:\Windows\system32\DRIVERS\avipbb.sys
23:24:18.0857 3524        avipbb - ok
23:24:19.0060 3524        avkmgr          (271cfd1a989209b1964e24d969552bf7) C:\Windows\system32\DRIVERS\avkmgr.sys
23:24:19.0076 3524        avkmgr - ok
23:24:19.0388 3524        Beep            (67e506b75bd5326a3ec7b70bd014dfb6) C:\Windows\system32\drivers\Beep.sys
23:24:19.0403 3524        Beep - ok
23:24:19.0512 3524        blbdrive        (d4df28447741fd3d953526e33a617397) C:\Windows\system32\drivers\blbdrive.sys
23:24:19.0544 3524        blbdrive - ok
23:24:19.0778 3524        bowser          (74b442b2be1260b7588c136177ceac66) C:\Windows\system32\DRIVERS\bowser.sys
23:24:19.0793 3524        bowser - ok
23:24:19.0856 3524        BrFiltLo        (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\drivers\brfiltlo.sys
23:24:19.0871 3524        BrFiltLo - ok
23:24:19.0980 3524        BrFiltUp        (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\drivers\brfiltup.sys
23:24:19.0996 3524        BrFiltUp - ok
23:24:20.0121 3524        Brserid        (b304e75cff293029eddf094246747113) C:\Windows\system32\drivers\brserid.sys
23:24:20.0121 3524        Brserid - ok
23:24:20.0261 3524        BrSerWdm        (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\system32\drivers\brserwdm.sys
23:24:20.0386 3524        BrSerWdm - ok
23:24:20.0448 3524        BrUsbMdm        (bd456606156ba17e60a04e18016ae54b) C:\Windows\system32\drivers\brusbmdm.sys
23:24:20.0464 3524        BrUsbMdm - ok
23:24:20.0667 3524        BrUsbSer        (af72ed54503f717a43268b3cc5faec2e) C:\Windows\system32\drivers\brusbser.sys
23:24:20.0667 3524        BrUsbSer - ok
23:24:20.0776 3524        BthEnum        (cce53afc28347cc18ea139972e5b5e5a) C:\Windows\system32\DRIVERS\BthEnum.sys
23:24:20.0792 3524        BthEnum - ok
23:24:21.0088 3524        BTHMODEM        (ad07c1ec6665b8b35741ab91200c6b68) C:\Windows\system32\drivers\bthmodem.sys
23:24:21.0104 3524        BTHMODEM - ok
23:24:21.0135 3524        BthPan          (5904efa25f829bf84ea6fb045134a1d8) C:\Windows\system32\DRIVERS\bthpan.sys
23:24:21.0166 3524        BthPan - ok
23:24:21.0634 3524        BTHPORT        (ac8a1689d5efc4d214201155a78d8f4b) C:\Windows\system32\Drivers\BTHport.sys
23:24:21.0665 3524        BTHPORT - ok
23:24:21.0884 3524        BTHUSB          (288c1f74e3e2eed6c7b54eb3aac70856) C:\Windows\system32\Drivers\BTHUSB.sys
23:24:21.0884 3524        BTHUSB - ok
23:24:21.0977 3524        btwaudio        (ed97cd06ef748004b8aac56c2d0aa5db) C:\Windows\system32\drivers\btwaudio.sys
23:24:21.0993 3524        btwaudio - ok
23:24:22.0289 3524        btwavdt        (4871b5ed4757197135ff65be61da44b3) C:\Windows\system32\drivers\btwavdt.sys
23:24:22.0336 3524        btwavdt - ok
23:24:22.0648 3524        btwl2cap        (6af9fd2aeebdc16a98d3e30e68440c5c) C:\Windows\system32\DRIVERS\btwl2cap.sys
23:24:22.0679 3524        btwl2cap - ok
23:24:22.0726 3524        btwrchid        (f5da7df99cf11fcb68e2bea12002f63a) C:\Windows\system32\DRIVERS\btwrchid.sys
23:24:22.0742 3524        btwrchid - ok
23:24:23.0007 3524        cdfs            (7add03e75beb9e6dd102c3081d29840a) C:\Windows\system32\DRIVERS\cdfs.sys
23:24:23.0022 3524        cdfs - ok
23:24:23.0069 3524        cdrom          (1ec25cea0de6ac4718bf89f9e1778b57) C:\Windows\system32\DRIVERS\cdrom.sys
23:24:23.0069 3524        cdrom - ok
23:24:23.0272 3524        circlass        (e5d4133f37219dbcfe102bc61072589d) C:\Windows\system32\drivers\circlass.sys
23:24:23.0272 3524        circlass - ok
23:24:23.0381 3524        CLFS            (465745561c832b29f7c48b488aab3842) C:\Windows\system32\CLFS.sys
23:24:23.0397 3524        CLFS - ok
23:24:23.0615 3524        CmBatt          (99afc3795b58cc478fbbbcdc658fcb56) C:\Windows\system32\DRIVERS\CmBatt.sys
23:24:23.0631 3524        CmBatt - ok
23:24:23.0678 3524        cmdide          (0ca25e686a4928484e9fdabd168ab629) C:\Windows\system32\drivers\cmdide.sys
23:24:23.0693 3524        cmdide - ok
23:24:23.0865 3524        Compbatt        (6afef0b60fa25de07c0968983ee4f60a) C:\Windows\system32\DRIVERS\compbatt.sys
23:24:23.0880 3524        Compbatt - ok
23:24:24.0130 3524        crcdisk        (741e9dff4f42d2d8477d0fc1dc0df871) C:\Windows\system32\drivers\crcdisk.sys
23:24:24.0130 3524        crcdisk - ok
23:24:24.0270 3524        Crusoe          (1f07becdca750766a96cda811ba86410) C:\Windows\system32\drivers\crusoe.sys
23:24:24.0286 3524        Crusoe - ok
23:24:24.0567 3524        DfsC            (9e635ae5e8ad93e2b5989e2e23679f97) C:\Windows\system32\Drivers\dfsc.sys
23:24:24.0582 3524        DfsC - ok
23:24:24.0816 3524        disk            (64109e623abd6955c8fb110b592e68b7) C:\Windows\system32\drivers\disk.sys
23:24:24.0832 3524        disk - ok
23:24:25.0082 3524        DMICall        (f206e28ed74c491fd5d7c0a1119ce37f) C:\Windows\system32\DRIVERS\DMICall.sys
23:24:25.0113 3524        DMICall - ok
23:24:25.0347 3524        drmkaud        (97fef831ab90bee128c9af390e243f80) C:\Windows\system32\drivers\drmkaud.sys
23:24:25.0362 3524        drmkaud - ok
23:24:25.0456 3524        DXGKrnl        (85f33880b8cfb554bd3d9ccdb486845a) C:\Windows\System32\drivers\dxgkrnl.sys
23:24:25.0456 3524        DXGKrnl - ok
23:24:25.0706 3524        E1G60          (5425f74ac0c1dbd96a1e04f17d63f94c) C:\Windows\system32\DRIVERS\E1G60I32.sys
23:24:25.0721 3524        E1G60 - ok
23:24:25.0924 3524        Ecache          (dd2cd259d83d8b72c02c5f2331ff9d68) C:\Windows\system32\drivers\ecache.sys
23:24:25.0955 3524        Ecache - ok
23:24:26.0018 3524        ElbyCDIO        (178cc9403816c082d22a1d47fa1f9c85) C:\Windows\system32\Drivers\ElbyCDIO.sys
23:24:26.0033 3524        ElbyCDIO - ok
23:24:26.0220 3524        elxstor        (23b62471681a124889978f6295b3f4c6) C:\Windows\system32\drivers\elxstor.sys
23:24:26.0252 3524        elxstor - ok
23:24:26.0314 3524        ErrDev          (3db974f3935483555d7148663f726c61) C:\Windows\system32\drivers\errdev.sys
23:24:26.0330 3524        ErrDev - ok
23:24:26.0751 3524        exfat          (0d858eb20589a34efb25695acaa6aa2d) C:\Windows\system32\drivers\exfat.sys
23:24:26.0766 3524        exfat - ok
23:24:26.0907 3524        fastfat        (3c489390c2e2064563727752af8eab9e) C:\Windows\system32\drivers\fastfat.sys
23:24:26.0922 3524        fastfat - ok
23:24:27.0156 3524        fdc            (afe1e8b9782a0dd7fb46bbd88e43f89a) C:\Windows\system32\DRIVERS\fdc.sys
23:24:27.0156 3524        fdc - ok
23:24:27.0406 3524        FileInfo        (a8c0139a884861e3aae9cfe73b208a9f) C:\Windows\system32\drivers\fileinfo.sys
23:24:27.0422 3524        FileInfo - ok
23:24:27.0532 3524        Filetrace      (0ae429a696aecbc5970e3cf2c62635ae) C:\Windows\system32\drivers\filetrace.sys
23:24:27.0579 3524        Filetrace - ok
23:24:27.0875 3524        flpydisk        (85b7cf99d532820495d68d747fda9ebd) C:\Windows\system32\DRIVERS\flpydisk.sys
23:24:27.0891 3524        flpydisk - ok
23:24:28.0109 3524        FltMgr          (05ea53afe985443011e36dab07343b46) C:\Windows\system32\drivers\fltmgr.sys
23:24:28.0156 3524        FltMgr - ok
23:24:28.0187 3524        Fs_Rec          (65ea8b77b5851854f0c55c43fa51a198) C:\Windows\system32\drivers\Fs_Rec.sys
23:24:28.0203 3524        Fs_Rec - ok
23:24:28.0249 3524        gagp30kx        (34582a6e6573d54a07ece5fe24a126b5) C:\Windows\system32\drivers\gagp30kx.sys
23:24:28.0265 3524        gagp30kx - ok
23:24:28.0499 3524        GEARAspiWDM    (8182ff89c65e4d38b2de4bb0fb18564e) C:\Windows\system32\DRIVERS\GEARAspiWDM.sys
23:24:28.0515 3524        GEARAspiWDM - ok
23:24:28.0827 3524        HdAudAddService (cb04c744be0a61b1d648faed182c3b59) C:\Windows\system32\drivers\HdAudio.sys
23:24:28.0858 3524        HdAudAddService - ok
23:24:28.0889 3524        HDAudBus        (c87b1ee051c0464491c1a7b03fa0bc99) C:\Windows\system32\DRIVERS\HDAudBus.sys
23:24:28.0889 3524        HDAudBus - ok
23:24:29.0107 3524        HidBth          (1338520e78d90154ed6be8f84de5fceb) C:\Windows\system32\drivers\hidbth.sys
23:24:29.0123 3524        HidBth - ok
23:24:29.0170 3524        HidIr          (ff3160c3a2445128c5a6d9b076da519e) C:\Windows\system32\drivers\hidir.sys
23:24:29.0185 3524        HidIr - ok
23:24:29.0388 3524        HidUsb          (e2b5bd48afcc0f0974fb44641b223250) C:\Windows\system32\DRIVERS\hidusb.sys
23:24:29.0404 3524        HidUsb - ok
23:24:29.0466 3524        HpCISSs        (16ee7b23a009e00d835cdb79574a91a6) C:\Windows\system32\drivers\hpcisss.sys
23:24:29.0497 3524        HpCISSs - ok
23:24:29.0685 3524        HSFHWAZL        (46d67209550973257601a533e2ac5785) C:\Windows\system32\DRIVERS\VSTAZL3.SYS
23:24:29.0716 3524        HSFHWAZL - ok
23:24:29.0950 3524        HSF_DPV        (7bc42c65b5c6281777c1a7605b253ba8) C:\Windows\system32\DRIVERS\HSX_DPV.sys
23:24:30.0028 3524        HSF_DPV - ok
23:24:30.0309 3524        HSXHWAZL        (9ebf2d102ccbb6bcdfbf1b7922f8ba2e) C:\Windows\system32\DRIVERS\HSXHWAZL.sys
23:24:30.0340 3524        HSXHWAZL - ok
23:24:30.0589 3524        HTTP            (96e241624c71211a79c84f50a8e71cab) C:\Windows\system32\drivers\HTTP.sys
23:24:30.0636 3524        HTTP - ok
23:24:30.0870 3524        i2omp          (c6b032d69650985468160fc9937cf5b4) C:\Windows\system32\drivers\i2omp.sys
23:24:30.0886 3524        i2omp - ok
23:24:31.0089 3524        i8042prt        (22d56c8184586b7a1f6fa60be5f5a2bd) C:\Windows\system32\DRIVERS\i8042prt.sys
23:24:31.0120 3524        i8042prt - ok
23:24:31.0167 3524        iaStor          (db0cc620b27a928d968c1a1e9cd9cb87) C:\Windows\system32\DRIVERS\iaStor.sys
23:24:31.0167 3524        iaStor - ok
23:24:31.0401 3524        iaStorV        (54155ea1b0df185878e0fc9ec3ac3a14) C:\Windows\system32\drivers\iastorv.sys
23:24:31.0447 3524        iaStorV - ok
23:24:31.0635 3524        iirsp          (2d077bf86e843f901d8db709c95b49a5) C:\Windows\system32\drivers\iirsp.sys
23:24:31.0650 3524        iirsp - ok
23:24:31.0931 3524        IntcAzAudAddService (4a0f260df9a5333c07f4ab40ca9d4f4b) C:\Windows\system32\drivers\RTKVHDA.sys
23:24:31.0993 3524        IntcAzAudAddService - ok
23:24:32.0259 3524        intelide        (83aa759f3189e6370c30de5dc5590718) C:\Windows\system32\drivers\intelide.sys
23:24:32.0274 3524        intelide - ok
23:24:32.0305 3524        intelppm        (224191001e78c89dfa78924c3ea595ff) C:\Windows\system32\DRIVERS\intelppm.sys
23:24:32.0305 3524        intelppm - ok
23:24:32.0446 3524        IpFilterDriver  (62c265c38769b864cb25b4bcf62df6c3) C:\Windows\system32\DRIVERS\ipfltdrv.sys
23:24:32.0461 3524        IpFilterDriver - ok
23:24:32.0493 3524        IpInIp - ok
23:24:32.0539 3524        IPMIDRV        (b25aaf203552b7b3491139d582b39ad1) C:\Windows\system32\drivers\ipmidrv.sys
23:24:32.0617 3524        IPMIDRV - ok
23:24:32.0695 3524        IPNAT          (8793643a67b42cec66490b2a0cf92d68) C:\Windows\system32\DRIVERS\ipnat.sys
23:24:32.0711 3524        IPNAT - ok
23:24:32.0914 3524        IRENUM          (109c0dfb82c3632fbd11949b73aeeac9) C:\Windows\system32\drivers\irenum.sys
23:24:32.0929 3524        IRENUM - ok
23:24:32.0976 3524        isapnp          (6c70698a3e5c4376c6ab5c7c17fb0614) C:\Windows\system32\drivers\isapnp.sys
23:24:32.0992 3524        isapnp - ok
23:24:33.0335 3524        iScsiPrt        (f247eec28317f6c739c16de420097301) C:\Windows\system32\DRIVERS\msiscsi.sys
23:24:33.0351 3524        iScsiPrt - ok
23:24:33.0507 3524        iteatapi        (bced60d16156e428f8df8cf27b0df150) C:\Windows\system32\drivers\iteatapi.sys
23:24:33.0522 3524        iteatapi - ok
23:24:33.0631 3524        iteraid        (06fa654504a498c30adca8bec4e87e7e) C:\Windows\system32\drivers\iteraid.sys
23:24:33.0647 3524        iteraid - ok
23:24:33.0787 3524        kbdclass        (37605e0a8cf00cbba538e753e4344c6e) C:\Windows\system32\DRIVERS\kbdclass.sys
23:24:33.0787 3524        kbdclass - ok
23:24:33.0959 3524        kbdhid          (18247836959ba67e3511b62846b9c2e0) C:\Windows\system32\DRIVERS\kbdhid.sys
23:24:33.0975 3524        kbdhid - ok
23:24:34.0224 3524        KSecDD          (7a0cf7908b6824d6a2a1d313e5ae3dca) C:\Windows\system32\Drivers\ksecdd.sys
23:24:34.0287 3524        KSecDD - ok
23:24:34.0396 3524        lltdio          (d1c5883087a0c3f1344d9d55a44901f6) C:\Windows\system32\DRIVERS\lltdio.sys
23:24:34.0443 3524        lltdio - ok
23:24:34.0692 3524        LSI_FC          (c7e15e82879bf3235b559563d4185365) C:\Windows\system32\drivers\lsi_fc.sys
23:24:34.0708 3524        LSI_FC - ok
