Trojaner-Board - Startmenü leer und Verknüpfungen überwiegend verschwunden

Trojaner-Board (https://www.trojaner-board.de/)

- Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)

- - Startmenü leer und Verknüpfungen überwiegend verschwunden (https://www.trojaner-board.de/110200-startmenue-leer-verknuepfungen-ueberwiegend-verschwunden.html)

Startmenü leer und Verknüpfungen überwiegend verschwunden

Hallo liebe Leute

Ich habe mir gestern Abend aus reiner Neugierde MSN-Discovery
runtergeladen und installiert. Nach kurzem Betrachten, wollte ich
dann eigentlich schlafen gehen. Jetzt war es schon sehr spät und
ich sehr müde (2:00 Uhr) und ich weiß jetzt nicht mehr, ob ich erst
den PC neugestartet hab oder ob ich sofort die Probleme hatte, jedenfalls
ist mein Hintergrund verschwunden, die ganzen Verknüpfungen in
der Schnellstartleiste, überwiegend auf meinem Desktop und mein
Startmenü ist leer.
Wenn ich jetzt aber auf "Alle Programme" klicke, erscheint doch noch
einiges, aber die linke Navigation, über der man zur Systemsteuerung
z.B. kommt, bleibt verschwunden.

Ich versuchte erstmal, den Taskmanager aufzurufen, leider war dieser
nicht mehr wählbar - dieses Problem konnte ich aber zum Glück über
Google lösen, indem ich den nötigen Wert in der Registry gelöscht hab.

Mein Antivirenprogramm (Avira) findet nichts, CCleaner lief ebenso schon
und mein AntiMalware Programm lässt sich nicht mehr finden, da auch
diese Verknüpfung fehlt und ich den Namen nicht mehr weiß - war total
neu. Noch vor kurzem habe ich alles geprüft und keine Viren/Trojaner
gefunden, also muss es ja von diesem Discovery Programm für MSN
kommen.

Nur dachte ich, ein direkter Download von Chip.de ist überwiegend
unproblematisch.

Habe Windows Vista Home Premium 32bit auf dem Rechner.
Sonst läuft hier auch alles wunderbar, was mich fast noch
stutziger macht.

Sollte ich irgendwelche Infos vergessen haben, einfach sagen.
Vielen Dank schonmal für eure Hilfe. :)

Lg Shadow315

Bitte nun routinemäßig einen Vollscan mit malwarebytes machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss! Außerdem müssen alle Funde entfernt werden.

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:

hier steht das Log

Also erstmal die letzten Logs von Malwarebytes:

Code:

Malwarebytes Anti-Malware (Test) 1.60.1.1000

www.malwarebytes.org
 

Datenbank Version: v2012.02.21.02
 

Windows Vista Service Pack 2 x86 NTFS

Internet Explorer 9.0.8112.16421

Shadow315 :: SHADOW315-PC [Administrator]
 

Schutz: Aktiviert
 

21.02.2012 07:27:40

mbam-log-2012-02-21 (07-27-40).txt
 

Art des Suchlaufs: Quick-Scan

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 194207

Laufzeit: 6 Minute(n), 41 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 3

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced|Start_ShowMyComputer (PUM.Hijack.StartMenu) -> Bösartig: (0) Gut: (1) -> Erfolgreich ersetzt und in Quarantäne gestellt.

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced|Start_ShowSearch (PUM.Hijack.StartMenu) -> Bösartig: (0) Gut: (1) -> Erfolgreich ersetzt und in Quarantäne gestellt.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System|DisableTaskMgr (PUM.Hijack.TaskManager) -> Bösartig: (1) Gut: (0) -> Erfolgreich ersetzt und in Quarantäne gestellt.
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 2

C:\ProgramData\BHMmHjYKMAcfJ.exe (Trojan.FakeAlert) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Windows\Temp\cnsojm\setup.exe (Spyware.Zeus) -> Erfolgreich gelöscht und in Quarantäne gestellt.
 

(Ende)

Code:

Malwarebytes Anti-Malware (Test) 1.60.1.1000

www.malwarebytes.org
 

Datenbank Version: v2012.02.21.02
 

Windows Vista Service Pack 2 x86 NTFS (Abgesichertenmodus)

Internet Explorer 9.0.8112.16421

Shadow315 :: SHADOW315-PC [Administrator]
 

Schutz: Deaktiviert
 

21.02.2012 08:15:23

mbam-log-2012-02-21 (08-15-23).txt
 

Art des Suchlaufs: Vollständiger Suchlauf

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 356027

Laufzeit: 49 Minute(n), 37 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 0

(Keine bösartigen Objekte gefunden)
 

(Ende)

Code:

Malwarebytes Anti-Malware (Test) 1.60.1.1000

www.malwarebytes.org
 

Datenbank Version: v2012.02.21.02
 

Windows Vista Service Pack 2 x86 NTFS

Internet Explorer 9.0.8112.16421

Shadow315 :: SHADOW315-PC [Administrator]
 

Schutz: Aktiviert
 

21.02.2012 13:21:36

mbam-log-2012-02-21 (13-21-36).txt
 

Art des Suchlaufs: Benutzerdefinierter Suchlauf

Aktivierte Suchlaufeinstellungen: Dateisystem | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Heuristiks/Extra | P2P

Durchsuchte Objekte: 137076

Laufzeit: 3 Stunde(n), 31 Minute(n), 17 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 0

(Keine bösartigen Objekte gefunden)
 

(Ende)

Jetzt den ESET-Log:

Code:

ESETSmartInstaller@High as downloader log:

all ok

# version=7

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6583

# api_version=3.0.2

# EOSSerial=2be8344a6d020940b370dc2b3210b0a9

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2012-02-21 07:29:05

# local_time=2012-02-21 08:29:05 (+0100, Mitteleuropäische Zeit)

# country="Germany"

# lang=1033

# osver=6.0.6002 NT Service Pack 2

# compatibility_mode=5892 16776574 66 100 23344661 167378757 0 0

# compatibility_mode=8192 67108863 100 0 3685 3685 0 0

# scanned=192093

# found=3

# cleaned=0

# scan_time=6515

C:\Program Files\VistaCodecPack\Tools\renderer32.exe        Win32/Packed.Autoit.E.Gen application (unable to clean)        00000000000000000000000000000000        I

C:\ProgramData\VistaCodecs\{146A630B-CF66-4B5E-95BF-478A16039BF3}\Vista Codec Package.msi        Win32/Packed.Autoit.E.Gen application (unable to clean)        00000000000000000000000000000000        I

C:\Users\All Users\VistaCodecs\{146A630B-CF66-4B5E-95BF-478A16039BF3}\Vista Codec Package.msi        Win32/Packed.Autoit.E.Gen application (unable to clean)        00000000000000000000000000000000        I

In der Zwischenzeit habe ich natürlich einige Virenprogramme durchlaufen
lassen und kaum einer hat etwas angezeigt, bis auf die beiden, die hier
empfohlen wurden.

Eine infizierte Datei aus dem Windows/System32/Drivers/ konnte ich im
abgesicherten Modus manuell löschen, alles andere war dann vergebene
Mühe.

Zitat:

Eine infizierte Datei aus dem Windows/System32/Drivers/ konnte ich im
abgesicherten Modus manuell löschen, alles andere war dann vergebene

Die da wäre? Was wurde da angezeigt, woher weißt du dass die infiziert war?

Zitat:

Zitat von cosinus (Beitrag 778482)

Die da wäre? Was wurde da angezeigt, woher weißt du dass die infiziert war?

Zum Glück hab ich mir die aufgeschrieben.
Gefunden wurden ganz zu Beginn - mit Emsisoft Anti-Malware - wurden
folgende Dateien als infiziert erkannt:

Virus.Win32.Vundo!E2
c:\Windows\System32\Drivers\i8042prt.sys

Trace.File.discoverylive!E1
c:\program files\messengerdiscovery

Im abgesicherten Modus wurde nur noch die erste, also die
i8042prt.sys entdeckt, nur konnte sie weder gelöscht noch in die
Quarantäne verschoben werden. Irgendwann hab ich dann verzweifelt
versucht, diese manuell zu löschen was normalerweise nie funktioniert
aber diesesmal war es anders.

Nach mehrmaligen Neustarts und Scans bzw seitdem generell, wird mir
da nichts mehr gemeldet.

Hast du die Datei oder wurde die komplett gelöscht?

Laut der Windows-Suche ist diese Datei nicht auffindbar, wohl
aber der Scanlog von Emsisoft:

Code:

Emsisoft Anti-Malware - Version 6.0

Letztes Update: 20.02.2012 21:56:07
 

Scan Einstellungen:
 

Scan Methode: Detail Scan

Objekte: Rootkits, Speicher, Traces, C:\, D:\

Archiv Scan: An

ADS Scan: An
 

Scan Beginn:        20.02.2012 22:58:49
 

C:\Windows\System32\Drivers\i8042prt.sys         gefunden: Virus.Win32.Vundo!E2
 

Gescannt        429273

Gefunden        1
 

Scan Ende:        20.02.2012 23:00:50

Scan Zeit:        0:02:01
 
 

Quarantäne        0

Mach bitte ein neues OTL-Log. Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:

hier steht das Log

CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

Starte bitte die OTL.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Setze oben mittig den Haken bei Scanne alle Benutzer
Kopiere nun den kompletten Inhalt aus der untenstehenden Codebox in die http://billy-oneal.com/Canned%20Spee.../customFix.png Textbox von OTL - wenn OTL auf deutsch ist wird sie mit http://larusso.trojaner-board.de/Images/otlfix.jpg beschriftet

Code:

netsvcs

msconfig

safebootminimal

safebootnetwork

activex

drivers32

%ALLUSERSPROFILE%\Application Data\*.

%ALLUSERSPROFILE%\Application Data\*.exe /s

%APPDATA%\*.

%APPDATA%\*.exe /s

%SYSTEMDRIVE%\*.exe

/md5start

wininit.exe

userinit.exe

eventlog.dll

scecli.dll

netlogon.dll

cngaudit.dll

ws2ifsl.sys

sceclt.dll

ntelogon.dll

winlogon.exe

logevent.dll

user32.DLL

iaStor.sys

nvstor.sys

atapi.sys

IdeChnDr.sys

viasraid.sys

AGP440.sys

vaxscsi.sys

nvatabus.sys

viamraid.sys

nvata.sys

nvgts.sys

iastorv.sys

ViPrt.sys

eNetHook.dll

ahcix86.sys

KR10N.sys

nvstor32.sys

ahcix86s.sys

/md5stop

%systemroot%\system32\drivers\*.sys /lockedfiles

%systemroot%\System32\config\*.sav

%systemroot%\*. /mp /s

%systemroot%\system32\*.dll /lockedfiles

CREATERESTOREPOINT

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Klick auf http://billy-oneal.com/Canned%20Spee.../OTL/btnOK.png.
Kopiere nun den Inhalt aus OTL.txt hier in Deinen Thread

OTL-txt:

Code:

OTL logfile created on: 22.02.2012 19:36:07 - Run 1

OTL by OldTimer - Version 3.2.33.2     Folder = C:\Users\Shadow315\Desktop

Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

2,00 Gb Total Physical Memory | 0,82 Gb Available Physical Memory | 41,04% Memory free

4,25 Gb Paging File | 2,05 Gb Available in Paging File | 48,24% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 315,33 Gb Total Space | 100,38 Gb Free Space | 31,83% Space Free | Partition Type: NTFS

Drive D: | 20,00 Gb Total Space | 13,42 Gb Free Space | 67,08% Space Free | Partition Type: FAT32

Drive J: | 931,51 Gb Total Space | 744,92 Gb Free Space | 79,97% Space Free | Partition Type: NTFS

 

Computer Name: SHADOW315-PC | User Name: Shadow315 | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2012.02.22 19:30:47 | 000,583,680 | ---- | M] (OldTimer Tools) -- C:\Users\Shadow315\Desktop\OTL(1).exe

PRC - [2012.02.16 15:55:51 | 000,924,632 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe

PRC - [2012.01.22 08:40:04 | 003,025,112 | ---- | M] (Emsi Software GmbH) -- C:\Program Files\Emsisoft Anti-Malware\a2service.exe

PRC - [2012.01.13 14:53:18 | 000,652,360 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

PRC - [2011.10.12 21:10:00 | 000,397,312 | ---- | M] (AMD) -- C:\Windows\System32\atieclxx.exe

PRC - [2011.10.12 21:09:32 | 000,176,128 | ---- | M] (AMD) -- C:\Windows\System32\atiesrxx.exe

PRC - [2011.10.12 16:18:28 | 000,291,840 | ---- | M] (Advanced Micro Devices, Inc.) -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe

PRC - [2011.06.15 15:16:48 | 000,997,920 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Security Client\msseces.exe

PRC - [2011.04.27 15:39:26 | 000,208,944 | ---- | M] (Microsoft Corporation) -- c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe

PRC - [2011.04.27 15:39:26 | 000,011,736 | ---- | M] (Microsoft Corporation) -- c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe

PRC - [2011.04.01 06:11:52 | 000,428,640 | ---- | M] (Logitech Inc.) -- C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe

PRC - [2009.04.11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe

 

 
 ========== Modules (No Company Name) ==========

 

MOD - [2012.02.16 15:55:51 | 001,911,768 | ---- | M] () -- C:\Program Files\Mozilla Firefox\mozjs.dll

MOD - [2011.12.08 13:23:48 | 008,527,008 | ---- | M] () -- C:\Windows\System32\Macromed\Flash\NPSWF32.dll

MOD - [2011.10.12 20:28:52 | 000,037,376 | ---- | M] () -- C:\Windows\System32\atitmpxx.dll

MOD - [2011.08.07 21:41:18 | 000,046,592 | ---- | M] () -- C:\Program Files\Windows Live\Contacts\VERSION.dll

MOD - [2011.08.07 14:54:16 | 000,004,096 | ---- | M] () -- C:\Program Files\Yuna Software\Messenger Plus!\detour32.dll

MOD - [2011.04.11 13:58:21 | 000,390,656 | ---- | M] () -- C:\Program Files\Yuna Software\Messenger Plus!\lame_enc.dll

MOD - [2011.04.11 13:58:17 | 000,370,688 | ---- | M] () -- C:\Program Files\Yuna Software\Messenger Plus!\libsndfile.dll

MOD - [2010.01.20 19:55:31 | 000,163,728 | ---- | M] () -- C:\Program Files\Lavasoft\Ad-Aware\ShellExt.dll

MOD - [2007.09.20 17:34:58 | 000,129,024 | ---- | M] () -- C:\Program Files\WinRAR\rarext.dll

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV - [2012.01.22 08:40:04 | 003,025,112 | ---- | M] (Emsi Software GmbH) [Auto | Running] -- C:\Program Files\Emsisoft Anti-Malware\a2service.exe -- (a2AntiMalware)

SRV - [2012.01.13 14:53:18 | 000,652,360 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)

SRV - [2011.10.12 21:09:32 | 000,176,128 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\System32\atiesrxx.exe -- (AMD External Events Utility)

SRV - [2011.10.12 16:18:28 | 000,291,840 | ---- | M] (Advanced Micro Devices, Inc.) [Auto | Running] -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe -- (AMD FUEL Service)

SRV - [2011.04.27 15:39:26 | 000,208,944 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe -- (NisSrv)

SRV - [2011.04.27 15:39:26 | 000,011,736 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe -- (MsMpSvc)

SRV - [2011.04.01 06:11:52 | 000,428,640 | ---- | M] (Logitech Inc.) [Auto | Running] -- C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe -- (UMVPFSrv)

SRV - [2011.03.16 09:42:06 | 000,407,336 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Steam\SteamService.exe -- (Steam Client Service)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - [2012.02.21 12:29:49 | 000,242,240 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\Windows\System32\drivers\dtsoftbus01.sys -- (dtsoftbus01)

DRV - [2011.12.10 15:24:06 | 000,020,464 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector)

DRV - [2011.11.02 10:13:12 | 000,051,632 | ---- | M] (Emsi Software GmbH) [File_System | On_Demand | Running] -- C:\PROGRAM FILES\EMSISOFT ANTI-MALWARE\a2accx86.sys -- (a2acc)

DRV - [2011.10.12 21:55:06 | 008,598,528 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\atikmdag.sys -- (R300)

DRV - [2011.10.12 21:55:06 | 008,598,528 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\atikmdag.sys -- (atikmdag)

DRV - [2011.10.12 21:55:06 | 008,598,528 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (amdkmdag)

DRV - [2011.10.12 20:30:18 | 000,257,024 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmpag.sys -- (amdkmdap)

DRV - [2011.06.06 23:06:42 | 000,081,936 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AtihdLH3.sys -- (AtiHDAudioService)

DRV - [2011.05.19 13:10:34 | 000,017,904 | ---- | M] (Emsi Software GmbH) [Kernel | System | Running] -- C:\Program Files\Emsisoft Anti-Malware\a2ddax86.sys -- (A2DDA)

DRV - [2011.04.27 15:25:24 | 000,065,024 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\NisDrvWFP.sys -- (NisDrv)

DRV - [2011.04.18 13:18:50 | 000,043,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\MpNWMon.sys -- (MpNWMon)

DRV - [2011.04.01 06:11:10 | 004,333,280 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\lvuvc.sys -- (LVUVC) Logitech HD Webcam C270(UVC)

DRV - [2011.04.01 06:09:48 | 000,291,424 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\lvrs.sys -- (LVRS)

DRV - [2010.06.23 08:21:32 | 000,259,176 | ---- | M] (Realtek                                            ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169)

DRV - [2010.02.18 09:18:22 | 000,037,944 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\amdiox86.sys -- (amdiox86)

DRV - [2008.05.02 09:58:28 | 000,008,064 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\usbser_lowerfltj.sys -- (UsbserFilt)

DRV - [2008.05.02 09:58:14 | 000,020,864 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ccdcmbo.sys -- (nmwcdc)

DRV - [2008.05.02 09:58:14 | 000,008,064 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\usbser_lowerflt.sys -- (upperdev)

DRV - [2008.05.02 09:58:12 | 000,017,536 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ccdcmb.sys -- (nmwcd)

DRV - [2004.10.26 10:22:50 | 000,002,410 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Program Files\FreshDevices\FreshDiagnose\FreshIO.sys -- (FreshIO)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank

 

 

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

 

 

IE - HKU\S-1-5-21-1955313859-1678149478-2173258271-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.farmerama.de/

IE - HKU\S-1-5-21-1955313859-1678149478-2173258271-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp

IE - HKU\S-1-5-21-1955313859-1678149478-2173258271-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de

IE - HKU\S-1-5-21-1955313859-1678149478-2173258271-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 7C E9 8C 6E 2A BE CB 01  [binary data]

IE - HKU\S-1-5-21-1955313859-1678149478-2173258271-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1

IE - HKU\S-1-5-21-1955313859-1678149478-2173258271-1000\..\URLSearchHook: {64ead72b-ffd4-4e01-aa3a-4c71665d73e4} - No CLSID value found

IE - HKU\S-1-5-21-1955313859-1678149478-2173258271-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 
 ========== FireFox ==========

 

FF - prefs.js..browser.search.defaultengine: "Ask.com"

FF - prefs.js..browser.search.defaultenginename: "Ask.com"

FF - prefs.js..browser.search.defaultthis.engineName: "Bigpoint Games DE Customized Web Search"

FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2843456&SearchSource=3&q={searchTerms}"

FF - prefs.js..browser.search.order.1: "Ask.com"

FF - prefs.js..browser.search.selectedEngine: "Bigpoint Games DE Customized Web Search"

FF - prefs.js..browser.search.useDBForOrder: true

FF - prefs.js..browser.startup.homepage: "hxxp://www.united-forum.de/"

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}:6.0.25

FF - prefs.js..extensions.enabledItems: engine@conduit.com:3.3.3.2

FF - prefs.js..extensions.enabledItems: moveplayer@movenetworks.com:1.0.0.071303000004

FF - prefs.js..extensions.enabledItems: {0e3dbc69-a682-48da-84e1-82c63a5d678e}:3.3.3.2

FF - prefs.js..extensions.enabledItems: {64ead72b-ffd4-4e01-aa3a-4c71665d73e4}:3.2.5.2

FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.8.2

FF - prefs.js..extensions.enabledItems: {e001c731-5e37-4538-a5cb-8168736a2360}:0.9.9.109

FF - prefs.js..extensions.enabledItems: {07b2a769-ed19-4483-87ce-c643914c81bb}:3.0.0.91

FF - prefs.js..keyword.URL: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2843456&q=&SearchSource=2"

 

 

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()

FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)

FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)

FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll File not found

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.448: C:\Program Files\VistaCodecPack\rm\browser\plugins\nppl3260.dll (RealNetworks, Inc.)

FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.46: C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)

FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.3.46: C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)

FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.448: C:\Program Files\VistaCodecPack\rm\browser\plugins\nprpjplug.dll (RealNetworks, Inc.)

FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.46: C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)

FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=:  File not found

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@veetle.com/veetleCorePlugin,version=0.9.18: C:\Program Files\Veetle\plugins\npVeetle.dll (Veetle Inc)

FF - HKLM\Software\MozillaPlugins\@veetle.com/veetlePlayerPlugin,version=0.9.18: C:\Program Files\Veetle\Player\npvlc.dll (Veetle Inc)

FF - HKCU\Software\MozillaPlugins\@movenetworks.com/Quantum Media Player:  File not found

FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Program Files\Real\RealPlayer\browserrecord [2008.09.12 00:23:58 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.02.18 11:31:51 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.02.18 11:31:50 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 4.0b9\extensions\\Components: C:\Program Files\Mozilla Firefox 4.0 Beta 9\components [2011.01.20 14:21:18 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 4.0b9\extensions\\Plugins: C:\Program Files\Mozilla Firefox 4.0 Beta 9\plugins

 

[2008.09.10 13:40:34 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Shadow315\AppData\Roaming\mozilla\Extensions

[2012.02.19 11:36:34 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Shadow315\AppData\Roaming\mozilla\Firefox\Profiles\wa7hn65n.default\extensions

[2010.10.07 07:43:20 | 000,000,000 | ---D | M] (Vista-aero) -- C:\Users\Shadow315\AppData\Roaming\mozilla\Firefox\Profiles\wa7hn65n.default\extensions\{07b2a769-ed19-4483-87ce-c643914c81bb}

[2012.02.19 00:13:52 | 000,000,000 | ---D | M] (Bigpoint Games DE Community Toolbar) -- C:\Users\Shadow315\AppData\Roaming\mozilla\Firefox\Profiles\wa7hn65n.default\extensions\{0e3dbc69-a682-48da-84e1-82c63a5d678e}

[2010.10.07 07:43:26 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Shadow315\AppData\Roaming\mozilla\Firefox\Profiles\wa7hn65n.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}

[2012.02.19 00:13:50 | 000,000,000 | ---D | M] (BittorrentBar_DE Community Toolbar) -- C:\Users\Shadow315\AppData\Roaming\mozilla\Firefox\Profiles\wa7hn65n.default\extensions\{64ead72b-ffd4-4e01-aa3a-4c71665d73e4}

[2012.02.19 11:36:34 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\Shadow315\AppData\Roaming\mozilla\Firefox\Profiles\wa7hn65n.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}

[2012.02.17 02:17:33 | 000,000,000 | ---D | M] (Bitdefender QuickScan) -- C:\Users\Shadow315\AppData\Roaming\mozilla\Firefox\Profiles\wa7hn65n.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}

[2011.03.31 10:17:29 | 000,000,000 | ---D | M] (Conduit Engine) -- C:\Users\Shadow315\AppData\Roaming\mozilla\Firefox\Profiles\wa7hn65n.default\extensions\engine@conduit.com

[2009.09.27 07:38:21 | 000,000,000 | ---D | M] (Move Media Player) -- C:\Users\Shadow315\AppData\Roaming\mozilla\Firefox\Profiles\wa7hn65n.default\extensions\moveplayer@movenetworks.com

[2010.10.07 07:43:20 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Shadow315\AppData\Roaming\mozilla\Firefox\Profiles\wa7hn65n.default\extensions\{07b2a769-ed19-4483-87ce-c643914c81bb}\chrome\mozapps\extensions

[2011.01.12 21:02:48 | 000,000,937 | ---- | M] () -- C:\Users\Shadow315\AppData\Roaming\Mozilla\Firefox\Profiles\wa7hn65n.default\searchplugins\conduit.xml

[2010.03.07 20:23:00 | 000,002,272 | ---- | M] () -- C:\Users\Shadow315\AppData\Roaming\Mozilla\Firefox\Profiles\wa7hn65n.default\searchplugins\google-und-download-suche.xml

[2012.02.18 11:31:51 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\mozilla firefox\extensions

[2012.02.16 15:55:53 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll

[2011.04.14 04:08:00 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll

[2012.02.16 12:02:53 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml

[2012.02.16 11:48:01 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml

[2012.02.16 12:02:53 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml

[2012.02.16 12:02:53 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml

[2012.02.16 12:02:53 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml

[2012.02.16 12:02:53 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml

 
 ========== Chrome  ==========

 

CHR - default_search_provider: Google ()

CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}sourceid=chrome&ie={inputEncoding}&q={searchTerms}

CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?client=chrome&output=chrome&hl={language}&q={searchTerms}

 

Hosts file not found

O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer)

O3 - HKU\S-1-5-21-1955313859-1678149478-2173258271-1000\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.