23:24:34.0942 3524        LSI_SAS        (ee01ebae8c9bf0fa072e0ff68718920a) C:\Windows\system32\drivers\lsi_sas.sys
23:24:34.0973 3524        LSI_SAS - ok
23:24:35.0067 3524        LSI_SCSI        (912a04696e9ca30146a62afa1463dd5c) C:\Windows\system32\drivers\lsi_scsi.sys
23:24:35.0082 3524        LSI_SCSI - ok
23:24:35.0191 3524        luafv          (8f5c7426567798e62a3b3614965d62cc) C:\Windows\system32\drivers\luafv.sys
23:24:35.0207 3524        luafv - ok
23:24:35.0472 3524        mdmxsdk        (0cea2d0d3fa284b85ed5b68365114f76) C:\Windows\system32\DRIVERS\mdmxsdk.sys
23:24:35.0488 3524        mdmxsdk - ok
23:24:35.0628 3524        megasas        (0001ce609d66632fa17b84705f658879) C:\Windows\system32\drivers\megasas.sys
23:24:35.0628 3524        megasas - ok
23:24:35.0815 3524        MegaSR          (c252f32cd9a49dbfc25ecf26ebd51a99) C:\Windows\system32\drivers\megasr.sys
23:24:35.0862 3524        MegaSR - ok
23:24:36.0081 3524        Modem          (e13b5ea0f51ba5b1512ec671393d09ba) C:\Windows\system32\drivers\modem.sys
23:24:36.0112 3524        Modem - ok
23:24:36.0205 3524        monitor        (0a9bb33b56e294f686abb7c1e4e2d8a8) C:\Windows\system32\DRIVERS\monitor.sys
23:24:36.0205 3524        monitor - ok
23:24:36.0361 3524        mouclass        (5bf6a1326a335c5298477754a506d263) C:\Windows\system32\DRIVERS\mouclass.sys
23:24:36.0393 3524        mouclass - ok
23:24:36.0455 3524        mouhid          (93b8d4869e12cfbe663915502900876f) C:\Windows\system32\drivers\mouhid.sys
23:24:36.0471 3524        mouhid - ok
23:24:36.0642 3524        MountMgr        (bdafc88aa6b92f7842416ea6a48e1600) C:\Windows\system32\drivers\mountmgr.sys
23:24:36.0673 3524        MountMgr - ok
23:24:36.0751 3524        mpio            (511d011289755dd9f9a7579fb0b064e6) C:\Windows\system32\drivers\mpio.sys
23:24:36.0783 3524        mpio - ok
23:24:36.0970 3524        mpsdrv          (22241feba9b2defa669c8cb0a8dd7d2e) C:\Windows\system32\drivers\mpsdrv.sys
23:24:36.0985 3524        mpsdrv - ok
23:24:37.0063 3524        Mraid35x        (4fbbb70d30fd20ec51f80061703b001e) C:\Windows\system32\drivers\mraid35x.sys
23:24:37.0079 3524        Mraid35x - ok
23:24:37.0266 3524        MRxDAV          (ae3de84536b6799d2267443cec8edbb9) C:\Windows\system32\drivers\mrxdav.sys
23:24:37.0297 3524        MRxDAV - ok
23:24:37.0360 3524        mrxsmb          (7afc42e60432fd1014f5342f2b1b1f74) C:\Windows\system32\DRIVERS\mrxsmb.sys
23:24:37.0375 3524        mrxsmb - ok
23:24:37.0453 3524        mrxsmb10        (8a75752ae17924f65452746674b14b78) C:\Windows\system32\DRIVERS\mrxsmb10.sys
23:24:37.0500 3524        mrxsmb10 - ok
23:24:37.0547 3524        mrxsmb20        (f4d0f3252e651f02be64984ffa738394) C:\Windows\system32\DRIVERS\mrxsmb20.sys
23:24:37.0578 3524        mrxsmb20 - ok
23:24:37.0750 3524        msahci          (28023e86f17001f7cd9b15a5bc9ae07d) C:\Windows\system32\drivers\msahci.sys
23:24:37.0750 3524        msahci - ok
23:24:37.0875 3524        msdsm          (4468b0f385a86ecddaf8d3ca662ec0e7) C:\Windows\system32\drivers\msdsm.sys
23:24:37.0890 3524        msdsm - ok
23:24:38.0015 3524        Msfs            (a9927f4a46b816c92f461acb90cf8515) C:\Windows\system32\drivers\Msfs.sys
23:24:38.0031 3524        Msfs - ok
23:24:38.0140 3524        msisadrv        (0f400e306f385c56317357d6dea56f62) C:\Windows\system32\drivers\msisadrv.sys
23:24:38.0140 3524        msisadrv - ok
23:24:38.0296 3524        MSKSSRV        (d8c63d34d9c9e56c059e24ec7185cc07) C:\Windows\system32\drivers\MSKSSRV.sys
23:24:38.0311 3524        MSKSSRV - ok
23:24:38.0483 3524        MSPCLOCK        (1d373c90d62ddb641d50e55b9e78d65e) C:\Windows\system32\drivers\MSPCLOCK.sys
23:24:38.0514 3524        MSPCLOCK - ok
23:24:38.0670 3524        MSPQM          (b572da05bf4e098d4bba3a4734fb505b) C:\Windows\system32\drivers\MSPQM.sys
23:24:38.0670 3524        MSPQM - ok
23:24:38.0701 3524        MsRPC          (b5614aecb05a9340aa0fb55bf561cc63) C:\Windows\system32\drivers\MsRPC.sys
23:24:38.0717 3524        MsRPC - ok
23:24:38.0935 3524        mssmbios        (e384487cb84be41d09711c30ca79646c) C:\Windows\system32\DRIVERS\mssmbios.sys
23:24:38.0935 3524        mssmbios - ok
23:24:39.0076 3524        MSTEE          (7199c1eec1e4993caf96b8c0a26bd58a) C:\Windows\system32\drivers\MSTEE.sys
23:24:39.0091 3524        MSTEE - ok
23:24:39.0294 3524        MTOnlPktAlyX    (036300114255b3c78bfb616ce8bc7ad9) C:\PROGRA~1\T-Online\T-ONLI~1\BASIS-~1\Basis1\MTOnlPktAlyX.SYS
23:24:39.0310 3524        MTOnlPktAlyX - ok
23:24:39.0435 3524        Mup            (6dfd1d322de55b0b7db7d21b90bec49c) C:\Windows\system32\Drivers\mup.sys
23:24:39.0450 3524        Mup - ok
23:24:39.0856 3524        NativeWifiP    (3c21ce48ff529bb73dadb98770b54025) C:\Windows\system32\DRIVERS\nwifi.sys
23:24:39.0871 3524        NativeWifiP - ok
23:24:40.0090 3524        NDIS            (9bdc71790fa08f0a0b5f10462b1bd0b1) C:\Windows\system32\drivers\ndis.sys
23:24:40.0090 3524        NDIS - ok
23:24:40.0183 3524        NdisTapi        (0e186e90404980569fb449ba7519ae61) C:\Windows\system32\DRIVERS\ndistapi.sys
23:24:40.0199 3524        NdisTapi - ok
23:24:40.0355 3524        Ndisuio        (d6973aa34c4d5d76c0430b181c3cd389) C:\Windows\system32\DRIVERS\ndisuio.sys
23:24:40.0371 3524        Ndisuio - ok
23:24:40.0449 3524        NdisWan        (3d14c3b3496f88890d431e8aa022a411) C:\Windows\system32\DRIVERS\ndiswan.sys
23:24:40.0464 3524        NdisWan - ok
23:24:40.0714 3524        NDProxy        (71dab552b41936358f3b541ae5997fb3) C:\Windows\system32\drivers\NDProxy.sys
23:24:40.0729 3524        NDProxy - ok
23:24:40.0792 3524        NetBIOS        (bcd093a5a6777cf626434568dc7dba78) C:\Windows\system32\DRIVERS\netbios.sys
23:24:40.0807 3524        NetBIOS - ok
23:24:40.0995 3524        netbt          (7c5fee5b1c5728507cd96fb4a13e7a02) C:\Windows\system32\DRIVERS\netbt.sys
23:24:41.0026 3524        netbt - ok
23:24:41.0260 3524        NETw5v32        (e559ea9138c77b5d1fda8c558764a25f) C:\Windows\system32\DRIVERS\NETw5v32.sys
23:24:41.0416 3524        NETw5v32 - ok
23:24:41.0634 3524        nfrd960        (2e7fb731d4790a1bc6270accefacb36e) C:\Windows\system32\drivers\nfrd960.sys
23:24:41.0650 3524        nfrd960 - ok
23:24:41.0915 3524        Npfs            (ecb5003f484f9ed6c608d6d6c7886cbb) C:\Windows\system32\drivers\Npfs.sys
23:24:41.0915 3524        Npfs - ok
23:24:42.0165 3524        nsiproxy        (609773e344a97410ce4ebf74a8914fcf) C:\Windows\system32\drivers\nsiproxy.sys
23:24:42.0165 3524        nsiproxy - ok
23:24:42.0492 3524        Ntfs            (b4effe29eb4f15538fd8a9681108492d) C:\Windows\system32\drivers\Ntfs.sys
23:24:42.0555 3524        Ntfs - ok
23:24:42.0742 3524        ntrigdigi      (e875c093aec0c978a90f30c9e0dfbb72) C:\Windows\system32\drivers\ntrigdigi.sys
23:24:42.0789 3524        ntrigdigi - ok
23:24:42.0929 3524        Null            (c5dbbcda07d780bda9b685df333bb41e) C:\Windows\system32\drivers\Null.sys
23:24:42.0929 3524        Null - ok
23:24:43.0272 3524        nvraid          (2edf9e7751554b42cbb60116de727101) C:\Windows\system32\drivers\nvraid.sys
23:24:43.0288 3524        nvraid - ok
23:24:43.0491 3524        nvstor          (abed0c09758d1d97db0042dbb2688177) C:\Windows\system32\drivers\nvstor.sys
23:24:43.0506 3524        nvstor - ok
23:24:43.0553 3524        nv_agp          (18bbdf913916b71bd54575bdb6eeac0b) C:\Windows\system32\drivers\nv_agp.sys
23:24:43.0584 3524        nv_agp - ok
23:24:43.0725 3524        NwlnkFlt - ok
23:24:43.0740 3524        NwlnkFwd - ok
23:24:43.0818 3524        ohci1394        (790e27c3db53410b40ff9ef2fd10a1d9) C:\Windows\system32\DRIVERS\ohci1394.sys
23:24:43.0818 3524        ohci1394 - ok
23:24:43.0896 3524        Parport        (0fa9b5055484649d63c303fe404e5f4d) C:\Windows\system32\drivers\parport.sys
23:24:43.0912 3524        Parport - ok
23:24:44.0115 3524        partmgr        (3b38467e7c3daed009dfe359e17f139f) C:\Windows\system32\drivers\partmgr.sys
23:24:44.0161 3524        partmgr - ok
23:24:44.0427 3524        Parvdm          (4f9a6a8a31413180d0fcb279ad5d8112) C:\Windows\system32\drivers\parvdm.sys
23:24:44.0427 3524        Parvdm - ok
23:24:44.0583 3524        pci            (01b94418deb235dff777cc80076354b4) C:\Windows\system32\drivers\pci.sys
23:24:44.0598 3524        pci - ok
23:24:44.0785 3524        pciide          (fc175f5ddab666d7f4d17449a547626f) C:\Windows\system32\drivers\pciide.sys
23:24:44.0801 3524        pciide - ok
23:24:44.0957 3524        pcmcia          (e6f3fb1b86aa519e7698ad05e58b04e5) C:\Windows\system32\drivers\pcmcia.sys
23:24:45.0004 3524        pcmcia - ok
23:24:45.0238 3524        PEAUTH          (6349f6ed9c623b44b52ea3c63c831a92) C:\Windows\system32\drivers\peauth.sys
23:24:45.0316 3524        PEAUTH - ok
23:24:45.0659 3524        PptpMiniport    (ecfffaec0c1ecd8dbc77f39070ea1db1) C:\Windows\system32\DRIVERS\raspptp.sys
23:24:45.0675 3524        PptpMiniport - ok
23:24:45.0753 3524        Processor      (2027293619dd0f047c584cf2e7df4ffd) C:\Windows\system32\drivers\processr.sys
23:24:45.0784 3524        Processor - ok
23:24:45.0893 3524        PSched          (bfef604508a0ed1eae2a73e872555ffb) C:\Windows\system32\DRIVERS\pacer.sys
23:24:45.0909 3524        PSched - ok
23:24:46.0002 3524        PxHelp20        (153d02480a0a2f45785522e814c634b6) C:\Windows\system32\Drivers\PxHelp20.sys
23:24:46.0033 3524        PxHelp20 - ok
23:24:46.0361 3524        ql2300          (0a6db55afb7820c99aa1f3a1d270f4f6) C:\Windows\system32\drivers\ql2300.sys
23:24:46.0423 3524        ql2300 - ok
23:24:46.0626 3524        ql40xx          (81a7e5c076e59995d54bc1ed3a16e60b) C:\Windows\system32\drivers\ql40xx.sys
23:24:46.0642 3524        ql40xx - ok
23:24:46.0829 3524        QWAVEdrv        (9f5e0e1926014d17486901c88eca2db7) C:\Windows\system32\drivers\qwavedrv.sys
23:24:46.0829 3524        QWAVEdrv - ok
23:24:46.0891 3524        RasAcd          (147d7f9c556d259924351feb0de606c3) C:\Windows\system32\DRIVERS\rasacd.sys
23:24:46.0907 3524        RasAcd - ok
23:24:47.0016 3524        Rasl2tp        (a214adbaf4cb47dd2728859ef31f26b0) C:\Windows\system32\DRIVERS\rasl2tp.sys
23:24:47.0032 3524        Rasl2tp - ok
23:24:47.0250 3524        RasPppoe        (3e9d9b048107b40d87b97df2e48e0744) C:\Windows\system32\DRIVERS\raspppoe.sys
23:24:47.0297 3524        RasPppoe - ok
23:24:47.0593 3524        RasSstp        (a7d141684e9500ac928a772ed8e6b671) C:\Windows\system32\DRIVERS\rassstp.sys
23:24:47.0609 3524        RasSstp - ok
23:24:47.0781 3524        rdbss          (6e1c5d0457622f9ee35f683110e93d14) C:\Windows\system32\DRIVERS\rdbss.sys
23:24:47.0812 3524        rdbss - ok
23:24:47.0968 3524        RDPCDD          (89e59be9a564262a3fb6c4f4f1cd9899) C:\Windows\system32\DRIVERS\RDPCDD.sys
23:24:47.0968 3524        RDPCDD - ok
23:24:48.0186 3524        rdpdr          (fbc0bacd9c3d7f6956853f64a66e252d) C:\Windows\system32\drivers\rdpdr.sys
23:24:48.0233 3524        rdpdr - ok
23:24:48.0280 3524        RDPENCDD        (9d91fe5286f748862ecffa05f8a0710c) C:\Windows\system32\drivers\rdpencdd.sys
23:24:48.0295 3524        RDPENCDD - ok
23:24:48.0498 3524        RDPWD          (e1c18f4097a5abcec941dc4b2f99db7e) C:\Windows\system32\drivers\RDPWD.sys
23:24:48.0529 3524        RDPWD - ok
23:24:48.0592 3524        regi            (001b4278407f4303efc902a2b16f2453) C:\Windows\system32\drivers\regi.sys
23:24:48.0592 3524        regi - ok
23:24:48.0795 3524        RFCOMM          (23f486726da7a9b2f3ec7326421a9c36) C:\Windows\system32\DRIVERS\rfcomm.sys
23:24:48.0810 3524        RFCOMM - ok
23:24:48.0873 3524        rimsptsk        (d0c2a0ce1091e08efb7ccba6cea4c3f9) C:\Windows\system32\DRIVERS\rimsptsk.sys
23:24:48.0873 3524        rimsptsk - ok
23:24:49.0122 3524        RimUsb          (616eac1b0e48b236a5a9b8ae07fdb81c) C:\Windows\system32\Drivers\RimUsb.sys
23:24:49.0138 3524        RimUsb - ok
23:24:49.0372 3524        RimVSerPort    (2c4fb2e9f039287767c384e46ee91030) C:\Windows\system32\DRIVERS\RimSerial.sys
23:24:49.0387 3524        RimVSerPort - ok
23:24:49.0434 3524        risdptsk        (c22e4e27ccdf9aa5fe8143104f28cde3) C:\Windows\system32\DRIVERS\risdptsk.sys
23:24:49.0434 3524        risdptsk - ok
23:24:49.0621 3524        ROOTMODEM      (75e8a6bfa7374aba833ae92bf41ae4e6) C:\Windows\system32\Drivers\RootMdm.sys
23:24:49.0621 3524        ROOTMODEM - ok
23:24:49.0668 3524        rspndr          (9c508f4074a39e8b4b31d27198146fad) C:\Windows\system32\DRIVERS\rspndr.sys
23:24:49.0699 3524        rspndr - ok
23:24:49.0902 3524        RTHDMIAzAudService (39c5c2fbf652c9f8c194873d5c8a1f58) C:\Windows\system32\drivers\RtHDMIV.sys
23:24:49.0933 3524        RTHDMIAzAudService - ok
23:24:50.0152 3524        sbp2port        (3ce8f073a557e172b330109436984e30) C:\Windows\system32\drivers\sbp2port.sys
23:24:50.0183 3524        sbp2port - ok
23:24:50.0277 3524        sdbus          (126ea89bcc413ee45e3004fb0764888f) C:\Windows\system32\DRIVERS\sdbus.sys
23:24:50.0277 3524        sdbus - ok
23:24:50.0495 3524        secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys
23:24:50.0495 3524        secdrv - ok
23:24:50.0713 3524        Serenum        (68e44e331d46f0fb38f0863a84cd1a31) C:\Windows\system32\drivers\serenum.sys
23:24:50.0713 3524        Serenum - ok
23:24:50.0760 3524        Serial          (c70d69a918b178d3c3b06339b40c2e1b) C:\Windows\system32\drivers\serial.sys
23:24:50.0776 3524        Serial - ok
23:24:50.0869 3524        sermouse        (8af3d28a879bf75db53a0ee7a4289624) C:\Windows\system32\drivers\sermouse.sys
23:24:50.0885 3524        sermouse - ok
23:24:51.0135 3524        SFEP            (8b7c1768d2cde2e02e09a66563ddfd16) C:\Windows\system32\DRIVERS\SFEP.sys
23:24:51.0135 3524        SFEP - ok
23:24:51.0228 3524        sffdisk        (3efa810bdca87f6ecc24f9832243fe86) C:\Windows\system32\drivers\sffdisk.sys
23:24:51.0228 3524        sffdisk - ok
23:24:51.0415 3524        sffp_mmc        (e95d451f7ea3e583aec75f3b3ee42dc5) C:\Windows\system32\drivers\sffp_mmc.sys
23:24:51.0431 3524        sffp_mmc - ok
23:24:51.0493 3524        sffp_sd        (3d0ea348784b7ac9ea9bd9f317980979) C:\Windows\system32\drivers\sffp_sd.sys
23:24:51.0525 3524        sffp_sd - ok
23:24:51.0759 3524        sfloppy        (c33bfbd6e9e41fcd9ffef9729e9faed6) C:\Windows\system32\DRIVERS\sfloppy.sys
23:24:51.0790 3524        sfloppy - ok
23:24:51.0868 3524        sisagp          (1d76624a09a054f682d746b924e2dbc3) C:\Windows\system32\drivers\sisagp.sys
23:24:51.0883 3524        sisagp - ok
23:24:52.0071 3524        SiSRaid2        (43cb7aa756c7db280d01da9b676cfde2) C:\Windows\system32\drivers\sisraid2.sys
23:24:52.0086 3524        SiSRaid2 - ok
23:24:52.0149 3524        SiSRaid4        (a99c6c8b0baa970d8aa59ddc50b57f94) C:\Windows\system32\drivers\sisraid4.sys
23:24:52.0164 3524        SiSRaid4 - ok
23:24:52.0367 3524        Smb            (031e6bcd53c9b2b9ace111eafec347b6) C:\Windows\system32\DRIVERS\smb.sys
23:24:52.0398 3524        Smb - ok
23:24:52.0523 3524        spldr          (7aebdeef071fe28b0eef2cdd69102bff) C:\Windows\system32\drivers\spldr.sys
23:24:52.0570 3524        spldr - ok
23:24:52.0788 3524        srv            (5754e8bae40943871d0ab9becbf335e8) C:\Windows\system32\DRIVERS\srv.sys
23:24:52.0804 3524        srv - ok
23:24:53.0007 3524        srv2            (d47b09ff7d28ee44d728f57c2d1fab86) C:\Windows\system32\DRIVERS\srv2.sys
23:24:53.0038 3524        srv2 - ok
23:24:53.0069 3524        srvnet          (32d52290341a740881521e118106acd6) C:\Windows\system32\DRIVERS\srvnet.sys
23:24:53.0100 3524        srvnet - ok
23:24:53.0287 3524        ssmdrv          (a36ee93698802cd899f98bfd553d8185) C:\Windows\system32\DRIVERS\ssmdrv.sys
23:24:53.0303 3524        ssmdrv - ok
23:24:53.0506 3524        swenum          (7ba58ecf0c0a9a69d44b3dca62becf56) C:\Windows\system32\DRIVERS\swenum.sys
23:24:53.0521 3524        swenum - ok
23:24:53.0568 3524        Symc8xx        (192aa3ac01df071b541094f251deed10) C:\Windows\system32\drivers\symc8xx.sys
23:24:53.0568 3524        Symc8xx - ok
23:24:53.0802 3524        Sym_hi          (8c8eb8c76736ebaf3b13b633b2e64125) C:\Windows\system32\drivers\sym_hi.sys
23:24:53.0802 3524        Sym_hi - ok
23:24:54.0052 3524        Sym_u3          (8072af52b5fd103bbba387a1e49f62cb) C:\Windows\system32\drivers\sym_u3.sys
23:24:54.0067 3524        Sym_u3 - ok
23:24:54.0317 3524        Tcpip          (782568ab6a43160a159b6215b70bcce9) C:\Windows\system32\drivers\tcpip.sys
23:24:54.0364 3524        Tcpip - ok
23:24:54.0676 3524        Tcpip6          (782568ab6a43160a159b6215b70bcce9) C:\Windows\system32\DRIVERS\tcpip.sys
23:24:54.0691 3524        Tcpip6 - ok
23:24:54.0863 3524        tcpipreg        (d4a2e4a4b011f3a883af77315a5ae76b) C:\Windows\system32\drivers\tcpipreg.sys
23:24:54.0879 3524        tcpipreg - ok
23:24:55.0066 3524        TDPIPE          (5dcf5e267be67a1ae926f2df77fbcc56) C:\Windows\system32\drivers\tdpipe.sys
23:24:55.0081 3524        TDPIPE - ok
23:24:55.0113 3524        TDTCP          (389c63e32b3cefed425b61ed92d3f021) C:\Windows\system32\drivers\tdtcp.sys
23:24:55.0113 3524        TDTCP - ok
23:24:55.0347 3524        tdx            (d09276b1fab033ce1d40dcbdf303d10f) C:\Windows\system32\DRIVERS\tdx.sys
23:24:55.0362 3524        tdx - ok
23:24:55.0549 3524        TermDD          (a048056f5e1a96a9bf3071b91741a5aa) C:\Windows\system32\DRIVERS\termdd.sys
23:24:55.0581 3524        TermDD - ok
23:24:55.0674 3524        tssecsrv        (dcf0f056a2e4f52287264f5ab29cf206) C:\Windows\system32\DRIVERS\tssecsrv.sys
23:24:55.0690 3524        tssecsrv - ok
23:24:55.0939 3524        tunmp          (caecc0120ac49e3d2f758b9169872d38) C:\Windows\system32\DRIVERS\tunmp.sys
23:24:55.0955 3524        tunmp - ok
23:24:56.0158 3524        tunnel          (119b8184e106baedc83fce5ddf3950da) C:\Windows\system32\DRIVERS\tunnel.sys
23:24:56.0173 3524        tunnel - ok
23:24:56.0376 3524        uagp35          (7d33c4db2ce363c8518d2dfcf533941f) C:\Windows\system32\drivers\uagp35.sys
23:24:56.0392 3524        uagp35 - ok
23:24:56.0579 3524        udfs            (8b5088058fa1d1cd897a2113ccff6c58) C:\Windows\system32\DRIVERS\udfs.sys
23:24:56.0626 3524        udfs - ok
23:24:56.0704 3524        UIUSys - ok
23:24:56.0907 3524        uliagpkx        (b0acfdc9e4af279e9116c03e014b2b27) C:\Windows\system32\drivers\uliagpkx.sys
23:24:56.0922 3524        uliagpkx - ok
23:24:57.0094 3524        uliahci        (9224bb254f591de4ca8d572a5f0d635c) C:\Windows\system32\drivers\uliahci.sys
23:24:57.0125 3524        uliahci - ok
23:24:57.0250 3524        UlSata          (8514d0e5cd0534467c5fc61be94a569f) C:\Windows\system32\drivers\ulsata.sys
23:24:57.0265 3524        UlSata - ok
23:24:57.0359 3524        ulsata2        (38c3c6e62b157a6bc46594fada45c62b) C:\Windows\system32\drivers\ulsata2.sys
23:24:57.0375 3524        ulsata2 - ok
23:24:57.0468 3524        umbus          (32cff9f809ae9aed85464492bf3e32d2) C:\Windows\system32\DRIVERS\umbus.sys
23:24:57.0468 3524        umbus - ok
23:24:57.0687 3524        USBAAPL        (c1ca131f4e3ed63d6bc89a35ffad4cda) C:\Windows\system32\Drivers\usbaapl.sys
23:24:57.0702 3524        USBAAPL - ok
23:24:57.0967 3524        usbccgp        (a7cd5b4adea26765cab06bdab7b07b13) C:\Windows\system32\DRIVERS\usbccgp.sys
23:24:57.0999 3524        usbccgp - ok
23:24:58.0295 3524        usbcir          (e9476e6c486e76bc4898074768fb7131) C:\Windows\system32\drivers\usbcir.sys
23:24:58.0311 3524        usbcir - ok
23:24:58.0498 3524        usbehci        (686d4188ae36254c3008b71fedacadf3) C:\Windows\system32\DRIVERS\usbehci.sys
23:24:58.0513 3524        usbehci - ok
23:24:58.0638 3524        usbhub          (4e42f665a658f08d153f7fffe7c83806) C:\Windows\system32\DRIVERS\usbhub.sys
23:24:58.0669 3524        usbhub - ok
23:24:58.0779 3524        usbohci        (38dbc7dd6cc5a72011f187425384388b) C:\Windows\system32\drivers\usbohci.sys
23:24:58.0794 3524        usbohci - ok
23:24:58.0873 3524        usbprint        (e75c4b5269091d15a2e7dc0b6d35f2f5) C:\Windows\system32\DRIVERS\usbprint.sys
23:24:58.0873 3524        usbprint - ok
23:24:59.0092 3524        usbscan        (a508c9bd8724980512136b039bba65e9) C:\Windows\system32\DRIVERS\usbscan.sys
23:24:59.0107 3524        usbscan - ok
23:24:59.0310 3524        USBSTOR        (87ba6b83c5d19b69160968d07d6e2982) C:\Windows\system32\DRIVERS\USBSTOR.SYS
23:24:59.0310 3524        USBSTOR - ok
23:24:59.0404 3524        usbuhci        (40f95a3d6d50d82f947f1d167c2ec39d) C:\Windows\system32\DRIVERS\usbuhci.sys
23:24:59.0419 3524        usbuhci - ok
23:24:59.0497 3524        usbvideo        (e67998e8f14cb0627a769f6530bcb352) C:\Windows\system32\Drivers\usbvideo.sys
23:24:59.0513 3524        usbvideo - ok
23:24:59.0669 3524        vga            (87b06e1f30b749a114f74622d013f8d4) C:\Windows\system32\DRIVERS\vgapnp.sys
23:24:59.0684 3524        vga - ok
23:24:59.0840 3524        VgaSave        (2e93ac0a1d8c79d019db6c51f036636c) C:\Windows\System32\drivers\vga.sys
23:24:59.0840 3524        VgaSave - ok
23:24:59.0950 3524        viaagp          (5d7159def58a800d5781ba3a879627bc) C:\Windows\system32\drivers\viaagp.sys
23:24:59.0981 3524        viaagp - ok
23:25:00.0215 3524        ViaC7          (c4f3a691b5bad343e6249bd8c2d45dee) C:\Windows\system32\drivers\viac7.sys
23:25:00.0215 3524        ViaC7 - ok
23:25:00.0324 3524        viaide          (aadf5587a4063f52c2c3fed7887426fc) C:\Windows\system32\drivers\viaide.sys
23:25:00.0340 3524        viaide - ok
23:25:00.0449 3524        volmgr          (69503668ac66c77c6cd7af86fbdf8c43) C:\Windows\system32\drivers\volmgr.sys
23:25:00.0464 3524        volmgr - ok
23:25:00.0542 3524        volmgrx        (98f5ffe6316bd74e9e2c97206c190196) C:\Windows\system32\drivers\volmgrx.sys
23:25:00.0558 3524        volmgrx - ok
23:25:00.0636 3524        volsnap        (d8b4a53dd2769f226b3eb374374987c9) C:\Windows\system32\drivers\volsnap.sys
23:25:00.0667 3524        volsnap - ok
23:25:00.0745 3524        vsmraid        (587253e09325e6bf226b299774b728a9) C:\Windows\system32\drivers\vsmraid.sys
23:25:00.0761 3524        vsmraid - ok
23:25:00.0870 3524        WacomPen        (48dfee8f1af7c8235d4e626f0c4fe031) C:\Windows\system32\drivers\wacompen.sys
23:25:00.0886 3524        WacomPen - ok
23:25:01.0042 3524        Wanarp          (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys
23:25:01.0135 3524        Wanarp - ok
23:25:01.0182 3524        Wanarpv6        (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys
23:25:01.0182 3524        Wanarpv6 - ok
23:25:01.0385 3524        Wd              (78fe9542363f297b18c027b2d7e7c07f) C:\Windows\system32\drivers\wd.sys
23:25:01.0385 3524        Wd - ok
23:25:01.0619 3524        Wdf01000        (9950e3d0f08141c7e89e64456ae7dc73) C:\Windows\system32\drivers\Wdf01000.sys
23:25:01.0650 3524        Wdf01000 - ok
23:25:01.0853 3524        WimFltr        (090a2b8f055343815556a01f725f6c35) C:\Windows\system32\DRIVERS\wimfltr.sys
23:25:01.0884 3524        WimFltr - ok
23:25:01.0931 3524        winachsf        (5a77ac34a0ffb70ce8b35b524fede9ba) C:\Windows\system32\DRIVERS\HSX_CNXT.sys
23:25:01.0993 3524        winachsf - ok
23:25:02.0165 3524        WmiAcpi        (2e7255d172df0b8283cdfb7b433b864e) C:\Windows\system32\drivers\wmiacpi.sys
23:25:02.0165 3524        WmiAcpi - ok
23:25:02.0430 3524        WpdUsb          (0cec23084b51b8288099eb710224e955) C:\Windows\system32\DRIVERS\wpdusb.sys
23:25:02.0446 3524        WpdUsb - ok
23:25:02.0539 3524        ws2ifsl        (e3a3cb253c0ec2494d4a61f5e43a389c) C:\Windows\system32\drivers\ws2ifsl.sys
23:25:02.0555 3524        ws2ifsl - ok
23:25:02.0695 3524        WUDFRd          (ac13cb789d93412106b0fb6c7eb2bcb6) C:\Windows\system32\DRIVERS\WUDFRd.sys
23:25:02.0711 3524        WUDFRd - ok
23:25:02.0804 3524        XAudio          (88af537264f2b818da15479ceeaf5d7c) C:\Windows\system32\DRIVERS\xaudio.sys
23:25:02.0820 3524        XAudio - ok
23:25:03.0054 3524        yukonwlh        (67e3d2af24c3873e6a0cac89de78d63b) C:\Windows\system32\DRIVERS\yk60x86.sys
23:25:03.0070 3524        yukonwlh - ok
23:25:03.0272 3524        [verify-U]_System - ok
23:25:03.0350 3524        MBR (0x1B8)    (5c616939100b85e558da92b899a0fc36) \Device\Harddisk0\DR0
23:25:03.0413 3524        \Device\Harddisk0\DR0 - ok
23:25:03.0428 3524        Boot (0x1200)  (2ca57410443ad7cd7f2e672eceb7e94a) \Device\Harddisk0\DR0\Partition0
23:25:03.0428 3524        \Device\Harddisk0\DR0\Partition0 - ok
23:25:03.0444 3524        Boot (0x1200)  (ce65a80f0f3c91e2ff667792ea241b75) \Device\Harddisk0\DR0\Partition1
23:25:03.0444 3524        \Device\Harddisk0\DR0\Partition1 - ok
23:25:03.0444 3524        ============================================================
23:25:03.0444 3524        Scan finished
23:25:03.0444 3524        ============================================================
23:25:03.0475 4376        Detected object count: 0
23:25:03.0475 4376        Actual detected object count: 0