O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)

O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)

O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)

O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)

O4 - HKU\S-1-5-21-1955313859-1678149478-2173258271-1000..\Run: [CD Bremse]  File not found

O4 - HKU\S-1-5-21-1955313859-1678149478-2173258271-1000..\Run: [DAEMON Tools Lite] J:\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0

O7 - HKU\S-1-5-21-1955313859-1678149478-2173258271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutorun = 0

O9 - Extra 'Tools' menuitem : Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - Reg Error: Value error. File not found

O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - %SystemRoot%\System32\winrnr.dll File not found

O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - %SystemRoot%\System32\winrnr.dll File not found

O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - %SystemRoot%\System32\winrnr.dll File not found

O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - %SystemRoot%\System32\winrnr.dll File not found

O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - %SystemRoot%\System32\winrnr.dll File not found

O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - %SystemRoot%\System32\winrnr.dll File not found

O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - %SystemRoot%\System32\winrnr.dll File not found

O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - %SystemRoot%\System32\winrnr.dll File not found

O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - %SystemRoot%\System32\winrnr.dll File not found

O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - %SystemRoot%\System32\winrnr.dll File not found

O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - %SystemRoot%\System32\winrnr.dll File not found

O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - %SystemRoot%\System32\winrnr.dll File not found

O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - %SystemRoot%\System32\winrnr.dll File not found

O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - %SystemRoot%\System32\winrnr.dll File not found

O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - %SystemRoot%\System32\winrnr.dll File not found

O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - %SystemRoot%\System32\winrnr.dll File not found

O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - %SystemRoot%\System32\winrnr.dll File not found

O10 - Protocol_Catalog9\Catalog_Entries\000000000018 - %SystemRoot%\System32\winrnr.dll File not found

O10 - Protocol_Catalog9\Catalog_Entries\000000000019 - %SystemRoot%\System32\winrnr.dll File not found

O10 - Protocol_Catalog9\Catalog_Entries\000000000020 - %SystemRoot%\System32\winrnr.dll File not found

O13 - gopher Prefix: missing

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25)

O16 - DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 80.69.100.182 80.69.100.230

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{A6A378D7-69B5-4196-B7CF-54089DE93890}: DhcpNameServer = 80.69.100.182 80.69.100.230

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)

O24 - Desktop WallPaper: C:\Users\Shadow315\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg

O24 - Desktop BackupWallPaper: C:\Users\Shadow315\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

O33 - MountPoints2\{c696b23e-36a0-11df-9edb-806e6f6e6963}\Shell - "" = AutoRun

O33 - MountPoints2\{c696b23e-36a0-11df-9edb-806e6f6e6963}\Shell\AutoRun\command - "" = F:\autorun.exe

O33 - MountPoints2\E\Shell - "" = AutoRun

O33 - MountPoints2\E\Shell\AutoRun\command - "" = E:\autorun.exe

O34 - HKLM BootExecute: (autocheck autochk *)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 

NetSvcs: FastUserSwitchingCompatibility -  File not found

NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)

NetSvcs: Nla -  File not found

NetSvcs: Ntmssvc -  File not found

NetSvcs: NWCWorkstation -  File not found

NetSvcs: Nwsapagent -  File not found

NetSvcs: SRService -  File not found

NetSvcs: WmdmPmSp -  File not found

NetSvcs: LogonHours -  File not found

NetSvcs: PCAudit -  File not found

NetSvcs: helpsvc -  File not found

NetSvcs: uploadmgr -  File not found

 

MsConfig - StartUpFolder: C:^Users^Shadow315^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Logitech . Produktregistrierung.lnk -  - File not found

MsConfig - StartUpReg: 4E3E0230AEBB4E96 - hkey= - key= -  File not found

MsConfig - StartUpReg: Adobe Photo Downloader - hkey= - key= -  File not found

MsConfig - StartUpReg: Adobe Reader Speed Launcher - hkey= - key= - C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)

MsConfig - StartUpReg: avgnt - hkey= - key= -  File not found

MsConfig - StartUpReg: BDAgent - hkey= - key= -  File not found

MsConfig - StartUpReg: BHMmHjYKMAcfJ.exe - hkey= - key= -  File not found

MsConfig - StartUpReg: BitDefender Antiphishing Helper - hkey= - key= -  File not found

MsConfig - StartUpReg: DivXUpdate - hkey= - key= - C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()

MsConfig - StartUpReg: Logitech Vid - hkey= - key= - C:\Program Files\Logitech\Vid HD\Vid.exe (Logitech Inc.)

MsConfig - StartUpReg: LWS - hkey= - key= - C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe (Logitech Inc.)

MsConfig - StartUpReg: NBCore - hkey= - key= - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBCore.exe (Nero AG)

MsConfig - StartUpReg: PlusService - hkey= - key= - C:\Program Files\Yuna Software\Messenger Plus!\PlusService.exe (Yuna Software)

MsConfig - StartUpReg: QuickTime Task - hkey= - key= - C:\Program Files\QuickTime\QTTask.exe (Apple Inc.)

MsConfig - StartUpReg: SMSTray - hkey= - key= -  File not found

MsConfig - StartUpReg: Steam - hkey= - key= - C:\Program Files\Steam\Steam.exe (Valve Corporation)

MsConfig - StartUpReg: SunJavaUpdateSched - hkey= - key= - C:\Program Files\Common Files\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)

MsConfig - StartUpReg: TkBellExe - hkey= - key= - C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)

MsConfig - StartUpReg: Windows Defender - hkey= - key= -  File not found

MsConfig - State: "startup" - 2

 

SafeBootMin: AppMgmt - Service

SafeBootMin: Base - Driver Group

SafeBootMin: Boot Bus Extender - Driver Group

SafeBootMin: Boot file system - Driver Group

SafeBootMin: File system - Driver Group

SafeBootMin: Filter - Driver Group

SafeBootMin: HelpSvc - Service

SafeBootMin: MsMpSvc - c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe (Microsoft Corporation)

SafeBootMin: NTDS -  File not found

SafeBootMin: PCI Configuration - Driver Group

SafeBootMin: PNP Filter - Driver Group

SafeBootMin: Primary disk - Driver Group

SafeBootMin: sacsvr - Service

SafeBootMin: SCSI Class - Driver Group

SafeBootMin: System Bus Extender - Driver Group

SafeBootMin: WinDefend - Service

SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

SafeBootNet: AppMgmt - Service

SafeBootNet: Base - Driver Group

SafeBootNet: BFE - Service

SafeBootNet: Boot Bus Extender - Driver Group

SafeBootNet: Boot file system - Driver Group

SafeBootNet: File system - Driver Group

SafeBootNet: Filter - Driver Group

SafeBootNet: HelpSvc - Service

SafeBootNet: Messenger - Service

SafeBootNet: MPSSvc - Service

SafeBootNet: MsMpSvc - c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe (Microsoft Corporation)

SafeBootNet: NDIS Wrapper - Driver Group

SafeBootNet: NetBIOSGroup - Driver Group

SafeBootNet: NetDDEGroup - Driver Group

SafeBootNet: Network - Driver Group

SafeBootNet: NetworkProvider - Driver Group

SafeBootNet: NTDS -  File not found

SafeBootNet: PCI Configuration - Driver Group

SafeBootNet: PNP Filter - Driver Group

SafeBootNet: PNP_TDI - Driver Group

SafeBootNet: Primary disk - Driver Group

SafeBootNet: rdsessmgr - Service

SafeBootNet: sacsvr - Service

SafeBootNet: SCSI Class - Driver Group

SafeBootNet: Streams Drivers - Driver Group

SafeBootNet: System Bus Extender - Driver Group

SafeBootNet: TDI - Driver Group

SafeBootNet: WinDefend - Service

SafeBootNet: WudfPf - Driver

SafeBootNet: WudfUsbccidDriver - Driver

SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net

SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient

SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService

SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans

SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers

SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

ActiveX: {0213C6AF-5562-4D09-884C-2ADCFC8C2F35} - Microsoft .NET Framework 1.1 Security Update (KB2656353)

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)

ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - 

ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0

ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework

ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework

ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)

ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - 

ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings

ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install

ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework

ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1

ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player

ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX: >{0AF45D3F-8287-45B9-8DAC-F4B808AB1136} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP

ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP

ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig

ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - 

 

Drivers32: msacm.ac3filter - C:\Windows\System32\ac3filter.acm ()

Drivers32: msacm.avis - C:\Windows\System32\ff_acm.acm ()

Drivers32: msacm.divxa32 - C:\Windows\System32\DivXa32.acm (Kristal StudioDFileDescription)

Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: msacm.l3codec - C:\Windows\System32\l3codecp.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: msacm.lhacm - C:\Windows\System32\lhacm.acm (Microsoft Corporation)

Drivers32: MSVideo - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)

Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)

Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)

Drivers32: vidc.DIVX - C:\Windows\System32\DivX.dll (DivX, Inc.)

Drivers32: VIDC.FFDS - C:\Windows\System32\ff_vfw.dll ()

Drivers32: VIDC.FPS1 - C:\Windows\System32\frapsvid.dll (Beepa P/L)

Drivers32: vidc.i420 - C:\Windows\System32\lvcodec2.dll (Logitech Inc.)

Drivers32: vidc.XVID - xvidvfw.dll File not found

Drivers32: vidc.yv12 - C:\Windows\System32\DivX.dll (DivX, Inc.)

 

CREATERESTOREPOINT

Restore point Set: OTL Restore Point

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2012.02.22 19:30:47 | 000,583,680 | ---- | C] (OldTimer Tools) -- C:\Users\Shadow315\Desktop\OTL(1).exe

[2012.02.22 11:15:26 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{A69EBF72-C5FF-411D-9A99-18662C7B64B0}

[2012.02.22 11:14:53 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{76F65C0C-38D4-4046-A6DC-D560EABC3A48}

[2012.02.21 19:15:20 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{70369FB5-FDF5-4047-ACE7-EAC3AB076ADC}

[2012.02.21 19:14:44 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{A9B2DCA6-76B1-43FF-86A0-F70E1EEE9EA8}

[2012.02.21 18:39:04 | 000,000,000 | ---D | C] -- C:\Program Files\ESET

[2012.02.21 12:31:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DAEMON Tools Lite

[2012.02.21 12:29:49 | 000,242,240 | ---- | C] (DT Soft Ltd) -- C:\Windows\System32\drivers\dtsoftbus01.sys

[2012.02.21 12:28:47 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Roaming\DAEMON Tools Lite

[2012.02.21 12:22:50 | 000,000,000 | ---D | C] -- C:\ProgramData\DAEMON Tools Lite

[2012.02.21 07:26:39 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Roaming\Malwarebytes

[2012.02.21 07:26:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2012.02.21 07:26:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2012.02.21 07:26:17 | 000,020,464 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys

[2012.02.21 07:26:17 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware

[2012.02.21 07:13:26 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{F24AF1E4-A10B-4A70-BEB1-7EDCBC84D6DF}

[2012.02.21 07:13:06 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{27544704-F64E-44C7-BF51-ADE1D80F822C}

[2012.02.20 21:47:55 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Security Client

[2012.02.20 16:06:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Emsisoft Anti-Malware

[2012.02.20 12:01:37 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{41AAFA97-7F6D-46CD-9897-5759D7404B2C}

[2012.02.20 12:01:07 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{8143BD9A-AE43-4337-8999-D6F4F568ADF6}

[2012.02.20 11:40:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner

[2012.02.20 11:40:19 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner

[2012.02.20 01:34:49 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\Documents\My Webcam Recordings

[2012.02.20 01:34:29 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Roaming\Systweak

[2012.02.20 01:34:20 | 000,017,280 | ---- | C] (Systweak Inc., (www.systweak.com)) -- C:\Windows\System32\roboot.exe

[2012.02.20 01:33:45 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\MessengerDiscovery

[2012.02.20 01:33:33 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\Babylon

[2012.02.20 01:33:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Babylon

[2012.02.20 01:33:30 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Roaming\Babylon

[2012.02.20 01:33:04 | 000,000,000 | ---D | C] -- C:\ProgramData\MessengerDiscovery

[2012.02.20 00:00:33 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{77D89F3E-EBCB-475F-8267-93A12962E96B}

[2012.02.19 11:59:53 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{5DD57861-B579-46BA-8E6E-719AD013B49E}

[2012.02.19 11:59:27 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{BE4D851E-B32B-4429-B665-93D5EC85931C}

[2012.02.18 23:58:35 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{204E4CC5-711D-43F6-94B9-E6966E8899A4}

[2012.02.18 11:57:55 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{01585FDF-8634-4906-B8E3-3A6A3FEEC5F2}

[2012.02.18 11:57:32 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{3AC257C3-4755-47DB-BDE4-68002E435479}

[2012.02.17 23:56:45 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{4F9C5384-21A0-4D11-9D81-7488AE728FF8}

[2012.02.17 11:56:05 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{A5DE6D9E-1210-4C28-8788-FFD923B09CF3}

[2012.02.17 11:55:41 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{86B2D14D-4AC3-4DDB-BE76-AF98D9064556}

[2012.02.16 23:55:09 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{1553FBF2-89C8-477F-ABCF-3AFD1D162359}

[2012.02.16 23:54:47 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{9C66E938-635D-4833-B1FE-7667EA36AA80}

[2012.02.16 11:54:19 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{D91C4C36-EC4C-4C40-8123-C67510B66019}

[2012.02.16 11:53:56 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{85D85A01-539E-49B0-9AA8-381427DE7B98}

[2012.02.15 23:53:17 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{63529CF6-DE38-45D8-9225-C189FB3A5884}