cosinus 09.01.2012 23:29
Ah es geht :)
Was ist bei dir Laufwerk G:? Eine externe Platte?

Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

Olivia81 10.01.2012 00:14
G: ist ein USB Anschluss, ist aber die ganze Zeit nicht in Verwendung. Avira kommt immer wieder mit der Fehlermeldung, G: scheint auch im Explorer auf (Auf G: kann nicht zugegriffen werden. Falscher Parameter).

hier das Log von Combofix:
[code]
Combofix Logfile:
Code:
ComboFix 12-01-09.03 - Schatzipu 09.01.2012  23:45:42.4.2 - x86
Microsoft® Windows Vista™ Home Premium  6.0.6001.1.1252.49.1031.18.3038.1829 [GMT 1:00]
ausgeführt von:: c:\users\Schatzipu\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\install.exe
c:\program files\facemoods.com\facemoods\1.4.17.6\faCEmoodstlbr.dll
c:\windows\system32\drivers\etc\hosts.ics
.
.
(((((((((((((((((((((((  Dateien erstellt von 2011-12-09 bis 2012-01-09  ))))))))))))))))))))))))))))))
.
.
2012-01-09 23:05 . 2012-01-09 23:06        --------        d-----w-        c:\users\Schatzipu\AppData\Local\temp
2012-01-09 23:05 . 2012-01-09 23:05        --------        d-----w-        c:\users\Thomas\AppData\Local\temp
2012-01-09 23:05 . 2012-01-09 23:05        --------        d-----w-        c:\users\Public\AppData\Local\temp
2012-01-09 23:05 . 2012-01-09 23:05        --------        d-----w-        c:\users\Default\AppData\Local\temp
2012-01-09 23:05 . 2012-01-09 23:05        --------        d-----w-        c:\users\Administrator\AppData\Local\temp
2012-01-09 22:13 . 2012-01-09 22:13        56200        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{F20AD058-D5E7-4C6A-ADC4-D9FBCE3CD9D3}\offreg.dll
2012-01-09 15:41 . 2012-01-09 15:41        --------        d-----w-        c:\users\Schatzipu\AppData\Roaming\ImgBurn
2012-01-09 15:40 . 2012-01-09 15:40        --------        d-----w-        c:\program files\ImgBurn
2012-01-08 21:21 . 2012-01-08 21:21        --------        d-----w-        c:\users\Schatzipu\AppData\Roaming\Canneverbe Limited
2012-01-08 21:21 . 2012-01-08 21:21        --------        d-----w-        c:\programdata\Canneverbe Limited
2012-01-08 21:20 . 2012-01-08 21:21        --------        d-----w-        c:\program files\CDBurnerXP
2012-01-08 19:49 . 2012-01-09 16:49        --------        d-----w-        c:\programdata\WinZip
2012-01-08 01:10 . 2012-01-09 22:21        5694        ----a-w-        c:\windows\system32\PerfStringBackup.TMP
2012-01-08 00:58 . 2012-01-08 00:58        --------        d-----w-        C:\_OTL
2012-01-07 09:33 . 2012-01-07 09:33        --------        d-----w-        c:\program files\ESET
2012-01-07 01:19 . 2011-11-21 10:47        6823496        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{F20AD058-D5E7-4C6A-ADC4-D9FBCE3CD9D3}\mpengine.dll
2012-01-06 18:05 . 2012-01-06 18:05        --------        d-----w-        C:\Malwarebytes' Anti-Malware
2012-01-06 02:30 . 2012-01-06 03:49        --------        d-----w-        c:\program files\GridinSoft Trojan Killer
2012-01-05 20:51 . 2012-01-05 20:51        --------        d-----w-        c:\users\Gast
2012-01-05 20:49 . 2012-01-05 20:49        --------        d-----w-        c:\users\virus
2012-01-05 20:31 . 2012-01-05 20:31        --------        d-sh--w-        c:\programdata\{32364CEA-7855-4A3C-B674-53D8E9B97936}
2012-01-04 10:22 . 2009-05-18 12:17        26600        ---ha-w-        c:\windows\system32\drivers\GEARAspiWDM.sys
2012-01-04 10:22 . 2008-04-17 11:12        107368        ---ha-w-        c:\windows\system32\GEARAspi.dll
2012-01-04 10:19 . 2012-01-04 10:19        --------        d-----w-        c:\program files\iPod
2011-12-20 20:33 . 2011-12-20 20:33        --------        d-----w-        c:\users\Schatzipu\AppData\Roaming\Avira
2011-12-20 19:27 . 2011-12-09 11:40        74640        ---ha-w-        c:\windows\system32\drivers\avgntflt.sys
2011-12-20 19:27 . 2011-12-09 11:40        36000        ---ha-w-        c:\windows\system32\drivers\avkmgr.sys
2011-12-20 19:27 . 2011-12-09 11:40        134856        ---ha-w-        c:\windows\system32\drivers\avipbb.sys
2011-12-20 19:27 . 2011-12-20 19:27        --------        d-----w-        c:\programdata\Avira
2011-12-20 19:27 . 2011-12-20 19:27        --------        d-----w-        c:\program files\Avira
2011-12-15 15:54 . 2011-12-15 15:54        1207568        ----a-w-        c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-12-10 14:24 . 2010-05-15 14:37        20464        ----a-w-        c:\windows\system32\drivers\mbam.sys
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"facemoods"="c:\program files\facemoods.com\facemoods\1.4.17.6\facemoodssrv.exe" [2010-10-26 323584]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]
"RtHDVCpl"="RtHDVCpl.exe" [2008-07-18 6295552]
"Apoint"="c:\program files\Apoint\Apoint.exe" [2008-02-23 122880]
"ToADiMon.exe"="c:\program files\T-Online\T-Online_Software_6\Basis-Software\Basis1\ToADiMon.exe" [2010-04-08 286720]
"RIMBBLaunchAgent.exe"="c:\program files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe" [2011-02-18 79192]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-11-01 59240]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2011-12-09 258512]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-12-08 421736]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"InfoCockpit"="c:\program files\T-Online\T-Online_Software_6\Info-Cockpit\IC_START.EXE" [2007-07-30 176128]
.
c:\users\Schatzipu\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Terminkalender2.lnk - c:\softwarenetz\Terminkalender2\kalender2.exe [2011-2-22 2502752]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"NoSecCPL"= 0 (0x0)
"NoDevMgrPage"= 0 (0x0)
"NoConfigPage"= 0 (0x0)
"NoVirtMemPage"= 0 (0x0)
"NoFileSysPage"= 0 (0x0)
"NoNetSetup"= 0 (0x0)
"NoNetSetupIDPage"= 0 (0x0)
"NoNetSetupSecurityPage"= 0 (0x0)
"NoWorkgroupContents"= 0 (0x0)
"NoEntireNetwork"= 0 (0x0)
"NoFileSharingControl"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\VESWinlogon]
2008-07-15 16:04        98304        ---ha-w-        c:\windows\System32\VESWinlogon.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer3"=wdmaud.drv
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^BTTray.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\BTTray.lnk
backup=c:\windows\pss\BTTray.lnk.CommonStartup
backupExtension=.CommonStartup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\T-Online_Software_6
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 8.0]
2008-10-14 20:38        623992        ----a-w-        c:\program files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS4ServiceManager]
2008-08-14 06:58        611712        ----a-w-        c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeUpdater]
2008-11-15 08:17        2356088        ----a-w-        c:\program files\Common Files\Adobe\Updater5\AdobeUpdater.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AML]
2008-06-13 13:07        1097728        ----a-w-        c:\program files\Sony\VAIO Launcher\AML.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]
2010-04-12 22:46        1135912        ----a-w-        c:\program files\DivX\DivX Update\DivXUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InfoCockpit]
2007-07-30 13:27        176128        ------w-        c:\program files\T-Online\T-Online_Software_6\Info-Cockpit\ic_start.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISBMgr.exe]
2008-04-03 18:03        317280        ----a-w-        c:\program files\Sony\ISB Utility\ISBMgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2011-12-08 00:36        421736        ----a-w-        c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MarketingTools]
2008-08-22 10:25        24576        ----a-w-        c:\program files\Sony\Marketing Tools\MarketingTools.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NSUFloatingUI]
2008-07-30 14:05        262144        ----a-w-        c:\program files\Sony\Network Utility\LANUtil.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2008-11-04 09:30        413696        ----a-w-        c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\T-Online_Software_6\WLAN-Access Finder]
2008-04-08 16:49        671796        ----a-w-        c:\program files\T-Online\WLAN-Access Finder\ToWLaAcF.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ToADiMon.exe]
2010-04-08 13:59        286720        ----a-w-        c:\program files\T-Online\T-Online_Software_6\Basis-Software\Basis1\ToADiMon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - 12164498
*Deregistered* - 12164498
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs        REG_MULTI_SZ          BthServ
Akamai        REG_MULTI_SZ          Akamai
.
Inhalt des "geplante Tasks" Ordners
.
2012-01-09 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-14 12:09]
.
2012-01-09 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-14 12:09]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.orf.at/
mStart Page = about:blank
mWindow Title = Microsoft Internet Explorer
uInternet Settings,ProxyOverride = *.local
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: An vorhandenes PDF anfügen - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Auswahl in Adobe PDF konvertieren - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Auswahl in vorhandene PDF-Datei konvertieren - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Bild an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
IE: In Adobe PDF konvertieren - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Seite an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
IE: Verknüpfungsziel in Adobe PDF konvertieren - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
Trusted Zone: maxdome.de\www
TCP: DhcpNameServer = 192.168.2.1
DPF: {0972B098-DEE9-4279-AC7E-4BAAA029102D} - hxxp://assets.photobox.com/assets/aurigma/ImageUploader5.cab?20111123062837
FF - ProfilePath - c:\users\Schatzipu\AppData\Roaming\Mozilla\Firefox\Profiles\dkk0kp2n.default\
FF - prefs.js: browser.search.selectedEngine -
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
FF - Ext: Skype Click to Call: {82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} - c:\program files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2012-01-10 00:06
Windows 6.0.6001 Service Pack 1 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
"ImagePath"="system32\drivers\
[verify-U]-driver.sys"
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Akamai]
"ServiceDll"="c:\program files\common files\akamai/netsession_win_b427739.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\[verify-U]_System]
"ImagePath"="system32\drivers\
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Zeit der Fertigstellung: 2012-01-10  00:11:05
ComboFix-quarantined-files.txt  2012-01-09 23:11
.
Vor Suchlauf: 18 Verzeichnis(se), 127.837.569.024 Bytes frei
Nach Suchlauf: 19 Verzeichnis(se), 127.799.738.368 Bytes frei
.
- - End Of File - - CD9DCD702EFCF619368A33F83E9DE799
--- --- ---

cosinus 10.01.2012 09:24
Zitat:
G: ist ein USB Anschluss
Diese Aussage macht so keinen Sinn.
G: ist ein Laufwerksbuchstabe, du kannst jeden beliebigen Laufwerkstyp auf G: legen. Die Frage war: was war zu dem Zeitpunkt auf Laufwerk G: eingehangen? Ein USB-Stick, eine externe Festplatte oder vllt sowas wie eine SD-Card im Kartenleser?

Zitat:
ist aber die ganze Zeit nicht in Verwendung.
Dann gibt es das Laufwerk G: so auch nicht wenn das Laufwerk nicht eingehangen ist (ungültige Laufwerksangabe)
Aber es wurde ja ein Schädling im Bootsektor auf dem Gerät gefunden, dass zu diesem Zeitpunkt als Laufwerk G: eingehangen war!

Olivia81 10.01.2012 09:37
Dann kann es nur meine externe Festplatte gewesen sein mit der ich die Datensicherung vorgenommen habe. Ansonsten hatte ich die ganze Zeit über nichts angeschlossen. Als das Antivirenprogramm die Meldung das erste Mal brachte, war sie jedoch schon einige Zeit nicht eingehangen.

Olivia81 10.01.2012 09:50
Habe den Computer nochmals hochgefahren. Die Avira Fehlermeldung erscheint erneut, auch G: ist nach wie vor im Explorer zu sehen, jedoch ist der Pfad nicht verfügbar.
Bedeutet dies, dass die Externe Festplatte nun auch betroffen ist?
Grüße,
Olivia

Olivia81 10.01.2012 10:00
PS: ich kann wieder auf meine Ordner zugreifen, lediglich im Startmenü sind die Ordner leer bzw nicht verfügbar.

cosinus 10.01.2012 10:08
Zitat:
Ansonsten hatte ich die ganze Zeit über nichts angeschlossen.
Zitat:
auch G: ist nach wie vor im Explorer zu sehen, jedoch ist der Pfad nicht verfügbar.
Was denn jetzt??
Ist die Festplatte nun angeschlossen oder nicht?

Olivia81 10.01.2012 10:09
Die Festplatte ist nicht angeschlossen, G: ist jedoch als Auswahlpunkt zu sehen - normalerweise nur verfügbar, wenn ein Gerät dranhängt. Und wie gesagt kommt Avira nach wie vor mit den Fehlermeldungen. Was soll ich tun?

cosinus 10.01.2012 10:12
Geh mal in die Datenträgerverwaltung => Start => Rechtsklick auf Computer => Verwalten => Datenträgerverwaltung
Mach das Fenster groß genug und dann einen Screenshot

Olivia81 10.01.2012 10:22
Liste der Anhänge anzeigen (Anzahl: 1)
hier ist er:

cosinus 10.01.2012 10:32
Verdammt! Da ist diese böse Partition wieder ;)
Geh nochmal in PartedMagic rein und starte den PartitionEditor (GParted) mach davoon wieder einen Screenshot.

Olivia81 10.01.2012 13:09
Habe es jetzt mehrmals versucht, Partedmagic laesst sich nicht starten:
Uncompression error
Vfs:cannot open Root device "Null"or Unionen Block

Olivia81 10.01.2012 13:10
Unknown Block soll das heissen

cosinus 10.01.2012 13:53
Könnte ein Problem mit dem Arbeitsspeicher sein.
Jedenfalls funktionierte PartedMagic bei dir vorher.

Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.
  • Starte die aswMBR.exe Vista und Win7 User aswMBR per Rechtsklick "als Administrator ausführen"
  • Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen) Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
  • Klicke auf Scan.
  • Warte bitte bis Scan finished successfully im DOS Fenster steht.
  • Drücke auf Save Log und speichere diese auf dem Desktop.
Poste mir die aswMBR.txt in deiner nächsten Antwort. Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte es erneut nicht klappen teile mir das bitte mit.

Olivia81 10.01.2012 15:08
Code:
aswMBR version 0.9.9.1297 Copyright(c) 2011 AVAST Software
Run date: 2012-01-10 14:34:24
-----------------------------
14:34:24.564    OS Version: Windows 6.0.6001 Service Pack 1
14:34:24.564    Number of processors: 2 586 0x1706
14:34:24.564    ComputerName: SCHATZIPU-PC  UserName: Schatzipu
14:34:32.163    Initialze error C000010E - driver not loaded
14:37:33.125    AVAST engine defs: 12011000
14:51:00.609    Scan error: Unzulässige Funktion.
14:51:21.985    The log file has been saved successfully to "C:\Users\Schatzipu\Desktop\aswMBR.txt"


aswMBR version 0.9.9.1297 Copyright(c) 2011 AVAST Software
Run date: 2012-01-10 14:33:52
-----------------------------
14:33:52.812    OS Version: Windows 6.0.6001 Service Pack 1
14:33:52.812    Number of processors: 2 586 0x1706
14:33:52.812    ComputerName: SCHATZIPU-PC  UserName: Schatzipu
14:34:34.886    Initialize success
14:34:35.058    write error "aswCmnB.dll". Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird.
14:54:19.147    AVAST engine defs: 12011000
14:54:21.598    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
14:54:21.598    Disk 0 Vendor: TOSHIBA_ LV01 Size: 305245MB BusType: 3
14:54:21.614    Disk 1  \Device\Harddisk1\DR1 -> \Device\0000006d
14:54:21.630    Disk 1 Vendor: RICOH 01 Size: 305245MB BusType: 0
14:54:21.630    Disk 2  \Device\Harddisk2\DR2 -> \Device\0000006e
14:54:21.645    Disk 2 Vendor: RICOH 02 Size: 305245MB BusType: 0
14:54:21.661    Disk 0 MBR read successfully
14:54:21.676    Disk 0 MBR scan
14:54:21.692    Disk 0 Windows VISTA default MBR code
14:54:21.723    Disk 0 Partition 1 80 (A) 27 Hidden NTFS WinRE NTFS        11485 MB offset 2048
14:54:21.786    Disk 0 Partition 2 00    07    HPFS/NTFS NTFS      293758 MB offset 23523328
14:54:21.801    Disk 0 Partition 3 00    07    HPFS/NTFS NTFS            0 MB offset 625140400
14:54:22.425    Disk 0 Partition 3  **INFECTED** MBR:Alureon-K [Rtk]
14:54:22.441    Disk 0 scanning sectors +625142432
14:54:22.488    Disk 0 scanning C:\Windows\system32\drivers
14:54:55.627    Service scanning
14:54:57.873    Modules scanning
14:55:15.377    Disk 0 trace - called modules:
14:55:15.408    ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll iaStor.sys
14:55:15.423    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8686cac8]
14:55:15.439    3 CLASSPNP.SYS[8a9a5745] -> nt!IofCallDriver -> [0x84d5a318]
14:55:15.455    5 acpi.sys[8068e6a0] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0x84d5d028]
14:55:18.965    AVAST engine scan C:\Windows
14:55:32.289    File: C:\Windows\PEV.exe  **INFECTED** Win32:Rootkit-gen [Rtk]
14:55:41.028    AVAST engine scan C:\Windows\system32
15:03:00.097    AVAST engine scan C:\Windows\system32\drivers
15:03:46.457    AVAST engine scan C:\Users\Schatzipu
15:07:44.615    Disk 0 MBR has been saved successfully to "C:\Users\Schatzipu\Desktop\MBR.dat"
15:07:44.630    The log file has been saved successfully to "C:\Users\Schatzipu\Desktop\aswMBR.txt"


aswMBR version 0.9.9.1297 Copyright(c) 2011 AVAST Software
Run date: 2012-01-10 14:33:52
-----------------------------
14:33:52.812    OS Version: Windows 6.0.6001 Service Pack 1
14:33:52.812    Number of processors: 2 586 0x1706
14:33:52.812    ComputerName: SCHATZIPU-PC  UserName: Schatzipu
14:34:34.886    Initialize success
14:34:35.058    write error "aswCmnB.dll". Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird.
14:54:19.147    AVAST engine defs: 12011000
14:54:21.598    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
14:54:21.598    Disk 0 Vendor: TOSHIBA_ LV01 Size: 305245MB BusType: 3
14:54:21.614    Disk 1  \Device\Harddisk1\DR1 -> \Device\0000006d
14:54:21.630    Disk 1 Vendor: RICOH 01 Size: 305245MB BusType: 0
14:54:21.630    Disk 2  \Device\Harddisk2\DR2 -> \Device\0000006e
14:54:21.645    Disk 2 Vendor: RICOH 02 Size: 305245MB BusType: 0
14:54:21.661    Disk 0 MBR read successfully
14:54:21.676    Disk 0 MBR scan
14:54:21.692    Disk 0 Windows VISTA default MBR code
14:54:21.723    Disk 0 Partition 1 80 (A) 27 Hidden NTFS WinRE NTFS        11485 MB offset 2048
14:54:21.786    Disk 0 Partition 2 00    07    HPFS/NTFS NTFS      293758 MB offset 23523328
14:54:21.801    Disk 0 Partition 3 00    07    HPFS/NTFS NTFS            0 MB offset 625140400
14:54:22.425    Disk 0 Partition 3  **INFECTED** MBR:Alureon-K [Rtk]
14:54:22.441    Disk 0 scanning sectors +625142432
14:54:22.488    Disk 0 scanning C:\Windows\system32\drivers
14:54:55.627    Service scanning
14:54:57.873    Modules scanning
14:55:15.377    Disk 0 trace - called modules:
14:55:15.408    ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll iaStor.sys
14:55:15.423    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8686cac8]
14:55:15.439    3 CLASSPNP.SYS[8a9a5745] -> nt!IofCallDriver -> [0x84d5a318]
14:55:15.455    5 acpi.sys[8068e6a0] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0x84d5d028]
14:55:18.965    AVAST engine scan C:\Windows
14:55:32.289    File: C:\Windows\PEV.exe  **INFECTED** Win32:Rootkit-gen [Rtk]
14:55:41.028    AVAST engine scan C:\Windows\system32
15:03:00.097    AVAST engine scan C:\Windows\system32\drivers
15:03:46.457    AVAST engine scan C:\Users\Schatzipu
15:07:44.615    Disk 0 MBR has been saved successfully to "C:\Users\Schatzipu\Desktop\MBR.dat"
15:07:44.630    The log file has been saved successfully to "C:\Users\Schatzipu\Desktop\aswMBR.txt"

cosinus 10.01.2012 16:37
Zitat:
Disk 0 Partition 3 **INFECTED** MBR:Alureon-K [Rtk]
Ja auch aswMBR erkennt es. Der MBR ist ist aber ok.
Geh nochmal in die Datenträgerverwaltung.
Klick oben in der Liste der Datenträger mit Rechts auf Laufwerk G: (die Partition mit Dateisystem RAW Und 1 MB Größe) und sag "Partition löschen"

Windows neu starten und einen neuen Screenshot von der Datenträgerverwaltung machen

Olivia81 10.01.2012 18:08
Ich kann mit rechts nur "Volume löschen", die Option "Partition löschen" finde ich leider nicht!
Grüße,
Olivia

cosinus 10.01.2012 19:57
Partition=Volume
Ist das gleiche mit gemeint

Olivia81 10.01.2012 22:10
Liste der Anhänge anzeigen (Anzahl: 1)
hi Arne,
danke - erhalte wie du auf dem Screenshot sehen kannst Meldungen, dass Programme (zB Avira) versuchen, auf das Internet zuzugreifen (hatte ich vor dem Virus nicht), das Programm facemood ist mir nicht bekannt.
Grüße,
Olivia

Olivia81 10.01.2012 22:11
PS: Kann Avira selbst auch etwas haben - habe soeben eine Meldung erhalten: "Entdecken Sie den neuen konfigurierbaren Spielmodus" - und die Probleme fingen an, als ich bei Avira ein Update durchgeführt habe...

cosinus 10.01.2012 22:26
Nein, das ist bloß ein Hinweis von Avira.