[2012.02.15 11:52:38 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{9049A75C-2ABF-4FAD-B15A-C437DF41C3A8}

[2012.02.15 11:52:14 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{B51EBE4B-3D5B-4471-804B-75899572F3ED}

[2012.02.14 23:51:36 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{66613ABE-BE9F-4335-97C0-9635D2B5BAA0}

[2012.02.14 11:50:53 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{25211C75-1B94-470D-AC8C-3E17394E38C9}

[2012.02.14 11:50:29 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{D82F350A-48B8-4242-924F-83AD7755DA6D}

[2012.02.13 23:49:58 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{31832502-5729-46BC-9203-9996A04C12BA}

[2012.02.13 23:49:36 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{C5304BBD-DD08-455B-B27A-3990A26D8DDA}

[2012.02.13 11:48:09 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{5BB8FCC7-E86E-4A04-9E39-F2C2228A962D}

[2012.02.13 11:47:47 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{9FE56245-7F92-4D13-8B66-D566F49F3B69}

[2012.02.12 23:47:15 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{72DF1494-0B94-4D87-8E81-F79E2BBA5BB2}

[2012.02.12 23:46:52 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{8243B488-FA54-4648-83C4-8E477D9EA619}

[2012.02.12 11:46:21 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{26FFCFA4-106E-4F11-A2D7-69B81D9F7C0E}

[2012.02.12 11:46:00 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{D2D0E211-CACF-425F-8E9A-14885D258F4D}

[2012.02.11 23:03:25 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{05D98FCF-AAA3-4C81-8B2B-32B1DEAAC092}

[2012.02.11 11:02:45 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{F7A3C5E5-F676-4BC4-88F4-E6F53A32CF93}

[2012.02.11 11:02:21 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{D952C589-CE28-42A8-AA3A-9616DCFF76A6}

[2012.02.10 23:01:42 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{72B188B0-987C-42D0-A150-A64422146FAA}

[2012.02.10 23:01:17 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{74F69919-0FB5-4C41-A6FB-AF9FBB3B91C5}

[2012.02.10 11:00:45 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{755DB9B5-6DC5-4419-B532-7F8B206AD4A1}

[2012.02.10 11:00:24 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{EA58C833-3C34-46A0-BBF4-6E7D21044A18}

[2012.02.09 22:59:52 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{B8035375-0067-4953-A009-65F112255112}

[2012.02.09 10:59:08 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{60AF0DAC-E6C8-4B88-B6B4-230FD70666AE}

[2012.02.09 10:58:44 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{022D775A-818C-4A15-A97E-9BF25240A2CF}

[2012.02.08 22:58:03 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{26895E1E-3F5A-4FAE-8746-F2F40664FBA1}

[2012.02.08 10:57:27 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{369C0F28-25A8-4DB7-B856-2BDCAA097377}

[2012.02.08 10:57:06 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{C23E9956-0E87-4DF4-8199-188CF99951AE}

[2012.02.07 22:56:36 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{440DEE2B-C1F6-4F38-BD16-66CE35C76648}

[2012.02.07 10:56:00 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{D97EDF86-00FF-4462-8749-F8D251008614}

[2012.02.07 10:55:39 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{C467DCDC-CD8C-4E8E-9F76-44E7A06AB207}

[2012.02.06 22:55:06 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{1A7B318D-2377-44B1-80A0-04BFFAE82153}

[2012.02.06 10:54:28 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{4796BB5A-8163-4181-8507-5470C219DDBB}

[2012.02.06 10:54:07 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{89FB9DA1-B7A9-4AF2-B7E6-CD1C1BCAB632}

[2012.02.05 21:54:27 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{934F41B0-5B91-4795-BCAA-D80410DDA170}

[2012.02.05 09:54:04 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{604DC800-7E53-4B29-B293-9D159B3C0727}

[2012.02.05 09:53:43 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{FFADA01F-81C7-4EDC-BCFE-EC20233EABF0}

[2012.02.03 12:14:20 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{731C4AAD-3FC8-437A-BD5B-44624970AB15}

[2012.02.03 12:14:09 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{ED16CA66-A6DC-4B86-BF42-91AD67D42B9C}

[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

 
 ========== Files - Modified Within 30 Days ==========

 

[2012.02.22 19:30:47 | 000,583,680 | ---- | M] (OldTimer Tools) -- C:\Users\Shadow315\Desktop\OTL(1).exe

[2012.02.22 19:18:00 | 000,001,104 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

[2012.02.22 19:13:09 | 000,003,264 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0

[2012.02.22 19:13:09 | 000,003,264 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0

[2012.02.22 12:28:44 | 000,001,100 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job

[2012.02.22 11:23:41 | 000,676,444 | ---- | M] () -- C:\Windows\System32\perfh007.dat

[2012.02.22 11:23:41 | 000,636,302 | ---- | M] () -- C:\Windows\System32\perfh009.dat

[2012.02.22 11:23:41 | 000,146,834 | ---- | M] () -- C:\Windows\System32\perfc007.dat

[2012.02.22 11:23:41 | 000,120,766 | ---- | M] () -- C:\Windows\System32\perfc009.dat

[2012.02.22 11:13:06 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2012.02.21 12:31:43 | 000,000,607 | ---- | M] () -- C:\Users\Public\Desktop\DAEMON Tools Lite.lnk

[2012.02.21 12:29:49 | 000,242,240 | ---- | M] (DT Soft Ltd) -- C:\Windows\System32\drivers\dtsoftbus01.sys

[2012.02.21 08:07:40 | 000,203,264 | ---- | M] () -- C:\Users\Shadow315\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2012.02.21 07:26:25 | 000,000,950 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2012.02.21 03:31:07 | 000,306,984 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT

[2012.02.20 21:49:39 | 000,002,154 | ---- | M] () -- C:\Windows\epplauncher.mif

[2012.02.20 16:06:37 | 000,000,932 | ---- | M] () -- C:\Users\Public\Desktop\Emsisoft Anti-Malware.lnk

[2012.02.20 11:40:19 | 000,000,848 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk

[2012.02.20 01:47:41 | 000,000,000 | -HS- | M] () -- C:\Windows\System32\dds_trash_log.cmd

[2012.02.20 01:33:51 | 000,000,237 | ---- | M] () -- C:\user.js

[2012.02.19 13:38:25 | 010,982,955 | ---- | M] () -- C:\Users\Shadow315\Desktop\3p  Licence 2 Kill   SNA Club Mix .mp3

[2012.02.19 11:55:23 | 000,000,841 | ---- | M] () -- C:\Users\Shadow315\Desktop\World of Warcraft.lnk

[2012.02.17 16:40:02 | 000,378,172 | ---- | M] () -- C:\Users\Shadow315\ok.jpg

[2012.02.10 16:00:58 | 000,017,280 | ---- | M] (Systweak Inc., (www.systweak.com)) -- C:\Windows\System32\roboot.exe

[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

 
 ========== Files Created - No Company Name ==========

 

[2012.02.22 00:00:19 | 013,903,445 | ---- | C] () -- C:\Users\Shadow315\Desktop\Allegria.mp3

[2012.02.21 12:31:43 | 000,000,607 | ---- | C] () -- C:\Users\Public\Desktop\DAEMON Tools Lite.lnk

[2012.02.21 07:26:25 | 000,000,950 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2012.02.20 21:49:39 | 000,002,154 | ---- | C] () -- C:\Windows\epplauncher.mif

[2012.02.20 21:48:18 | 000,001,852 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk

[2012.02.20 16:06:37 | 000,000,932 | ---- | C] () -- C:\Users\Public\Desktop\Emsisoft Anti-Malware.lnk

[2012.02.20 11:40:19 | 000,000,848 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk

[2012.02.20 01:43:25 | 000,000,000 | -HS- | C] () -- C:\Windows\System32\dds_trash_log.cmd

[2012.02.20 01:33:43 | 000,000,237 | ---- | C] () -- C:\user.js

[2012.02.19 13:37:54 | 010,982,955 | ---- | C] () -- C:\Users\Shadow315\Desktop\3p  Licence 2 Kill   SNA Club Mix .mp3

[2012.02.17 16:40:02 | 000,378,172 | ---- | C] () -- C:\Users\Shadow315\ok.jpg

[2011.10.12 20:28:52 | 000,037,376 | ---- | C] () -- C:\Windows\System32\atitmpxx.dll

[2011.10.12 16:16:30 | 000,056,832 | ---- | C] () -- C:\Windows\System32\OpenVideo.dll

[2011.08.17 20:48:44 | 000,237,701 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat

[2011.06.02 21:42:26 | 000,000,000 | ---- | C] () -- C:\Windows\System32\imwords.dat

[2011.06.02 21:42:26 | 000,000,000 | ---- | C] () -- C:\Windows\System32\im_markovian.dat

[2011.05.28 09:07:54 | 000,000,000 | ---- | C] () -- C:\Windows\System32\imblacklist.dat

[2011.05.28 08:29:50 | 000,867,468 | ---- | C] () -- C:\ProgramData\bdinstall.bin

[2011.04.09 17:55:28 | 000,179,261 | ---- | C] () -- C:\Windows\System32\xlive.dll.cat

[2011.04.01 06:07:02 | 010,877,272 | ---- | C] () -- C:\Windows\System32\LogiDPP.dll

[2011.04.01 06:07:02 | 000,102,744 | ---- | C] () -- C:\Windows\System32\LogiDPPApp.exe

[2011.04.01 06:06:56 | 000,331,608 | ---- | C] () -- C:\Windows\System32\DevManagerCore.dll

[2011.04.01 05:56:00 | 000,027,872 | ---- | C] () -- C:\Windows\System32\lvcoinst.ini

[2011.03.22 22:58:22 | 000,014,168 | ---- | C] () -- C:\Windows\System32\drivers\iKeyLFT2.dll

[2011.03.17 18:51:44 | 000,003,929 | ---- | C] () -- C:\Windows\System32\atipblag.dat

[2011.02.20 10:43:44 | 000,000,069 | ---- | C] () -- C:\Windows\NeroDigital.ini

[2010.10.24 19:34:19 | 000,000,510 | ---- | C] () -- C:\Windows\WORDPAD.INI

[2010.03.24 00:49:07 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin

[2010.02.24 23:54:59 | 000,021,840 | ---- | C] () -- C:\Windows\System32\SIntfNT.dll

[2010.02.24 23:54:59 | 000,017,212 | ---- | C] () -- C:\Windows\System32\SIntf32.dll

[2010.02.24 23:54:59 | 000,012,067 | ---- | C] () -- C:\Windows\System32\SIntf16.dll

 
 ========== LOP Check ==========

 

[2009.06.17 00:26:49 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\Ankh

[2009.07.28 10:58:31 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\Any Video Converter

[2012.02.20 01:33:30 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\Babylon

[2012.02.20 11:42:11 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\BitTorrent

[2009.10.12 12:32:36 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\BullGuard

[2009.05.13 11:31:34 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\Command & Conquer 3 Kanes Rache

[2010.10.14 19:02:32 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\Command & Conquer 3 Tiberium Wars

[2012.02.21 12:32:18 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\DAEMON Tools Lite

[2012.02.21 07:43:28 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\DataCast

[2011.11.19 12:31:36 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\EurekaLog

[2010.11.26 20:20:01 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\Extensible XML Editor

[2011.09.24 17:03:33 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\FreshDiagnose

[2011.05.28 14:51:15 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\GetRightToGo

[2008.10.12 22:32:41 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\KaLoMa

[2010.05.22 08:52:01 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\Leadertech

[2011.03.21 08:45:58 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\LolClient

[2009.11.19 20:31:13 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\MAGIX

[2009.08.28 23:57:42 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\Octoshape

[2011.03.20 13:38:40 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\PlayFirst

[2012.02.17 02:17:46 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\QuickScan

[2009.03.19 23:33:42 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\Red Alert 3 Demo

[2011.05.26 18:51:40 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\RIFT

[2010.03.23 15:49:05 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\SystemSuite

[2012.02.21 07:41:21 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\Systweak

[2008.09.22 13:48:35 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\Template

[2010.02.04 10:04:53 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\The Bat!