Bitte nun neue Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM!

Mach auch ein neues Log mit aswMBR

Olivia81 11.01.2012 06:51
hi Arne,
GMER hat sich wie angekündigt aufgehängt.

Code:
OSAM Logfile:

       
Code:

       
Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 22:42:03 on 10.01.2012

OS: Windows Vista Home Premium Edition Service Pack 1 (Build 6001), 32-bit
Default Browser: Microsoft Corporation Internet Explorer 8.00.6001.18702

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries


[Common]
-----( %SystemRoot%\Tasks )-----
"GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe

[Control Panel Objects]
-----( %SystemRoot%\system32 )-----
"DivXControlPanelApplet.cpl" - "DivX, Inc." - C:\Windows\system32\DivXControlPanelApplet.cpl
"FlashPlayerCPLApp.cpl" - "Adobe Systems Incorporated" - C:\Windows\system32\FlashPlayerCPLApp.cpl
"iproset.cpl" - "Intel(R) Corporation" - C:\Windows\system32\iproset.cpl
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"Adobe Gamma" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma.cpl
"PROSet Tools" - "Intel(R) Corporation" - C:\Windows\System32\iPROSet.cpl
"QuickTime" - "Apple Inc." - C:\Program Files\QuickTime\QTSystem\QuickTime.cpl
"ToSysCnf" - "Deutsche Telekom AG, Marmiko IT-Solutions GmbH" - C:\Program Files\T-Online\T-Online_Software_6\Basis-Software\Basis1\ToSysCnf.cpl

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"Apple Mobile USB Driver" (USBAAPL) - "Apple, Inc." - C:\Windows\System32\Drivers\usbaapl.sys
"avgntflt" (avgntflt) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avgntflt.sys
"avipbb" (avipbb) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avipbb.sys
"avkmgr" (avkmgr) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avkmgr.sys
"catchme" (catchme) - ? - C:\Users\SCHATZ~1\AppData\Local\Temp\catchme.sys  (File not found)
"ElbyCDIO Driver" (ElbyCDIO) - "Elaborate Bytes AG" - C:\Windows\System32\Drivers\ElbyCDIO.sys
"IP in IP Tunnel Driver" (IpInIp) - ? - C:\Windows\System32\DRIVERS\ipinip.sys  (File not found)
"IPX Traffic Filter Driver" (NwlnkFlt) - ? - C:\Windows\System32\DRIVERS\nwlnkflt.sys  (File not found)
"IPX Traffic Forwarder Driver" (NwlnkFwd) - ? - C:\Windows\System32\DRIVERS\nwlnkfwd.sys  (File not found)
"MTOnlPktAlyX NDIS Protocol Driver" (MTOnlPktAlyX) - "Deutsche Telekom AG AG, Marmiko IT-Solutions GmbH" - C:\PROGRA~1\T-Online\T-ONLI~1\BASIS-~1\Basis1\MTOnlPktAlyX.SYS
"regi" (regi) - "InterVideo" - C:\Windows\system32\drivers\regi.sys
"Sony DMI Call service" (DMICall) - "Sony Corporation" - C:\Windows\System32\DRIVERS\DMICall.sys
"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\Windows\System32\DRIVERS\ssmdrv.sys
"WimFltr" (WimFltr) - "Microsoft Corporation" - C:\Windows\System32\DRIVERS\wimfltr.sys
"[verify-U]_System" ([verify-U]_System) - ? - C:\Windows\System32\drivers\[verify-U]-driver.sys  (File not found)

[Explorer]
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
-----( HKLM\Software\Classes\Protocols\Filter )-----
{807563E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
-----( HKLM\Software\Classes\Protocols\Handler )-----
{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
{0A9007C0-4076-11D3-8789-0000F8105754} "Microsoft Infotech Storage Protocol for IE 4.0" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll
{91774881-D725-4E58-B298-07617B9B86A8} "Skype IE add-on Pluggable Protocol" - ? - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll  (File not found)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks )-----
{AEB6717E-7E19-11d0-97EE-00C04FD91972} "{AEB6717E-7E19-11d0-97EE-00C04FD91972}" - ? -   (File not found | COM-object registry key not found)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{911051fa-c21c-4246-b470-070cd8df6dc4} ".cab or .zip files" - ? -   (File not found | COM-object registry key not found)
{D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802} "Acrobat Elements Context Menu" - "Adobe Systems Inc." - C:\Program Files\Adobe\Acrobat 8.0\Acrobat Elements\ContextMenu.dll
{1b24a030-9b20-49bc-97ac-1be4426f9e59} "ActiveDirectory Folder" - ? -   (File not found | COM-object registry key not found)
{34449847-FD14-4fc8-A75A-7432F5181EFB} "ActiveDirectory Folder" - ? -   (File not found | COM-object registry key not found)
{0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48} "Contacts folder" - ? -   (File not found | COM-object registry key not found)
{94586423-855F-4EB2-9F6A-D9DA5658DBE3} "Context menu" - ? - C:\PROGRA~1\FREEM4~1\m4a_menu.dll  (File found, but it contains no detailed information)
{2C2577C2-63A7-40e3-9B7F-586602617ECB} "Explorer Query Band" - ? -   (File not found | COM-object registry key not found)
{FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75} "IE User Assist" - ? -   (File not found | COM-object registry key not found)
{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF} "iTunes" - "Apple Inc." - C:\Program Files\iTunes\iTunesMiniPlayer.dll
{00020d75-0000-0000-c000-000000000046} "lnkfile" - ? -   (File not found | COM-object registry key not found)
{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\msohevi.dll
{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
{5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C} "Microsoft Office OneNote Namespace Extension for Windows Desktop Search" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\ONFILTER.DLL
{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
{7842554E-6BED-11D2-8CDB-B05550C10000} "Monitor Class" - "Broadcom Corporation." - C:\Windows\system32\btncopy.dll
{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4} "RealOne Player Context Menu Class" - "RealNetworks, Inc." - C:\Program Files\Real\RealPlayer\rpshell.dll
{C8494E42-ACDD-4739-B0FB-217361E4894F} "Sam Account Folder" - ? -   (File not found | COM-object registry key not found)
{E29F9716-5C08-4FCD-955A-119FDB5A522D} "Sam Account Folder" - ? -   (File not found | COM-object registry key not found)
{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira Operations GmbH & Co. KG" - C:\Program Files\Avira\AntiVir Desktop\shlext.dll
{da67b8ad-e81b-4c70-9b91b417b5e33527} "Windows Search Shell Service" - ? -   (File not found | COM-object registry key not found)
{E0D79304-84BE-11CE-9641-444553540000} "WinZip" - "WinZip Computing, S.L." - C:\Program Files\WinZip\wzshlstb.dll
{E0D79305-84BE-11CE-9641-444553540000} "WinZip" - "WinZip Computing, S.L." - C:\Program Files\WinZip\wzshlstb.dll
{E0D79306-84BE-11CE-9641-444553540000} "WinZip" - "WinZip Computing, S.L." - C:\Program Files\WinZip\wzshlstb.dll
{E0D79307-84BE-11CE-9641-444553540000} "WinZip" - "WinZip Computing, S.L." - C:\Program Files\WinZip\wzshlstb.dll

[Internet Explorer]
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
ITBar7Height "ITBar7Height" - ? -   (File not found | COM-object registry key not found)
<binary data> "ITBar7Layout" - ? -   (File not found | COM-object registry key not found)
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_24" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} "Java Plug-in 1.6.0_24" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_24" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_24.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
{7530BFB8-7293-4D34-9923-61A11451AFC5} "OnlineScanner Control" - "ESET" - C:\PROGRA~1\ESET\ESETON~1\ONLINE~1.OCX / hxxp://download.eset.com/special/eos/OnlineScanner.cab
{0972B098-DEE9-4279-AC7E-4BAAA029102D} "PhotoboxPhotowaysUploader5 Control" - "PhotoBox Photoways" - C:\Windows\Downloaded Program Files\ImageUploader5.ocx / hxxp://assets.photobox.com/assets/aurigma/ImageUploader5.cab?20111123062837
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
{48E73304-E1D6-4330-914C-F5F514E3486C} "An OneNote senden" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
{898EA8C8-E7FF-479B-8935-AEC46303B9E5} "Skype Click to Call" - ? - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll  (File not found)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2ssv.dll

[Logon]
-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\Users\Schatzipu\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
"Terminkalender2.lnk" - "softwarenetz.de" - C:\Softwarenetz\Terminkalender2\kalender2.exe  (Shortcut exists | File exists)
-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----
"StartupPrograms" - ? - rdpclip  (File not found)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"APSDaemon" - "Apple Inc." - "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"
"avgnt" - "Avira Operations GmbH & Co. KG" - "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
"facemoods" - "facemoods.com" - "C:\Program Files\facemoods.com\facemoods\1.4.17.6\facemoodssrv.exe" /md I
"iTunesHelper" - "Apple Inc." - "C:\Program Files\iTunes\iTunesHelper.exe"
"RIMBBLaunchAgent.exe" - "Research In Motion Limited" - C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
"ToADiMon.exe" - "Deutsche Telekom AG, Marmiko IT-Solutions GmbH" - C:\Program Files\T-Online\T-Online_Software_6\Basis-Software\Basis1\ToADiMon.exe -TOnlineAutodialStart

[Print Monitors]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----
"Send To Microsoft OneNote Monitor" - "Microsoft Corporation" - C:\Windows\system32\msonpmon.dll

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"Adobe Active File Monitor V6" (AdobeActiveFileMonitor6.0) - ? - C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe  (File found, but it contains no detailed information)
"Akamai NetSession Interface" (Akamai) - ? - c:\program files\common files\akamai\netsession_win_b427739.dll  (File found, but it contains no detailed information)
"Apple Mobile Device" (Apple Mobile Device) - "Apple Inc." - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
"Avira Echtzeit Scanner" (AntiVirService) - "Avira Operations GmbH & Co. KG" - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
"Avira Planer" (AntiVirSchedulerService) - "Avira Operations GmbH & Co. KG" - C:\Program Files\Avira\AntiVir Desktop\sched.exe
"VAIO Power Management" (VAIO Power Management) - "Sony Corporation" - C:\Program Files\Sony\VAIO Power Management\SPMService.exe
"Bluetooth Service" (btwdins) - "Broadcom Corporation." - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
"Dienst "Bonjour"" (Bonjour Service) - "Apple Inc." - C:\Program Files\Bonjour\mDNSResponder.exe
"FLEXnet Licensing Service" (FLEXnet Licensing Service) - "Acresso Software Inc." - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
"Google Software Updater" (gusvc) - "Google" - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
"Google Update Service (gupdate)" (gupdate) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"Google Update-Dienst (gupdatem)" (gupdatem) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"Intel® PROSet/Wireless Event Log" (EvtEng) - "Intel(R) Corporation" - C:\Program Files\Intel\WiFi\bin\EvtEng.exe
"Intel® PROSet/Wireless Registry Service" (RegSrvc) - "Intel(R) Corporation" - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
"iPod-Dienst" (iPod Service) - "Apple Inc." - C:\Program Files\iPod\bin\iPodService.exe
"IviRegMgr" (IviRegMgr) - "InterVideo" - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
"Microsoft Office Diagnostics Service" (odserv) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
"MSCSPTISRV" (MSCSPTISRV) - "Sony Corporation" - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
"NSUService" (NSUService) - "Sony Corporation" - C:\Program Files\Sony\Network Utility\NSUService.exe
"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"PACSPTISVR" (PACSPTISVR) - "Sony Corporation" - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
"Realtek Audio Service" (RtkAudioService) - "Realtek Semiconductor" - C:\Windows\RtkAudioService.exe
"Sony SPTI Service" (SPTISRV) - "Sony Corporation" - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
"VAIO Content Folder Watcher" (VCFw) - "Sony Corporation" - C:\Program Files\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe
"VAIO Content Metadata Intelligent Analyzing Manager" (VcmIAlzMgr) - "Sony Corporation" - C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe
"VAIO Content Metadata XML Interface" (VcmXmlIfHelper) - "Sony Corporation" - C:\Program Files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper.exe
"VAIO Entertainment Database Service" (VzCdbSvc) - "Sony Corporation" - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
"VAIO Entertainment TV Device Arbitration Service" (VAIO Entertainment TV Device Arbitration Service) - "Sony Corporation" - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzHardwareResourceManager\VzHardwareResourceManager\VzHardwareResourceManager.exe
"VAIO Entertainment UPnP Client Adapter" (Vcsw) - "Sony Corporation" - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
"VAIO Event Service" (VAIO Event Service) - "Sony Corporation" - C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
"VAIO Media plus Content Importer" (SOHCImp) - "Sony Corporation" - C:\Program Files\Sony\VAIO Media plus\SOHCImp.exe
"VAIO Media plus Device Searcher" (SOHDs) - "Sony Corporation" - C:\Program Files\Sony\VAIO Media plus\SOHDs.exe
"VAIO Media plus Digital Media Server" (SOHDms) - "Sony Corporation" - C:\Program Files\Sony\VAIO Media plus\SOHDms.exe

[Winlogon]
-----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify )-----
"VESWinlogon" - "Sony Corporation" - C:\Windows\system32\VESWinlogon.dll

[Winsock Providers]
-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries )-----
"mdnsNSP" - "Apple Inc." - C:\Program Files\Bonjour\mdnsNSP.dll