[2012.02.20 11:42:11 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\TS3Client

[2009.09.09 11:56:50 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\Turbine

[2009.06.17 09:48:47 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\uTorrent

[2009.11.17 23:56:12 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\VistaCodecs

[2008.09.25 20:31:28 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\Xilisoft Corporation

[2012.02.20 11:13:54 | 000,000,000 | ---D | M] -- C:\Users\The_Crow\AppData\Roaming\Systweak

[2012.02.22 01:32:43 | 000,032,628 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

 
 ========== Purity Check ==========

 

 

 
 ========== Custom Scans ==========

 

 
 < %ALLUSERSPROFILE%\Application Data\*. >

 
 < %ALLUSERSPROFILE%\Application Data\*.exe /s >

 
 < %APPDATA%\*. >

[2009.07.26 12:19:33 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\Adobe

[2009.07.26 12:19:33 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\AdobeUM

[2009.06.17 00:26:49 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\Ankh

[2009.07.28 10:58:31 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\Any Video Converter

[2012.02.20 01:33:30 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\Babylon

[2012.02.20 11:42:11 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\BitTorrent

[2009.10.12 12:32:36 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\BullGuard

[2009.05.13 11:31:34 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\Command & Conquer 3 Kanes Rache

[2010.10.14 19:02:32 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\Command & Conquer 3 Tiberium Wars

[2012.02.21 12:32:18 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\DAEMON Tools Lite

[2012.02.21 07:43:28 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\DataCast

[2010.06.01 23:54:40 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\DivX

[2009.02.11 13:09:41 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\Download Manager

[2011.11.19 12:31:36 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\EurekaLog

[2010.11.26 20:20:01 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\Extensible XML Editor

[2011.09.24 17:03:33 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\FreshDiagnose

[2011.05.28 14:51:15 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\GetRightToGo

[2008.09.10 13:34:28 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\Identities

[2008.10.12 22:32:41 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\KaLoMa

[2010.05.22 08:52:01 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\Leadertech

[2011.03.21 08:45:58 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\LolClient

[2008.09.10 18:27:39 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\Macromedia

[2009.11.19 20:31:13 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\MAGIX

[2012.02.21 07:26:39 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\Malwarebytes

[2006.11.02 13:37:34 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\Media Center Programs

[2010.10.14 11:08:58 | 000,000,000 | --SD | M] -- C:\Users\Shadow315\AppData\Roaming\Microsoft

[2009.06.07 08:23:09 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\Mozilla

[2009.02.21 05:13:08 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\Nero

[2009.08.28 23:57:42 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\Octoshape

[2011.03.20 13:38:40 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\PlayFirst

[2012.02.17 02:17:46 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\QuickScan

[2008.09.12 00:25:49 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\Real

[2009.03.19 23:33:42 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\Red Alert 3 Demo

[2011.05.26 18:51:40 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\RIFT

[2010.10.14 19:00:57 | 000,000,000 | RH-D | M] -- C:\Users\Shadow315\AppData\Roaming\SecuROM

[2012.02.20 11:42:11 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\Skype

[2009.01.27 00:15:21 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\Symantec

[2010.03.23 15:49:05 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\SystemSuite

[2012.02.21 07:41:21 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\Systweak

[2010.02.13 23:01:03 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\teamspeak2

[2008.09.22 13:48:35 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\Template

[2010.02.04 10:04:53 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\The Bat!

[2012.02.20 11:42:11 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\TS3Client

[2009.09.09 11:56:50 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\Turbine

[2009.06.17 09:48:47 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\uTorrent

[2009.11.17 23:56:12 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\VistaCodecs

[2008.09.14 18:51:47 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\WinRAR

[2008.09.25 20:31:28 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\Xilisoft Corporation

 
 < %APPDATA%\*.exe /s >

[2011.06.08 12:47:19 | 003,120,288 | ---- | M] (Adobe Systems, Inc.) -- C:\Users\Shadow315\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\fpupdateax\fpupdateax.exe

[2011.02.16 21:34:15 | 002,832,544 | ---- | M] (Adobe Systems, Inc.) -- C:\Users\Shadow315\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\fpupdatepl\fpupdatepl.exe

[2011.06.15 16:22:38 | 000,053,248 | R--- | M] (Acresso Software Inc.) -- C:\Users\Shadow315\AppData\Roaming\Microsoft\Installer\{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}\ARPPRODUCTICON.exe

 
 < %SYSTEMDRIVE%\*.exe >

 

 
 < MD5 for: AGP440.SYS  >

[2008.01.19 08:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_51b95d75\AGP440.sys

[2008.01.19 08:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys

[2008.01.19 08:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys

[2008.01.19 08:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_bbfe6647bbd2a4c6\AGP440.sys

[2006.11.02 10:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\drivers\AGP440.sys

[2006.11.02 10:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys

 
 < MD5 for: ATAPI.SYS  >

[2009.04.11 07:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\drivers\atapi.sys

[2009.04.11 07:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_b12d8e84\atapi.sys

[2009.04.11 07:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys

[2008.01.19 08:41:30 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys

[2008.01.19 08:41:30 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys

[2006.11.02 10:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys

[2007.04.17 09:30:38 | 000,021,688 | ---- | M] (Microsoft Corporation) MD5=78620BDA3EC87816E5D1FA86F920BC3A -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c2a1b5ae\atapi.sys

[2007.04.17 09:30:38 | 000,021,688 | ---- | M] (Microsoft Corporation) MD5=78620BDA3EC87816E5D1FA86F920BC3A -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20518_none_dbd8b4d73d81c9d0\atapi.sys

[2008.09.11 02:11:21 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_7de13c21\atapi.sys

[2008.09.11 02:11:21 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16632_none_db337a442479c42c\atapi.sys

[2008.09.11 02:11:20 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=E03E8C99D15D0381E02743C36AFC7C6F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_64dfd8ea\atapi.sys

[2008.09.11 02:11:20 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=E03E8C99D15D0381E02743C36AFC7C6F -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20757_none_dbac78a93da31a8b\atapi.sys

 
 < MD5 for: CNGAUDIT.DLL  >

[2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll

[2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll

 
 < MD5 for: IASTORV.SYS  >

[2008.01.19 08:42:51 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_c9df7691\iaStorV.sys

[2008.01.19 08:42:51 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys

[2006.11.02 10:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\drivers\iaStorV.sys

[2006.11.02 10:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys

 
 < MD5 for: NETLOGON.DLL  >

[2006.11.02 10:46:11 | 000,559,616 | ---- | M] (Microsoft Corporation) MD5=889A2C9F2AACCD8F64EF50AC0B3D553B -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6000.16386_none_fb80f5473b0ed783\netlogon.dll

[2009.04.11 07:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\System32\netlogon.dll

[2009.04.11 07:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_ffa3304f351bb3a3\netlogon.dll

[2008.01.19 08:35:36 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll

 
 < MD5 for: NVSTOR.SYS  >

[2006.11.02 10:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\drivers\nvstor.sys

[2006.11.02 10:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys

[2008.01.19 08:42:09 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys

[2008.01.19 08:42:09 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys

 
 < MD5 for: SCECLI.DLL  >

[2008.01.19 08:36:19 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll

[2006.11.02 10:46:12 | 000,176,640 | ---- | M] (Microsoft Corporation) MD5=80E2839D05CA5970A86D7BE2A08BFF61 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6000.16386_none_35d7205fdc305e3e\scecli.dll

[2009.04.11 07:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\System32\scecli.dll

[2009.04.11 07:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e\scecli.dll

 
 < MD5 for: USER32.DLL  >

[2008.09.11 02:02:10 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=63B4F59D7C89B1BF5277F1FFEFD491CD -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.16438_none_cb39bc5b7047127e\user32.dll

[2008.09.11 02:02:10 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=9D9F061EDA75425FC67F0365E3467C86 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.20537_none_cbc258dc896598f1\user32.dll

[2008.01.19 08:36:46 | 000,627,200 | ---- | M] (Microsoft Corporation) MD5=B974D9F06DC7D1908E825DC201681269 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_cd386c416d5c7f32\user32.dll

[2006.11.02 10:46:13 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=E698A5437B89A285ACA3FF022356810A -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.16386_none_cb01aa4570716e5e\user32.dll

[2009.04.11 07:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\user32.dll

[2009.04.11 07:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6002.18005_none_cf23e54d6a7e4a7e\user32.dll

 
 < MD5 for: USERINIT.EXE  >

[2008.01.19 08:33:33 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe

[2008.01.19 08:33:33 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe

[2006.11.02 10:45:50 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=22027835939F86C3E47AD8E3FBDE3D11 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6000.16386_none_d9f1f819d4c4e737\userinit.exe

 
 < MD5 for: WININIT.EXE  >

[2008.01.19 08:33:37 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\System32\wininit.exe

[2008.01.19 08:33:37 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6001.18000_none_30f2b8cf0450a6a2\wininit.exe

[2006.11.02 10:45:57 | 000,095,744 | ---- | M] (Microsoft Corporation) MD5=D4385B03E8CCCEE6F0EE249F827C1F3E -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6000.16386_none_2ebbf6d3076595ce\wininit.exe

 
 < MD5 for: WINLOGON.EXE  >

[2012.01.13 14:53:20 | 000,182,856 | ---- | M] () MD5=63EEC8A8B221AB79045E776E5F592868 -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe

[2009.04.11 07:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\System32\winlogon.exe

[2009.04.11 07:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe

[2006.11.02 10:45:57 | 000,308,224 | ---- | M] (Microsoft Corporation) MD5=9F75392B9128A91ABAFB044EA350BAAD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6000.16386_none_6d8c3f1ad8066b21\winlogon.exe

[2008.01.19 08:33:37 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe

 
 < MD5 for: WS2IFSL.SYS  >

[2006.11.02 09:58:26 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=84620AECDCFD2A7A14E6263927D8C0ED -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6000.16386_none_4d4fded8cae2956d\ws2ifsl.sys

[2008.01.19 06:56:49 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\System32\drivers\ws2ifsl.sys

[2008.01.19 06:56:49 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6001.18000_none_4f86a0d4c7cda641\ws2ifsl.sys

 
 < %systemroot%\system32\drivers\*.sys /lockedfiles >

[2011.04.18 13:18:50 | 000,043,392 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\system32\drivers\MpNWMon.sys

 
 < %systemroot%\System32\config\*.sav >

[2006.11.02 11:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV

[2006.11.02 11:34:05 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV

[2006.11.02 11:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV

[2006.11.02 11:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV

[2006.11.02 11:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV

 
 < %systemroot%\*. /mp /s >

 
 < %systemroot%\system32\*.dll /lockedfiles >

 
 ========== Files - Unicode (All) ==========

[2011.06.28 06:19:42 | 000,000,000 | ---- | M] ()(C:\Windows\System32\?????) -- C:\Windows\System32\獷楬汢捯污

[2011.06.28 06:19:42 | 000,000,000 | ---- | C] ()(C:\Windows\System32\?????) -- C:\Windows\System32\獷楬汢捯污

 
 ========== Hard Links - Junction Points - Mount Points - Symbolic Links ==========

[C:\Windows\$NtUninstallKB23493$] -> Error: Cannot create file handle -> Unknown point type

 
 ========== Alternate Data Streams ==========

 

@Alternate Data Stream - 10 bytes -> C:\Users\Shadow315\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\fpupdateax\fpupdateax.exe:BDU
 

< End of report >

Zitat:

[C:\Windows\$NtUninstallKB23493$] -> Error: Cannot create file handle -> Unknown point type

Du hast offensichtlich einen ZeroAccess drauf, der ist immer ungemütlich. :(
Ich würde dir erstmal für den Fall der Fälle eine Datensicherung empfehlen und dich darauf vorzubereiten, eine komplette Neuinstallation von Windows durchzuführen, den ZA kann man nämlich nicht immer per Bereinigung entfernen!

Zum Thema Datensicherung von infizierten Systemen; mach das über ne Live-CD wie Knoppix, Ubuntu (zweiter Link in meiner Signatur) oder über PartedMagic. Grund: Bei einem Live-System sind keine Schädlinge des infizierten Windows-Systems aktiv, damit ist dann auch eine negative Beeinflussung des Backups durch Schädlinge ausgeschlossen.

Du brauchst natürlich auch ein Sicherungsmedium, am besten dürfte eine externe Platte sein. Sofern du nicht allzuviel sichern musst, kann auch ein USB-Stick ausreichen.

Hier eine kurze Anleitung zu PartedMagic, funktioniert prinzipell so aber fast genauso mit allen anderen Live-Systemen auch.

1. Lade Dir das ISO-Image von PartedMagic herunter, müssten ca. 180 MB sein
2. Brenn es per Imagebrennfunktion auf CD, geht zB mit ImgBurn unter Windows
3. Boote von der gebrannten CD, im Bootmenü von Option 1 starten und warten bis der Linux-Desktop oben ist

http://partedmagic.com/lib/exe/fetch...ia=desktop.png

4. Du müsstest ein Symbol "Mount Devices" finden, das doppelklicken
5. Mounte die Partitionen wo Windows installiert ist, meistens isses /dev/sda1 und natürlich noch etwaige andere Partitionen, wo noch Daten liegen und die gesichert werden müssen - natürlich auch die der externen Platte (du bekommmst nur Lese- und Schreibzugriffe auf die Dateisysteme, wenn diese gemountet sind)
6. Kopiere die Daten der internen Platte auf die externe Platte - kopiere nur persönliche Dateien, Musik, Videos, etc. auf die Backupplatte, KEINE ausführbaren Dateien wie Programme/Spiele/Setups!!
7. Nach der Datensicherung: Rechner runterfahren, Backupmedium vom Rechner trennen (physikalisch => Kabel ziehen von ext. Festplatte), Rechner neu starten und wieder Windows booten - da jetzt die Datensicherung gemacht wurde kann man sich nun austoben ;)

Wenn du dir sicher bist, dass du auch alle Daten unter Linux gesichert hast, führst du mal Combofix aus:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix

Lade dir ComboFix hier herunter auf deinen Desktop.

Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.

Starte combofix.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.

Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.

Wichtiger Hinweis:

Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

Gut, dass ich schon längst all meine wichtigen Daten auf meiner
externen Festplatte gespeichert habe. Habe derzeit zwar Brenner und
normales Laufwerk im Rechner, allerdings funktionieren beide nicht
mehr. Heißt, ich müsste per virtuelles Laufwerk auf der externen Platte
mein Windows neu aufspielen - sobald ich verstanden habe, wie das
jetzt funktioniert. :pfeiff:

Und ja, natürlich ist diese iso.Datei von Windows eine Kopie meiner
original Windows Vista CD, die leider dank defekten Laufwerken
nicht mehr gelesen werden kann. :(

Egal, vielleicht muss ich ja gar nicht neu formatieren, hier die Log-Datei:

Code:

ComboFix 12-02-22.01 - Shadow315 23.02.2012   6:13.1.2 - x86

Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1252.49.1031.18.2047.761 [GMT 1:00]

ausgeführt von:: c:\users\Shadow315\Desktop\ComboFix.exe

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\users\Shadow315\AppData\Local\assembly\tmp

c:\users\Shadow315\AppData\Roaming\EurekaLog

c:\windows\$NtUninstallKB23493$

c:\windows\$NtUninstallKB23493$\105422576

c:\windows\$NtUninstallKB23493$\1899047668\@

c:\windows\$NtUninstallKB23493$\1899047668\cfg.ini

c:\windows\$NtUninstallKB23493$\1899047668\Desktop.ini

c:\windows\$NtUninstallKB23493$\1899047668\L\qnbwvoto

c:\windows\$NtUninstallKB23493$\1899047668\oemid

c:\windows\$NtUninstallKB23493$\1899047668\U\00000001.@

c:\windows\$NtUninstallKB23493$\1899047668\U\00000002.@

c:\windows\$NtUninstallKB23493$\1899047668\U\00000004.@

c:\windows\$NtUninstallKB23493$\1899047668\U\80000000.@

c:\windows\$NtUninstallKB23493$\1899047668\U\80000004.@

c:\windows\$NtUninstallKB23493$\1899047668\U\80000032.@

c:\windows\$NtUninstallKB23493$\1899047668\version

c:\windows\system32\roboot.exe

c:\windows\unin0407.exe

D:\install.exe

J:\setup.exe

.

.

(((((((((((((((((((((((   Dateien erstellt von 2012-01-23 bis 2012-02-23  ))))))))))))))))))))))))))))))

.

.

2012-02-23 05:25 . 2012-02-23 05:25        56200        ----a-w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{F2463681-0E36-4F21-A4D6-C70CCB2EE029}\offreg.dll

2012-02-22 10:32 . 2012-02-07 21:03        6552120        ----a-w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll

2012-02-22 10:30 . 2012-02-07 21:03        6552120        ----a-w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{F2463681-0E36-4F21-A4D6-C70CCB2EE029}\mpengine.dll

2012-02-21 17:39 . 2012-02-21 17:39        --------        d-----w-        c:\program files\ESET

2012-02-21 11:29 . 2012-02-21 11:29        242240        ----a-w-        c:\windows\system32\drivers\dtsoftbus01.sys

2012-02-21 11:28 . 2012-02-21 11:32        --------        d-----w-        c:\users\Shadow315\AppData\Roaming\DAEMON Tools Lite

2012-02-21 11:22 . 2012-02-21 11:26        --------        d-----w-        c:\programdata\DAEMON Tools Lite

2012-02-21 06:26 . 2012-02-21 06:26        --------        d-----w-        c:\users\Shadow315\AppData\Roaming\Malwarebytes

2012-02-21 06:26 . 2012-02-21 06:26        --------        d-----w-        c:\programdata\Malwarebytes

2012-02-21 06:26 . 2012-02-21 06:26        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware

2012-02-21 06:26 . 2011-12-10 14:24        20464        ----a-w-        c:\windows\system32\drivers\mbam.sys

2012-02-21 02:04 . 2011-12-14 02:50        2382848        ----a-w-        c:\windows\system32\mshtml.tlb

2012-02-21 02:04 . 2011-12-14 03:32        141112        ----a-w-        c:\program files\Internet Explorer\sqmapi.dll

2012-02-21 02:04 . 2011-12-14 02:54        194048        ----a-w-        c:\program files\Internet Explorer\IEShims.dll

2012-02-21 02:04 . 2011-12-14 03:04        1798656        ----a-w-        c:\windows\system32\jscript9.dll

2012-02-21 02:04 . 2011-12-14 02:57        1127424        ----a-w-        c:\windows\system32\wininet.dll

2012-02-21 02:03 . 2011-12-14 02:59        678912        ----a-w-        c:\program files\Internet Explorer\iedvtool.dll

2012-02-21 02:03 . 2011-12-14 02:56        1427456        ----a-w-        c:\windows\system32\inetcpl.cpl

2012-02-20 21:00 . 2012-02-20 20:59        713784        ------w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{D347F227-87D2-4826-BB6E-7C5BE620EDC4}\gapaengine.dll

2012-02-20 20:59 . 2011-11-18 17:47        66560        ----a-w-        c:\windows\system32\packager.dll

2012-02-20 20:59 . 2011-10-14 16:02        429056        ----a-w-        c:\windows\system32\EncDec.dll

2012-02-20 20:59 . 2011-12-14 16:17        680448        ----a-w-        c:\windows\system32\msvcrt.dll

2012-02-20 20:53 . 2011-12-20 10:56        2409784        ----a-w-        c:\program files\Windows Mail\OESpamFilter.dat

2012-02-20 20:53 . 2011-09-30 15:57        707584        ----a-w-        c:\program files\Common Files\System\wab32.dll

2012-02-20 20:47 . 2012-02-20 20:49        --------        d-----w-        c:\program files\Microsoft Security Client

2012-02-20 20:46 . 2010-04-05 20:00        221568        ----a-w-        c:\windows\system32\drivers\netio.sys

2012-02-20 10:40 . 2012-02-20 10:40        --------        d-----w-        c:\program files\CCleaner

2012-02-20 10:13 . 2012-02-20 10:14        --------        d-----w-        c:\users\The_Crow

2012-02-20 00:43 . 2012-02-20 00:47        0        --sha-w-        c:\windows\system32\dds_trash_log.cmd

2012-02-20 00:34 . 2012-02-21 06:41        --------        d-----w-        c:\users\Shadow315\AppData\Roaming\Systweak

2012-02-20 00:33 . 2012-02-20 00:53        --------        d-----w-        c:\users\Shadow315\AppData\Local\MessengerDiscovery

2012-02-20 00:33 . 2012-02-20 00:33        237        ----a-w-        C:\user.js

2012-02-20 00:33 . 2012-02-20 00:33        --------        d-----w-        c:\users\Shadow315\AppData\Local\Babylon

2012-02-20 00:33 . 2012-02-20 00:33        --------        d-----w-        c:\programdata\Babylon

2012-02-20 00:33 . 2012-02-20 00:33        --------        d-----w-        c:\users\Shadow315\AppData\Roaming\Babylon

2012-02-20 00:33 . 2012-02-20 00:33        --------        d-----w-        c:\programdata\MessengerDiscovery

2012-02-18 10:31 . 2012-02-16 14:55        134104        ----a-w-        c:\program files\Mozilla Firefox\components\browsercomps.dll

2012-02-18 10:31 . 2012-02-16 14:55        97240        ----a-w-        c:\program files\Mozilla Firefox\libEGL.dll

2012-02-18 10:31 . 2012-02-16 14:55        801752        ----a-w-        c:\program files\Mozilla Firefox\mozsqlite3.dll

2012-02-18 10:31 . 2012-02-16 14:55        45016        ----a-w-        c:\program files\Mozilla Firefox\mozutils.dll

2012-02-18 10:31 . 2012-02-16 14:55        437208        ----a-w-        c:\program files\Mozilla Firefox\libGLESv2.dll

2012-02-18 10:31 . 2012-02-16 14:55        1911768        ----a-w-        c:\program files\Mozilla Firefox\mozjs.dll

2012-02-18 10:31 . 2012-02-16 14:55        15832        ----a-w-        c:\program files\Mozilla Firefox\mozalloc.dll

2012-02-18 10:31 . 2012-02-16 10:42        2106216        ----a-w-        c:\program files\Mozilla Firefox\D3DCompiler_43.dll

2012-02-18 10:31 . 2012-02-16 10:42        1998168        ----a-w-        c:\program files\Mozilla Firefox\d3dx9_43.dll

2012-02-18 10:31 . 2012-02-16 10:41        626688        ----a-w-        c:\program files\Mozilla Firefox\msvcr80.dll

2012-02-18 10:31 . 2012-02-16 10:41        548864        ----a-w-        c:\program files\Mozilla Firefox\msvcp80.dll

2012-02-18 10:31 . 2012-02-16 10:41        479232        ----a-w-        c:\program files\Mozilla Firefox\msvcm80.dll

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-01-31 12:44 . 2009-10-02 22:03        237072        ------w-        c:\windows\system32\MpSigStub.exe

2011-12-08 12:23 . 2011-05-28 08:31        414368        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl

2012-02-16 14:55 . 2012-02-18 10:31        134104        ----a-w-        c:\program files\mozilla firefox\components\browsercomps.dll

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]

"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]

"DAEMON Tools Lite"="j:\daemon tools lite\DTLite.exe" [2012-02-13 3481408]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2011-06-15 997920]

"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-01-13 460872]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableLUA"= 0 (0x0)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

@="Service"

.

[HKLM\~\startupfolder\C:^Users^Shadow315^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Logitech . Produktregistrierung.lnk]

path=c:\users\Shadow315\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Logitech . Produktregistrierung.lnk

backup=c:\windows\pss\Logitech . Produktregistrierung.lnk.Startup

backupExtension=.Startup

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]

2008-06-12 01:38        34672        ----a-w-        c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]

2010-09-16 20:04        1164584        ----a-w-        c:\program files\DivX\DivX Update\DivXUpdate.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Vid]

2011-01-13 02:01        6129496        ----a-w-        c:\program files\Logitech\Vid HD\Vid.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LWS]

2011-03-01 21:14        190808        ----a-w-        c:\program files\Logitech\LWS\Webcam Software\LWS.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBCore]

2008-12-05 15:11        1590568        ----a-w-        c:\program files\Common Files\Nero\Nero BackItUp 4\NBCore.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PlusService]

2011-10-24 15:51        801792        ----a-w-        c:\program files\Yuna Software\Messenger Plus!\PlusService.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]

2009-05-26 15:18        413696        ----a-w-        c:\program files\QuickTime\QTTask.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]

2011-09-05 07:29        1242448        ----a-w-        c:\program files\Steam\Steam.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

2011-01-07 11:12        253672        ----a-w-        c:\program files\Common Files\Java\Java Update\jusched.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]

2008-09-11 23:23        185896        ----a-w-        c:\program files\Common Files\Real\Update_OB\realsched.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]

2008-01-19 07:38        1008184        ----a-w-        c:\program files\Windows Defender\MSASCui.exe

.

S1 A2DDA;A2 Direct Disk Access Support Driver;c:\program files\Emsisoft Anti-Malware\a2ddax86.sys [2011-05-19 17904]

S2 a2AntiMalware;Emsisoft Anti-Malware 6.0 - Service;c:\program files\Emsisoft Anti-Malware\a2service.exe [2012-01-22 3025112]

S3 a2acc;a2acc;c:\program files\EMSISOFT ANTI-MALWARE\a2accx86.sys [2011-11-02 51632]

.

.

--- Andere Dienste/Treiber im Speicher ---

.

*NewlyCreated* - MPNWMON

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

LocalServiceAndNoImpersonation        REG_MULTI_SZ           FontCache

.

Inhalt des "geplante Tasks" Ordners

.

2012-02-23 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-12-01 19:24]

.