===[ Logfile end ]=========================================[ Logfile end ]===

--- --- ---

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru
Code:
aswMBR version 0.9.9.1297 Copyright(c) 2011 AVAST Software
Run date: 2012-01-10 14:34:24
-----------------------------
14:34:24.564    OS Version: Windows 6.0.6001 Service Pack 1
14:34:24.564    Number of processors: 2 586 0x1706
14:34:24.564    ComputerName: SCHATZIPU-PC  UserName: Schatzipu
14:34:32.163    Initialze error C000010E - driver not loaded
14:37:33.125    AVAST engine defs: 12011000
14:51:00.609    Scan error: Unzulässige Funktion.
14:51:21.985    The log file has been saved successfully to "C:\Users\Schatzipu\Desktop\aswMBR.txt"


aswMBR version 0.9.9.1297 Copyright(c) 2011 AVAST Software
Run date: 2012-01-10 14:33:52
-----------------------------
14:33:52.812    OS Version: Windows 6.0.6001 Service Pack 1
14:33:52.812    Number of processors: 2 586 0x1706
14:33:52.812    ComputerName: SCHATZIPU-PC  UserName: Schatzipu
14:34:34.886    Initialize success
14:34:35.058    write error "aswCmnB.dll". Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird.
14:54:19.147    AVAST engine defs: 12011000
14:54:21.598    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
14:54:21.598    Disk 0 Vendor: TOSHIBA_ LV01 Size: 305245MB BusType: 3
14:54:21.614    Disk 1  \Device\Harddisk1\DR1 -> \Device\0000006d
14:54:21.630    Disk 1 Vendor: RICOH 01 Size: 305245MB BusType: 0
14:54:21.630    Disk 2  \Device\Harddisk2\DR2 -> \Device\0000006e
14:54:21.645    Disk 2 Vendor: RICOH 02 Size: 305245MB BusType: 0
14:54:21.661    Disk 0 MBR read successfully
14:54:21.676    Disk 0 MBR scan
14:54:21.692    Disk 0 Windows VISTA default MBR code
14:54:21.723    Disk 0 Partition 1 80 (A) 27 Hidden NTFS WinRE NTFS        11485 MB offset 2048
14:54:21.786    Disk 0 Partition 2 00    07    HPFS/NTFS NTFS      293758 MB offset 23523328
14:54:21.801    Disk 0 Partition 3 00    07    HPFS/NTFS NTFS            0 MB offset 625140400
14:54:22.425    Disk 0 Partition 3  **INFECTED** MBR:Alureon-K [Rtk]
14:54:22.441    Disk 0 scanning sectors +625142432
14:54:22.488    Disk 0 scanning C:\Windows\system32\drivers
14:54:55.627    Service scanning
14:54:57.873    Modules scanning
14:55:15.377    Disk 0 trace - called modules:
14:55:15.408    ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll iaStor.sys
14:55:15.423    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8686cac8]
14:55:15.439    3 CLASSPNP.SYS[8a9a5745] -> nt!IofCallDriver -> [0x84d5a318]
14:55:15.455    5 acpi.sys[8068e6a0] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0x84d5d028]
14:55:18.965    AVAST engine scan C:\Windows
14:55:32.289    File: C:\Windows\PEV.exe  **INFECTED** Win32:Rootkit-gen [Rtk]
14:55:41.028    AVAST engine scan C:\Windows\system32
15:03:00.097    AVAST engine scan C:\Windows\system32\drivers
15:03:46.457    AVAST engine scan C:\Users\Schatzipu
15:07:44.615    Disk 0 MBR has been saved successfully to "C:\Users\Schatzipu\Desktop\MBR.dat"
15:07:44.630    The log file has been saved successfully to "C:\Users\Schatzipu\Desktop\aswMBR.txt"


aswMBR version 0.9.9.1297 Copyright(c) 2011 AVAST Software
Run date: 2012-01-10 14:33:52
-----------------------------
14:33:52.812    OS Version: Windows 6.0.6001 Service Pack 1
14:33:52.812    Number of processors: 2 586 0x1706
14:33:52.812    ComputerName: SCHATZIPU-PC  UserName: Schatzipu
14:34:34.886    Initialize success
14:34:35.058    write error "aswCmnB.dll". Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird.
14:54:19.147    AVAST engine defs: 12011000
14:54:21.598    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
14:54:21.598    Disk 0 Vendor: TOSHIBA_ LV01 Size: 305245MB BusType: 3
14:54:21.614    Disk 1  \Device\Harddisk1\DR1 -> \Device\0000006d
14:54:21.630    Disk 1 Vendor: RICOH 01 Size: 305245MB BusType: 0
14:54:21.630    Disk 2  \Device\Harddisk2\DR2 -> \Device\0000006e
14:54:21.645    Disk 2 Vendor: RICOH 02 Size: 305245MB BusType: 0
14:54:21.661    Disk 0 MBR read successfully
14:54:21.676    Disk 0 MBR scan
14:54:21.692    Disk 0 Windows VISTA default MBR code
14:54:21.723    Disk 0 Partition 1 80 (A) 27 Hidden NTFS WinRE NTFS        11485 MB offset 2048
14:54:21.786    Disk 0 Partition 2 00    07    HPFS/NTFS NTFS      293758 MB offset 23523328
14:54:21.801    Disk 0 Partition 3 00    07    HPFS/NTFS NTFS            0 MB offset 625140400
14:54:22.425    Disk 0 Partition 3  **INFECTED** MBR:Alureon-K [Rtk]
14:54:22.441    Disk 0 scanning sectors +625142432
14:54:22.488    Disk 0 scanning C:\Windows\system32\drivers
14:54:55.627    Service scanning
14:54:57.873    Modules scanning
14:55:15.377    Disk 0 trace - called modules:
14:55:15.408    ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll iaStor.sys
14:55:15.423    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8686cac8]
14:55:15.439    3 CLASSPNP.SYS[8a9a5745] -> nt!IofCallDriver -> [0x84d5a318]
14:55:15.455    5 acpi.sys[8068e6a0] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0x84d5d028]
14:55:18.965    AVAST engine scan C:\Windows
14:55:32.289    File: C:\Windows\PEV.exe  **INFECTED** Win32:Rootkit-gen [Rtk]
14:55:41.028    AVAST engine scan C:\Windows\system32
15:03:00.097    AVAST engine scan C:\Windows\system32\drivers
15:03:46.457    AVAST engine scan C:\Users\Schatzipu
15:07:44.615    Disk 0 MBR has been saved successfully to "C:\Users\Schatzipu\Desktop\MBR.dat"
15:07:44.630    The log file has been saved successfully to "C:\Users\Schatzipu\Desktop\aswMBR.txt"
15:07:55.449    Disk 0 MBR has been saved successfully to "C:\Users\Schatzipu\Desktop\MBR.dat"
15:07:55.449    The log file has been saved successfully to "C:\Users\Schatzipu\Desktop\aswMBR.txt"


aswMBR version 0.9.9.1297 Copyright(c) 2011 AVAST Software
Run date: 2012-01-10 22:47:00
-----------------------------
22:47:00.712    OS Version: Windows 6.0.6001 Service Pack 1
22:47:00.712    Number of processors: 2 586 0x1706
22:47:00.712    ComputerName: SCHATZIPU-PC  UserName: Schatzipu
22:47:02.585    Initialize success
22:47:17.545    AVAST engine defs: 12011000
22:47:21.258    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
22:47:21.258    Disk 0 Vendor: TOSHIBA_ LV01 Size: 305245MB BusType: 3
22:47:21.273    Disk 1  \Device\Harddisk1\DR1 -> \Device\0000006c
22:47:21.273    Disk 1 Vendor: RICOH 01 Size: 305245MB BusType: 0
22:47:21.289    Disk 2  \Device\Harddisk2\DR2 -> \Device\0000006d
22:47:21.289    Disk 2 Vendor: RICOH 02 Size: 305245MB BusType: 0
22:47:21.336    Disk 0 MBR read successfully
22:47:21.336    Disk 0 MBR scan
22:47:21.398    Disk 0 Windows VISTA default MBR code
22:47:21.429    Disk 0 Partition 1 80 (A) 27 Hidden NTFS WinRE NTFS        11485 MB offset 2048
22:47:21.461    Disk 0 Partition 2 00    07    HPFS/NTFS NTFS      293758 MB offset 23523328
22:47:21.461    Disk 0 scanning sectors +625140400
22:47:21.507    Disk 0 malicious Win32:MBRoot code @ sector 625140403 !
22:47:21.523    Disk 0 PE file @ sector 625140425 !
22:47:21.570    Disk 0 scanning C:\Windows\system32\drivers
22:47:42.240    Service scanning
22:47:43.987    Modules scanning
22:47:51.725    Disk 0 trace - called modules:
22:47:51.756    ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll iaStor.sys
22:47:51.771    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x861fc780]
22:47:51.787    3 CLASSPNP.SYS[8a9aa745] -> nt!IofCallDriver -> [0x85701408]
22:47:51.787    5 acpi.sys[806876a0] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0x85706028]
22:47:53.597    AVAST engine scan C:\Windows
22:47:55.609    File: C:\Windows\PEV.exe  **INFECTED** Win32:Rootkit-gen [Rtk]
22:48:01.942    AVAST engine scan C:\Windows\system32
22:51:34.141    AVAST engine scan C:\Windows\system32\drivers
22:52:15.467    AVAST engine scan C:\Users\Schatzipu
22:55:25.483    Disk 0 MBR has been saved successfully to "C:\Users\Schatzipu\Desktop\MBR.dat"
22:55:25.515    The log file has been saved successfully to "C:\Users\Schatzipu\Desktop\aswMBR.txt"


aswMBR version 0.9.9.1297 Copyright(c) 2011 AVAST Software
Run date: 2012-01-10 22:57:08
-----------------------------
22:57:08.209    OS Version: Windows 6.0.6001 Service Pack 1
22:57:08.209    Number of processors: 2 586 0x1706
22:57:08.225    ComputerName: SCHATZIPU-PC  UserName: Schatzipu
22:57:09.957    Initialize success
22:57:19.317    AVAST engine defs: 12011000
22:57:36.040    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
22:57:36.055    Disk 0 Vendor: TOSHIBA_ LV01 Size: 305245MB BusType: 3
22:57:36.055    Disk 1  \Device\Harddisk1\DR1 -> \Device\0000006c
22:57:36.071    Disk 1 Vendor: RICOH 01 Size: 305245MB BusType: 0
22:57:36.071    Disk 2  \Device\Harddisk2\DR2 -> \Device\0000006d
22:57:36.087    Disk 2 Vendor: RICOH 02 Size: 305245MB BusType: 0
22:57:36.149    Disk 0 MBR read successfully
22:57:36.165    Disk 0 MBR scan
22:57:36.180    Disk 0 Windows VISTA default MBR code
22:57:36.227    Disk 0 Partition 1 80 (A) 27 Hidden NTFS WinRE NTFS        11485 MB offset 2048
22:57:36.258    Disk 0 Partition 2 00    07    HPFS/NTFS NTFS      293758 MB offset 23523328
22:57:36.274    Disk 0 scanning sectors +625140400
22:57:36.352    Disk 0 malicious Win32:MBRoot code @ sector 625140403 !
22:57:36.367    Disk 0 PE file @ sector 625140425 !
22:57:36.477    Disk 0 scanning C:\Windows\system32\drivers
22:58:00.469    Service scanning
22:58:02.263    Modules scanning
22:58:10.828    Disk 0 trace - called modules:
22:58:10.859   
22:58:12.591    AVAST engine scan C:\Windows
22:58:14.962    File: C:\Windows\PEV.exe  **INFECTED** Win32:Rootkit-gen [Rtk]
22:58:46.491    AVAST engine scan C:\Windows\system32
23:01:44.281    AVAST engine scan C:\Windows\system32\drivers
23:02:06.589    AVAST engine scan C:\Users\Schatzipu
00:25:07.700    AVAST engine scan C:\ProgramData
00:49:54.215    Scan finished successfully
06:49:55.735    Disk 0 MBR has been saved successfully to "C:\Users\Schatzipu\Desktop\MBR.dat"
06:49:55.751    The log file has been saved successfully to "C:\Users\Schatzipu\Desktop\aswMBR.txt"

cosinus 11.01.2012 11:41
Zitat:
22:57:36.274 Disk 0 scanning sectors +625140400
22:57:36.352 Disk 0 malicious Win32:MBRoot code @ sector 625140403 !
22:57:36.367 Disk 0 PE file @ sector 625140425 !
Das sieht schonmal freundlich aus. Die besagten Sektoren zu löschen ist nicht unbedingt erforderlich, können wir aber tun wenn du willst.


Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!


Anschließend über den OnlineScanner von ESET eine zusätzliche Meinung zu holen ist auch nicht verkehrt:


ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


Olivia81 12.01.2012 05:51
hi Arne,
würde die Sektoren gerne löschen.
hat zwar ein wenig gedauert, aber hier sind die Logs

Code:
Malwarebytes Anti-Malware 1.60.0.1800
www.malwarebytes.org

Datenbank Version: v2012.01.11.03

Windows Vista Service Pack 1 x86 NTFS
Internet Explorer 8.0.6001.19019
Schatzipu :: SCHATZIPU-PC [Administrator]

11.01.2012 13:10:22
mbam-log-2012-01-11 (13-10-22).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 423582
Laufzeit: 3 Stunde(n), 36 Minute(n), 49 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
Code:
SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com

Generated 01/11/2012 at 08:40 PM

Application Version : 5.0.1142

Core Rules Database Version : 8121
Trace Rules Database Version: 5933

Scan type      : Complete Scan
Total Scan Time : 03:40:15

Operating System Information
Windows Vista Home Premium 32-bit, Service Pack 1 (Build 6.00.6001)
UAC On - Administrator

Memory items scanned      : 891
Memory threats detected  : 0
Registry items scanned    : 38822
Registry threats detected : 0
File items scanned        : 191817
File threats detected    : 11

Adware.Tracking Cookie
        C:\Users\Schatzipu\AppData\Roaming\Microsoft\Windows\Cookies\schatzipu@ads.immobilienscout24[1].txt [ /ads.immobilienscout24 ]
        C:\Users\Schatzipu\AppData\Roaming\Microsoft\Windows\Cookies\schatzipu@doubleclick[1].txt [ /doubleclick ]
        C:\USERS\GAST\AppData\Roaming\Microsoft\Windows\Cookies\gast@advertise[1].txt [ Cookie:gast@advertise.com/ ]
        C:\USERS\GAST\AppData\Roaming\Microsoft\Windows\Cookies\gast@apmebf[1].txt [ Cookie:gast@apmebf.com/ ]
        C:\USERS\GAST\AppData\Roaming\Microsoft\Windows\Cookies\gast@sonyeurope.112.2o7[1].txt [ Cookie:gast@sonyeurope.112.2o7.net/ ]
        C:\USERS\GAST\Cookies\gast@advertise[1].txt [ Cookie:gast@advertise.com/ ]
        C:\USERS\GAST\Cookies\gast@apmebf[1].txt [ Cookie:gast@apmebf.com/ ]
        C:\USERS\GAST\Cookies\gast@sonyeurope.112.2o7[1].txt [ Cookie:gast@sonyeurope.112.2o7.net/ ]
        C:\USERS\GAST\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\GAST@MEDIA6DEGREES[1].TXT [ /MEDIA6DEGREES ]
        cdn5.specificclick.net [ C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\G9M6ZF52 ]

Trojan.Agent/Gen-SoftonicDownloader
        C:\USERS\SCHATZIPU\DOWNLOADS\SOFTONICDOWNLOADER_FUER_GIMP.EXE
Code:
ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK

Grüße,
Olivia

cosinus 12.01.2012 07:50
Zitat:
würde die Sektoren gerne löschen.
Kommst du noch in PartedMagic rein, von der CD booten?

ESET Hast du falsch ausgeführt, so muss es gemacht werden: Anmerkung für Vista und Win7 User: Bitte den Browser unbedingt als Administrator starten.

Olivia81 12.01.2012 15:19
hier einmal esset, parted magic prüf ich gleich.
Code:
ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
esets_scanner_update returned -1 esets_gle=53251
# version=7
# iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=12e274edd79ce84d80e4b1c881e9cbb1
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-01-12 12:43:05
# local_time=2012-01-12 01:43:05 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.0.6001 NT Service Pack 1
# compatibility_mode=512 16777215 100 0 26051351 26051351 0 0
# compatibility_mode=1792 16777215 100 0 1952748 1952748 0 0
# compatibility_mode=5892 16776573 100 100 0 163891140 0 0
# compatibility_mode=8192 67108863 100 0 433190 433190 0 0
# scanned=221899
# found=3
# cleaned=0
# scan_time=13794
C:\Program Files\GridinSoft Trojan Killer\trojankiller.exe        a variant of Win32/1AntiVirus application (unable to clean)        00000000000000000000000000000000        I
C:\Users\Schatzipu\Desktop\trojankiller2116-setup.exe        a variant of Win32/1AntiVirus application (unable to clean)        00000000000000000000000000000000        I
C:\Users\Schatzipu\Downloads\SoftonicDownloader_fuer_gimp.exe        a variant of Win32/SoftonicDownloader.A application (unable to clean)        00000000000000000000000000000000        I

cosinus 12.01.2012 15:24
TrojanerKiller kannste deinstalliern, das braucht man nicht.
Die beiden Setups trojankiller2116-setup.exe und SoftonicDownloader_fuer_gimp.exe einfach löschen

Olivia81 12.01.2012 16:16
hallo Arne,
habe alles gelöscht, in PartedMagic komme ich leider nicht mehr rein - erhalte nach wie vor die selbe Fehlermeldung.
Grüße,
Olivia

cosinus 12.01.2012 18:25
Ich kann mir einfach nicht vorstellen, dass das nun nicht mehr funktionieren soll.
Was machst du nun anders? Wie genau bootest du? Hier von Option 1 oder nimmst du als Sprache Deutsch? (Language => German)

http://images.netzwelt.de/thumb/9/20...rted-magic.jpg

Olivia81 12.01.2012 19:09
Liste der Anhänge anzeigen (Anzahl: 1)
hallo Arne,
habe immer Option 1 ausgewaehlt, funktionierte trotzdem nicht, habe daher die CD nochmals gebrannt. Hat geklappt, anbei ein Screenshot von GParted.
Gruesse,
Olivia81

cosinus 12.01.2012 20:18
So ganz wichtig. Versuch mal aus dem unzugeordneten 1MB-Happen eine Partition zu erstellen. Dateisystem ist egal, nimm mal am besten FAT. Übernimm das ganze und schließe die Aktion ab.
Beende GParted und öffne es wieder (du musst NICHT den Rechner neu von der CD booten!)
Mach wieder einen neuen Screenshot und poste den

Olivia81 12.01.2012 21:00
Liste der Anhänge anzeigen (Anzahl: 1)
hi Arne,
bin mir nicht sicher, ob ich es richtig gemacht habe.
Anbei der Screenshot.
Gruesse,
Olivia

cosinus 12.01.2012 21:21
Nein :D
Klick den unteren Bereich an uns sag neue Partition, FAT => ok
Wenn du das trotzdem nicht schaffst einfach das 1MB Häppchen anklicken => Info
Das Info Fenster offen lassen, Screenshot machen und hier poste

Olivia81 12.01.2012 22:18
Liste der Anhänge anzeigen (Anzahl: 1)
sorry, bekomm ich nicht hin...

cosinus 12.01.2012 22:31
Ok. Aber der screenshot reicht mir. Wie gesagt was jetzt folgt und du hast Datenverluste seist du jetzt nochmal ausdrücklich gewarnt, alles richtig umzusetzen und vorher alles wichtige auf externe Platten zu sichern. Wenn du sicher bist, dass alle wichtige Daten in Sicherheit sind und die externen Datenträger auch nicht mehr am Rechner angeschlossen sind, dann fahre fort wir folgt:

Öffne das Terminal in PartedMagic. Ist unten in der Quicklaunch der schwarze Monitor. Eine schwarze Konsole öffnet sich. Tipp dort ein (du solltest root@partedmagic in der Zeile lesen können)

WARNUNG: Folgender Befehl auf eigene Gefahr! Für Datenverluste nicht rumheulen und wer das mitliest soll den Befehl ebenfalls nicht so ausführen!!

@Olivia: Bitte lieber eher 3x als 2x prüfen ob du alles so richtig eingetippt hast NACH der Datensicherung:

Code:
dd if=/dev/zero of=/dev/sda seek=625140401 bs=512
Wenn du dir sicher bist das genau so eingetippt zu haben wie es da bei mir steht, dann drücke die Eingabetaste. Es dauert nicht lange, dann hast du wieder die Zeile und sinngemäß so etwas wie

2048+0 Datensätze ein
2048+0 Datensätze aus

Wenn das so rauskaum (können auch 2047 statt 2048 sein) starte den Rechner neu und boote Windows.
Mach dort einen neuen scan mit aswMBR und poste wieder das Log.

Olivia81 13.01.2012 14:38
Code:
aswMBR version 0.9.9.1297 Copyright(c) 2011 AVAST Software
Run date: 2012-01-13 12:43:29
-----------------------------
12:43:29.478    OS Version: Windows 6.0.6001 Service Pack 1
12:43:29.478    Number of processors: 2 586 0x1706
12:43:29.478    ComputerName: SCHATZIPU-PC  UserName: Schatzipu
12:43:34.489    Initialize success
12:43:46.519    AVAST engine defs: 12011201
12:43:51.090    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
12:43:51.090    Disk 0 Vendor: TOSHIBA_ LV01 Size: 305245MB BusType: 3
12:43:51.090    Disk 1  \Device\Harddisk1\DR1 -> \Device\0000006f
12:43:51.106    Disk 1 Vendor: RICOH 01 Size: 305245MB BusType: 0
12:43:51.106    Disk 2  \Device\Harddisk2\DR2 -> \Device\00000070
12:43:51.121    Disk 2 Vendor: RICOH 02 Size: 305245MB BusType: 0
12:43:51.153    Disk 0 MBR read successfully
12:43:51.153    Disk 0 MBR scan
12:43:51.168    Disk 0 Windows VISTA default MBR code
12:43:51.215    Disk 0 Partition 1 80 (A) 27 Hidden NTFS WinRE NTFS        11485 MB offset 2048
12:43:51.309    Disk 0 Partition 2 00    07    HPFS/NTFS NTFS      293758 MB offset 23523328
12:43:51.324    Disk 0 Partition 3 00    07    HPFS/NTFS                1 MB offset 625140400
12:43:51.340    Disk 0 scanning sectors +625142448
12:43:51.418    Disk 0 scanning C:\Windows\system32\drivers
12:44:11.888    Service scanning
12:44:13.963    Modules scanning
12:44:27.707    Disk 0 trace - called modules:
12:44:27.754    ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll iaStor.sys partmgr.sys volmgr.sys ecache.sys volsnap.sys Ntfs.sys
12:44:27.770    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x861d7ac8]
12:44:27.770    3 CLASSPNP.SYS[8a9aa745] -> nt!IofCallDriver -> [0x84d508d8]
12:44:27.785    5 acpi.sys[806886a0] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0x84d5c028]
12:44:30.204    AVAST engine scan C:\Windows
12:44:32.872    File: C:\Windows\PEV.exe  **INFECTED** Win32:Rootkit-gen [Rtk]
12:44:38.336    AVAST engine scan C:\Windows\system32
12:49:38.418    AVAST engine scan C:\Windows\system32\drivers
12:50:32.571    AVAST engine scan C:\Users\Schatzipu
13:48:34.818    AVAST engine scan C:\ProgramData
14:13:12.574    Scan finished successfully
14:36:23.899    Disk 0 MBR has been saved successfully to "C:\Users\Schatzipu\Desktop\MBR.dat"
14:36:23.931    The log file has been saved successfully to "C:\Users\Schatzipu\Desktop\aswMBR2.txt"

cosinus 13.01.2012 16:05
Sehr schön hat gut geklappt oder war schwierig zu verstehen meine Anleitung? :)

Zitat:
File: C:\Windows\PEV.exe **INFECTED** Win32:Rootkit-gen [Rtk]
Ein ein Fehlalarm gehört zu Combofix
Die die KOntrollscans auch durch sind kann ich nur noch fragen ob dein Rechner soweit wieder im Lot ist oder ob noch was offen ist.
Falls die dritte Partition noch auftaucht, einfach wieder löschen über die Datenträgerverwaltung in Windows. Notfalls fragen wenn du dir unsicher bist.

Olivia81 13.01.2012 17:35
hi Arne,
vielen Dank - war leicht zu folgen :)
Im Startmenü sind die Ordner leer, obwohl sie im Explorer nun zu sehen sind. Weißt du, wie ich das wieder hinbekomme?
Ich habe insgesamt den Eindruck, dass der Rechner etwas langsamer läuft. Möchte ich zB eine einefache Textdatei vom Desktop löschen, löscht er sie zwar, aber das Fenster "Recyceln von 1 Element" bleibt stecken. Wenn ich versuche, es über den Task-Manager zu schließen, meldet sich zuerst kurz Windows Vista mit dem Herunterfahren-Schirm und dann der Programm Manager mit "Das Programm reagiert nicht."
Sind das die Nachwehen des Schädlings? Sollte ich einige Programme auch wieder neu installieren bzw. auch auf einen anderen Virenschutz wechseln?
Vielen lieben Dank für deine Hilfe.
Grüße,
Olivia

cosinus 13.01.2012 18:21
Erstell mal über die Systemsteuerung/Benutzerkonten einen neuen Benutzer zB Test
Log dich aus und mit Test ein.
Schau nach ob es dort auch langsamer ist als gewöhnlich und ob dort die Stermenüs auch leer sind.-

Olivia81 13.01.2012 20:52
hallo Arne,
verhält sich bei dem neuen Benutzerkonto leider genau so.
Grüße,
Olivia

cosinus 13.01.2012 23:13
Was denn? Beides also langsam und Startmenü leer oder nur eins von beiden?

Olivia81 14.01.2012 05:38
Beides leider

cosinus 14.01.2012 13:58
Na klasse, dann hat der Schädling doch schon einiges zerstört, oftmals lassen sich solche Auswirkungen durch eine Bereinigung aber beheben bei dir wohl nicht :(
Du solltest eine Reaparatur- oder Neuinstallation vornehmen

Olivia81 14.01.2012 16:28
hi Arne,
werde ich wohl machen müssen.
Vielen Dank auf alle Fälle für deine Hilfe.
Nur noch eine letzte Frage: hast du einen Tipp bzg. Virenprogramm??
Grüße,
Olivia

Olivia81 14.01.2012 16:39
Und noch eine Sache: die externe Festplattte - muss ich diese nun eigentlich auch formatieren?

cosinus 14.01.2012 17:19
Zitat:
muss ich diese nun eigentlich auch formatieren?
Nein.

Zitat:
hast du einen Tipp bzg. Virenprogramm??
Es heißt AntiVirenProgramm (AVP) oder Virenscanner aber nicht Virenprogramm.

Die Frage - welcher Virenscanner oder ob der installierte reicht - taucht ständig auf.
Der Virenscanner - egal welcher - kann und wird niemals 100% Schutz bieten können. Neue/unbekannte Schädlinge können immer durch die Lappen gehen. Geld ausgeben muss man nicht für einen Scanner, sowas wie Avast oder Microsoft Security Essentials sind für die privaten Gebrauch völlig ausreichend.
Abgesehen davon nutzen verschiedene Virenscanner unterschiedliche Signaturen und Techniken, das führt dazu, dass zB Scanner1 Schädling X entdeckt, aber Schädling Y übersieht. Scanner2 erkennt Schädling Y, dafür aber Schädling X nicht...
Wichtiger ist, dass du dich an Regeln hälst. Der beste Virenscanner bringt nichts, wenn du dich falsch verhälst und fahrlässig/unvorsichtig bist. Airbag und Sicherheitsgurt im Auto sind ja auch keine Gründe dafür auf die Verkehrsregeln zu pfeifen.

Halte Dich am besten grob an diese Regeln:
  1. Sei misstrauisch im Internet und v.a. bei unbekannten E-Mails, sei vorsichtig bei der Herausgabe persönlicher Daten!!
  2. Halte Windows und alle verwendeten Programme immer aktuell - unterstützen kann dich dabei Secunia PSI
  3. Führe regelmäßig Backups auf externe Medien durch
  4. Arbeite mit eingeschränkten Rechten
  5. Nutze sicherere Programme wie zB Opera oder Firefox zum Surfen statt den IE, zum Mailen Thunderbird statt Outlook Express - E-Mails nur als reinen text anzeigen lassen
  6. automatische Wiedergabe von allen Laufwerken komplett deaktivieren, denn das ist ein unnötiges Sicherheitsrisiko
  7. Bei der Installation von Software möglichst darauf achten, dass die Setups aus offiziellen Quellen stammen und du bei der Installation nach Möglichkeit die benutzerdefinierte Methode wählst - dann hast du die Möglichkeit etwaigen Schrott (wie Toolbars oder sowas wie RegistryBooster) abzuwählen, welcher sonst einfach mitinstalliert wird.
  8. Bösartige bzw. ungewollte Sites von vornherein blockieren lassen mit Hilfe der MVPS Hosts File => Blocking Unwanted Parasites with a Hosts File


Alles noch genauer erklärt steht hier => Kompromittierung unvermeidbar?

Olivia81 14.01.2012 23:34
hallo Arne,
nochmals vielen Dank für deine Zeit & Unterstützung - und für die Tipps!!
Grüße,
Olivia


Alle Zeitangaben in WEZ +1. Es ist jetzt 00:52 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131