2012-02-23 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-12-01 19:24]

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = hxxp://www.farmerama.de/

mStart Page = about:blank

TCP: DhcpNameServer = 80.69.100.182 80.69.100.230

FF - ProfilePath - c:\users\Shadow315\AppData\Roaming\Mozilla\Firefox\Profiles\wa7hn65n.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2843456&SearchSource=3&q={searchTerms}

FF - prefs.js: browser.search.selectedEngine - Bigpoint Games DE Customized Web Search

FF - prefs.js: browser.startup.homepage - hxxp://www.united-forum.de/

FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2843456&q=&SearchSource=2

FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=108298

FF - user.js: extensions.BabylonToolbar_i.babExt - 

FF - user.js: extensions.BabylonToolbar_i.srcExt - ss

FF - user.js: extensions.BabylonToolbar_i.id - d289d28a000000000000001d920d4f94

FF - user.js: extensions.BabylonToolbar_i.hardId - d289d28a000000000000001d920d4f94

FF - user.js: extensions.BabylonToolbar_i.instlDay - 15390

FF - user.js: extensions.BabylonToolbar_i.vrsn - 1.5.3.17

FF - user.js: extensions.BabylonToolbar_i.vrsni - 1.5.3.17

FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.5.3.171:33

FF - user.js: extensions.BabylonToolbar_i.prtnrId - babylon

FF - user.js: extensions.BabylonToolbar_i.prdct - BabylonToolbar

FF - user.js: extensions.BabylonToolbar_i.aflt - babsst

FF - user.js: extensions.BabylonToolbar_i.smplGrp - none

FF - user.js: extensions.BabylonToolbar_i.tlbrId - base

FF - user.js: extensions.BabylonToolbar_i.instlRef - sst

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

URLSearchHooks-{64ead72b-ffd4-4e01-aa3a-4c71665d73e4} - (no file)

WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)

HKCU-Run-CD Bremse - (no file)

MSConfigStartUp-4E3E0230AEBB4E96 - c:\recycle.bin\Recycle.Bin.exe

MSConfigStartUp-Adobe Photo Downloader - c:\program files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe

MSConfigStartUp-avgnt - c:\program files\Avira\AntiVir Desktop\avgnt.exe

MSConfigStartUp-BDAgent - c:\program files\BitDefender\BitDefender 2011\bdagent.exe

MSConfigStartUp-BHMmHjYKMAcfJ - c:\programdata\BHMmHjYKMAcfJ.exe

MSConfigStartUp-BitDefender Antiphishing Helper - c:\program files\BitDefender\BitDefender 2011\ieshow.exe

MSConfigStartUp-SMSTray - c:\program files\Samsung\Samsung Media Studio 5\SMSTray.exe

AddRemove-LucasArts' Curse of Monkey Island - c:\windows\unin0407.exe

AddRemove-MessengerDiscovery3_is1 - c:\program files\MessengerDiscovery\unins000.exe

AddRemove-{7B63B2922B174135AFC0E1377DD81EC2} - c:\program files\DivX\DivXCodecUninstall.exe

.

.

.

**************************************************************************

Scanne versteckte Prozesse... 

.

Scanne versteckte Autostarteinträge... 

.

Scanne versteckte Dateien... 

.

Scan erfolgreich abgeschlossen

versteckte Dateien: 

.

**************************************************************************

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_USERS\S-1-5-21-1955313859-1678149478-2173258271-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]

"??"=hex:ab,c8,fb,f7,95,53,45,03,66,aa,fb,e1,8d,16,55,67,f0,e8,db,bb,da,72,06,

   b1,2d,1e,bd,5b,3e,dc,e0,da,32,a1,9f,12,f0,f4,ae,c3,e1,03,12,c3,da,4f,c2,bd,\

"??"=hex:5d,2e,bc,00,9b,07,bc,9c,34,34,87,88,c9,ab,ca,0d

.

[HKEY_USERS\S-1-5-21-1955313859-1678149478-2173258271-1000\Software\SecuROM\License information*]

"datasecu"=hex:f2,a9,5f,81,1d,e0,c9,78,ea,71,7e,e5,a2,64,a6,a2,1c,57,31,78,1a,

   74,07,69,47,e7,cd,64,ce,c6,ac,ac,b2,2a,c7,91,36,88,e4,01,d5,35,e2,11,fc,78,\

"rkeysecu"=hex:99,90,da,5a,ee,6d,f2,48,c2,53,53,2e,3b,a5,63,24

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

------------------------ Weitere laufende Prozesse ------------------------

.

c:\program files\Microsoft Security Client\Antimalware\MsMpEng.exe

c:\windows\system32\atiesrxx.exe

c:\program files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe

c:\windows\system32\atieclxx.exe

c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe

c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

c:\windows\system32\conime.exe

c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe

c:\windows\ehome\ehmsas.exe

c:\program files\Windows Media Player\wmpnetwk.exe

c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe

.

**************************************************************************

.

Zeit der Fertigstellung: 2012-02-23  06:32:29 - PC wurde neu gestartet

ComboFix-quarantined-files.txt  2012-02-23 05:32

.

Vor Suchlauf: 8 Verzeichnis(se), 105.293.590.528 Bytes frei

Nach Suchlauf: 12 Verzeichnis(se), 105.302.876.160 Bytes frei

.

- - End Of File - - D74203EF22E86621BDEC1BE7226E7A74

Ich hoffe auf eine gute Bilanz. :heulen:

Ja, CF hat gut was weggekloppt. :)

Mach bitte ein neues OTL-Log. Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:

hier steht das Log

CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

Starte bitte die OTL.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Setze oben mittig den Haken bei Scanne alle Benutzer
Kopiere nun den kompletten Inhalt aus der untenstehenden Codebox in die http://billy-oneal.com/Canned%20Spee.../customFix.png Textbox von OTL - wenn OTL auf deutsch ist wird sie mit http://larusso.trojaner-board.de/Images/otlfix.jpg beschriftet

Code:

netsvcs

msconfig

safebootminimal

safebootnetwork

activex

drivers32

%ALLUSERSPROFILE%\Application Data\*.

%ALLUSERSPROFILE%\Application Data\*.exe /s

%APPDATA%\*.

%APPDATA%\*.exe /s

%SYSTEMDRIVE%\*.exe

/md5start

wininit.exe

userinit.exe

eventlog.dll

scecli.dll

netlogon.dll

cngaudit.dll

ws2ifsl.sys

sceclt.dll

ntelogon.dll

winlogon.exe

logevent.dll

user32.DLL

iaStor.sys

nvstor.sys

atapi.sys

IdeChnDr.sys

viasraid.sys

AGP440.sys

vaxscsi.sys

nvatabus.sys

viamraid.sys

nvata.sys

nvgts.sys

iastorv.sys

ViPrt.sys

eNetHook.dll

ahcix86.sys

KR10N.sys

nvstor32.sys

ahcix86s.sys

/md5stop

%systemroot%\system32\drivers\*.sys /lockedfiles

%systemroot%\System32\config\*.sav

%systemroot%\*. /mp /s

%systemroot%\system32\*.dll /lockedfiles

CREATERESTOREPOINT

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Klick auf http://billy-oneal.com/Canned%20Spee.../OTL/btnOK.png.
Kopiere nun den Inhalt aus OTL.txt hier in Deinen Thread

Neuer OTL-Log:

Code:

OTL logfile created on: 23.02.2012 13:19:44 - Run 2

OTL by OldTimer - Version 3.2.33.2     Folder = C:\Users\Shadow315\Desktop

Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

2,00 Gb Total Physical Memory | 1,37 Gb Available Physical Memory | 68,50% Memory free

4,24 Gb Paging File | 3,16 Gb Available in Paging File | 74,39% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 315,33 Gb Total Space | 91,53 Gb Free Space | 29,03% Space Free | Partition Type: NTFS

Drive D: | 20,00 Gb Total Space | 13,42 Gb Free Space | 67,08% Space Free | Partition Type: FAT32

Drive J: | 931,51 Gb Total Space | 744,92 Gb Free Space | 79,97% Space Free | Partition Type: NTFS

 

Computer Name: SHADOW315-PC | User Name: Shadow315 | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2012.02.22 19:30:47 | 000,583,680 | ---- | M] (OldTimer Tools) -- C:\Users\Shadow315\Desktop\OTL(1).exe

PRC - [2012.01.22 08:40:04 | 003,025,112 | ---- | M] (Emsi Software GmbH) -- C:\Program Files\Emsisoft Anti-Malware\a2service.exe

PRC - [2012.01.13 14:53:18 | 000,652,360 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

PRC - [2011.10.12 21:10:00 | 000,397,312 | ---- | M] (AMD) -- C:\Windows\System32\atieclxx.exe

PRC - [2011.10.12 21:09:32 | 000,176,128 | ---- | M] (AMD) -- C:\Windows\System32\atiesrxx.exe

PRC - [2011.10.12 16:18:28 | 000,291,840 | ---- | M] (Advanced Micro Devices, Inc.) -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe

PRC - [2011.04.27 15:39:26 | 000,208,944 | ---- | M] (Microsoft Corporation) -- c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe

PRC - [2011.04.27 15:39:26 | 000,011,736 | ---- | M] (Microsoft Corporation) -- c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe

PRC - [2011.04.01 06:11:52 | 000,428,640 | ---- | M] (Logitech Inc.) -- C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe

PRC - [2011.03.28 11:21:16 | 000,249,648 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft\BingBar\SeaPort.EXE

PRC - [2009.04.11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe

 

 
 ========== Modules (No Company Name) ==========

 

MOD - [2011.10.12 20:28:52 | 000,037,376 | ---- | M] () -- C:\Windows\System32\atitmpxx.dll

MOD - [2011.08.07 21:41:18 | 000,046,592 | ---- | M] () -- C:\Program Files\Windows Live\Contacts\VERSION.dll

MOD - [2011.08.07 14:54:16 | 000,004,096 | ---- | M] () -- C:\Program Files\Yuna Software\Messenger Plus!\detour32.dll

MOD - [2011.04.11 13:58:21 | 000,390,656 | ---- | M] () -- C:\Program Files\Yuna Software\Messenger Plus!\lame_enc.dll

MOD - [2011.04.11 13:58:17 | 000,370,688 | ---- | M] () -- C:\Program Files\Yuna Software\Messenger Plus!\libsndfile.dll

MOD - [2010.01.20 19:55:31 | 000,163,728 | ---- | M] () -- C:\Program Files\Lavasoft\Ad-Aware\ShellExt.dll

MOD - [2007.09.20 17:34:58 | 000,129,024 | ---- | M] () -- C:\Program Files\WinRAR\rarext.dll

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV - [2012.01.22 08:40:04 | 003,025,112 | ---- | M] (Emsi Software GmbH) [Auto | Running] -- C:\Program Files\Emsisoft Anti-Malware\a2service.exe -- (a2AntiMalware)

SRV - [2012.01.13 14:53:18 | 000,652,360 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)

SRV - [2011.10.12 21:09:32 | 000,176,128 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\System32\atiesrxx.exe -- (AMD External Events Utility)

SRV - [2011.10.12 16:18:28 | 000,291,840 | ---- | M] (Advanced Micro Devices, Inc.) [Auto | Running] -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe -- (AMD FUEL Service)

SRV - [2011.04.27 15:39:26 | 000,208,944 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe -- (NisSrv)

SRV - [2011.04.27 15:39:26 | 000,011,736 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe -- (MsMpSvc)

SRV - [2011.04.01 11:14:30 | 000,183,560 | ---- | M] (Microsoft Corporation.) [On_Demand | Stopped] -- C:\Program Files\Microsoft\BingBar\BBSvc.EXE -- (BBSvc)

SRV - [2011.04.01 06:11:52 | 000,428,640 | ---- | M] (Logitech Inc.) [Auto | Running] -- C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe -- (UMVPFSrv)

SRV - [2011.03.28 11:21:16 | 000,249,648 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft\BingBar\SeaPort.EXE -- (SeaPort)

SRV - [2011.03.16 09:42:06 | 000,407,336 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Steam\SteamService.exe -- (Steam Client Service)

SRV - [2008.01.19 08:38:24 | 000,272,952 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - [2012.02.21 12:29:49 | 000,242,240 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\Windows\System32\drivers\dtsoftbus01.sys -- (dtsoftbus01)

DRV - [2011.12.10 15:24:06 | 000,020,464 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector)

DRV - [2011.11.02 10:13:12 | 000,051,632 | ---- | M] (Emsi Software GmbH) [File_System | On_Demand | Running] -- C:\PROGRAM FILES\EMSISOFT ANTI-MALWARE\a2accx86.sys -- (a2acc)

DRV - [2011.10.12 21:55:06 | 008,598,528 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\atikmdag.sys -- (R300)

DRV - [2011.10.12 21:55:06 | 008,598,528 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\atikmdag.sys -- (atikmdag)

DRV - [2011.10.12 21:55:06 | 008,598,528 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (amdkmdag)

DRV - [2011.10.12 20:30:18 | 000,257,024 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmpag.sys -- (amdkmdap)

DRV - [2011.06.06 23:06:42 | 000,081,936 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AtihdLH3.sys -- (AtiHDAudioService)

DRV - [2011.05.19 13:10:34 | 000,017,904 | ---- | M] (Emsi Software GmbH) [Kernel | System | Running] -- C:\Program Files\Emsisoft Anti-Malware\a2ddax86.sys -- (A2DDA)

DRV - [2011.04.27 15:25:24 | 000,065,024 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\NisDrvWFP.sys -- (NisDrv)

DRV - [2011.04.18 13:18:50 | 000,043,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\MpNWMon.sys -- (MpNWMon)

DRV - [2011.04.01 06:11:10 | 004,333,280 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\lvuvc.sys -- (LVUVC) Logitech HD Webcam C270(UVC)

DRV - [2011.04.01 06:09:48 | 000,291,424 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\lvrs.sys -- (LVRS)

DRV - [2010.06.23 08:21:32 | 000,259,176 | ---- | M] (Realtek                                            ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169)

DRV - [2010.02.18 09:18:22 | 000,037,944 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\amdiox86.sys -- (amdiox86)

DRV - [2008.05.02 09:58:28 | 000,008,064 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\usbser_lowerfltj.sys -- (UsbserFilt)

DRV - [2008.05.02 09:58:14 | 000,020,864 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ccdcmbo.sys -- (nmwcdc)

DRV - [2008.05.02 09:58:14 | 000,008,064 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\usbser_lowerflt.sys -- (upperdev)

DRV - [2008.05.02 09:58:12 | 000,017,536 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ccdcmb.sys -- (nmwcd)

DRV - [2004.10.26 10:22:50 | 000,002,410 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Program Files\FreshDevices\FreshDiagnose\FreshIO.sys -- (FreshIO)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank

 

 

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

 

 

IE - HKU\S-1-5-21-1955313859-1678149478-2173258271-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.farmerama.de/

IE - HKU\S-1-5-21-1955313859-1678149478-2173258271-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de

IE - HKU\S-1-5-21-1955313859-1678149478-2173258271-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 7C E9 8C 6E 2A BE CB 01  [binary data]

IE - HKU\S-1-5-21-1955313859-1678149478-2173258271-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1

IE - HKU\S-1-5-21-1955313859-1678149478-2173258271-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 
 ========== FireFox ==========

 

FF - prefs.js..browser.search.defaultengine: "Ask.com"

FF - prefs.js..browser.search.defaultenginename: "Ask.com"

FF - prefs.js..browser.search.defaultthis.engineName: "Bigpoint Games DE Customized Web Search"

FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2843456&SearchSource=3&q={searchTerms}"

FF - prefs.js..browser.search.order.1: "Ask.com"

FF - prefs.js..browser.search.selectedEngine: "Bigpoint Games DE Customized Web Search"

FF - prefs.js..browser.search.useDBForOrder: true

FF - prefs.js..browser.startup.homepage: "hxxp://www.united-forum.de/"

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}:6.0.25

FF - prefs.js..extensions.enabledItems: engine@conduit.com:3.3.3.2

FF - prefs.js..extensions.enabledItems: moveplayer@movenetworks.com:1.0.0.071303000004

FF - prefs.js..extensions.enabledItems: {0e3dbc69-a682-48da-84e1-82c63a5d678e}:3.3.3.2

FF - prefs.js..extensions.enabledItems: {64ead72b-ffd4-4e01-aa3a-4c71665d73e4}:3.2.5.2

FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.8.2

FF - prefs.js..extensions.enabledItems: {e001c731-5e37-4538-a5cb-8168736a2360}:0.9.9.109

FF - prefs.js..extensions.enabledItems: {07b2a769-ed19-4483-87ce-c643914c81bb}:3.0.0.91

FF - prefs.js..keyword.URL: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2843456&q=&SearchSource=2"

 

 

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()

FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)

FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)

FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll File not found

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.448: C:\Program Files\VistaCodecPack\rm\browser\plugins\nppl3260.dll (RealNetworks, Inc.)

FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.46: C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)

FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.3.46: C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)

FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.448: C:\Program Files\VistaCodecPack\rm\browser\plugins\nprpjplug.dll (RealNetworks, Inc.)

FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.46: C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)

FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=:  File not found

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@veetle.com/veetleCorePlugin,version=0.9.18: C:\Program Files\Veetle\plugins\npVeetle.dll (Veetle Inc)

FF - HKLM\Software\MozillaPlugins\@veetle.com/veetlePlayerPlugin,version=0.9.18: C:\Program Files\Veetle\Player\npvlc.dll (Veetle Inc)

FF - HKCU\Software\MozillaPlugins\@movenetworks.com/Quantum Media Player:  File not found

FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Program Files\Real\RealPlayer\browserrecord [2008.09.12 00:23:58 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.02.18 11:31:51 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.02.18 11:31:50 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 4.0b9\extensions\\Components: C:\Program Files\Mozilla Firefox 4.0 Beta 9\components [2011.01.20 14:21:18 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 4.0b9\extensions\\Plugins: C:\Program Files\Mozilla Firefox 4.0 Beta 9\plugins

 

[2008.09.10 13:40:34 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Shadow315\AppData\Roaming\mozilla\Extensions

[2012.02.19 11:36:34 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Shadow315\AppData\Roaming\mozilla\Firefox\Profiles\wa7hn65n.default\extensions

[2010.10.07 07:43:20 | 000,000,000 | ---D | M] (Vista-aero) -- C:\Users\Shadow315\AppData\Roaming\mozilla\Firefox\Profiles\wa7hn65n.default\extensions\{07b2a769-ed19-4483-87ce-c643914c81bb}

[2012.02.19 00:13:52 | 000,000,000 | ---D | M] (Bigpoint Games DE Community Toolbar) -- C:\Users\Shadow315\AppData\Roaming\mozilla\Firefox\Profiles\wa7hn65n.default\extensions\{0e3dbc69-a682-48da-84e1-82c63a5d678e}

[2010.10.07 07:43:26 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Shadow315\AppData\Roaming\mozilla\Firefox\Profiles\wa7hn65n.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}

[2012.02.19 00:13:50 | 000,000,000 | ---D | M] (BittorrentBar_DE Community Toolbar) -- C:\Users\Shadow315\AppData\Roaming\mozilla\Firefox\Profiles\wa7hn65n.default\extensions\{64ead72b-ffd4-4e01-aa3a-4c71665d73e4}

[2012.02.19 11:36:34 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\Shadow315\AppData\Roaming\mozilla\Firefox\Profiles\wa7hn65n.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}

[2012.02.17 02:17:33 | 000,000,000 | ---D | M] (Bitdefender QuickScan) -- C:\Users\Shadow315\AppData\Roaming\mozilla\Firefox\Profiles\wa7hn65n.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}

[2011.03.31 10:17:29 | 000,000,000 | ---D | M] (Conduit Engine) -- C:\Users\Shadow315\AppData\Roaming\mozilla\Firefox\Profiles\wa7hn65n.default\extensions\engine@conduit.com

[2009.09.27 07:38:21 | 000,000,000 | ---D | M] (Move Media Player) -- C:\Users\Shadow315\AppData\Roaming\mozilla\Firefox\Profiles\wa7hn65n.default\extensions\moveplayer@movenetworks.com

[2010.10.07 07:43:20 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Shadow315\AppData\Roaming\mozilla\Firefox\Profiles\wa7hn65n.default\extensions\{07b2a769-ed19-4483-87ce-c643914c81bb}\chrome\mozapps\extensions

[2011.01.12 21:02:48 | 000,000,937 | ---- | M] () -- C:\Users\Shadow315\AppData\Roaming\Mozilla\Firefox\Profiles\wa7hn65n.default\searchplugins\conduit.xml

[2010.03.07 20:23:00 | 000,002,272 | ---- | M] () -- C:\Users\Shadow315\AppData\Roaming\Mozilla\Firefox\Profiles\wa7hn65n.default\searchplugins\google-und-download-suche.xml

[2012.02.18 11:31:51 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\mozilla firefox\extensions

[2012.02.16 15:55:53 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll

[2011.04.14 04:08:00 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll

[2012.02.16 12:02:53 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml

[2012.02.16 11:48:01 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml

[2012.02.16 12:02:53 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml

[2012.02.16 12:02:53 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml

[2012.02.16 12:02:53 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml

[2012.02.16 12:02:53 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml

 
 ========== Chrome  ==========

 

CHR - default_search_provider: Google ()

CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}sourceid=chrome&ie={inputEncoding}&q={searchTerms}

CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?client=chrome&output=chrome&hl={language}&q={searchTerms}

 

O1 HOSTS File: ([2012.02.23 06:25:59 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1       localhost

O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer)

O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)

O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)

O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)

O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)

O4 - HKU\S-1-5-21-1955313859-1678149478-2173258271-1000..\Run: [DAEMON Tools Lite] J:\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0

O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-21-1955313859-1678149478-2173258271-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-21-1955313859-1678149478-2173258271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutorun = 0

O7 - HKU\S-1-5-21-1955313859-1678149478-2173258271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O9 - Extra 'Tools' menuitem : Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - Reg Error: Value error. File not found

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25)

O16 - DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 80.69.100.182 80.69.100.230

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{A6A378D7-69B5-4196-B7CF-54089DE93890}: DhcpNameServer = 80.69.100.182 80.69.100.230

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)

O24 - Desktop WallPaper: C:\Users\Shadow315\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg

O24 - Desktop BackupWallPaper: C:\Users\Shadow315\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

O34 - HKLM BootExecute: (autocheck autochk *)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = ComFile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 

NetSvcs: FastUserSwitchingCompatibility -  File not found

NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)

NetSvcs: Nla -  File not found

NetSvcs: Ntmssvc -  File not found

NetSvcs: NWCWorkstation -  File not found

NetSvcs: Nwsapagent -  File not found

NetSvcs: SRService -  File not found

NetSvcs: WmdmPmSp -  File not found

NetSvcs: LogonHours -  File not found

NetSvcs: PCAudit -  File not found

NetSvcs: helpsvc -  File not found

NetSvcs: uploadmgr -  File not found

 

MsConfig - StartUpFolder: C:^Users^Shadow315^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Logitech . Produktregistrierung.lnk -  - File not found

MsConfig - StartUpReg: Adobe Reader Speed Launcher - hkey= - key= - C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)

MsConfig - StartUpReg: DivXUpdate - hkey= - key= - C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()

MsConfig - StartUpReg: Logitech Vid - hkey= - key= - C:\Program Files\Logitech\Vid HD\Vid.exe (Logitech Inc.)

MsConfig - StartUpReg: LWS - hkey= - key= - C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe (Logitech Inc.)

MsConfig - StartUpReg: NBCore - hkey= - key= - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBCore.exe (Nero AG)

MsConfig - StartUpReg: PlusService - hkey= - key= - C:\Program Files\Yuna Software\Messenger Plus!\PlusService.exe (Yuna Software)

MsConfig - StartUpReg: QuickTime Task - hkey= - key= - C:\Program Files\QuickTime\QTTask.exe (Apple Inc.)

MsConfig - StartUpReg: Steam - hkey= - key= - C:\Program Files\Steam\Steam.exe (Valve Corporation)

MsConfig - StartUpReg: SunJavaUpdateSched - hkey= - key= - C:\Program Files\Common Files\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)

MsConfig - StartUpReg: TkBellExe - hkey= - key= - C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)

MsConfig - StartUpReg: Windows Defender - hkey= - key= -  File not found

MsConfig - State: "startup" - 2

 

SafeBootMin: AppMgmt -  File not found

SafeBootMin: Base - Driver Group

SafeBootMin: Boot Bus Extender - Driver Group

SafeBootMin: Boot file system - Driver Group

SafeBootMin: File system - Driver Group

SafeBootMin: Filter - Driver Group

SafeBootMin: HelpSvc - Service

SafeBootMin: MsMpSvc - c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe (Microsoft Corporation)

SafeBootMin: NTDS -  File not found

SafeBootMin: PCI Configuration - Driver Group

SafeBootMin: PNP Filter - Driver Group

SafeBootMin: Primary disk - Driver Group

SafeBootMin: sacsvr - Service

SafeBootMin: SCSI Class - Driver Group

SafeBootMin: System Bus Extender - Driver Group

SafeBootMin: WinDefend - C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)

SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

SafeBootNet: AppMgmt -  File not found

SafeBootNet: Base - Driver Group

SafeBootNet: Boot Bus Extender - Driver Group

SafeBootNet: Boot file system - Driver Group

SafeBootNet: File system - Driver Group

SafeBootNet: Filter - Driver Group

SafeBootNet: HelpSvc - Service

SafeBootNet: Messenger - Service

SafeBootNet: MsMpSvc - c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe (Microsoft Corporation)

SafeBootNet: NDIS Wrapper - Driver Group

SafeBootNet: NetBIOSGroup - Driver Group

SafeBootNet: NetDDEGroup - Driver Group

SafeBootNet: Network - Driver Group

SafeBootNet: NetworkProvider - Driver Group

SafeBootNet: NTDS -  File not found

SafeBootNet: PCI Configuration - Driver Group

SafeBootNet: PNP Filter - Driver Group

SafeBootNet: PNP_TDI - Driver Group

SafeBootNet: Primary disk - Driver Group

SafeBootNet: rdsessmgr - Service

SafeBootNet: sacsvr - Service

SafeBootNet: SCSI Class - Driver Group

SafeBootNet: Streams Drivers - Driver Group

SafeBootNet: System Bus Extender - Driver Group

SafeBootNet: TDI - Driver Group

SafeBootNet: WinDefend - C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)

SafeBootNet: WudfPf - Driver

SafeBootNet: WudfUsbccidDriver - Driver

SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net

SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient

SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService

SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans

SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers

SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

 

ActiveX: {0213C6AF-5562-4D09-884C-2ADCFC8C2F35} - Microsoft .NET Framework 1.1 Security Update (KB2656353)

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)

ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - 

ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0

ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework

ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework

ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)

ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - 

ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings

ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install

ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework

ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1

ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player

ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX: >{0AF45D3F-8287-45B9-8DAC-F4B808AB1136} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP

ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP

ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig

ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - 

 

Drivers32: msacm.ac3filter - C:\Windows\System32\ac3filter.acm ()

Drivers32: msacm.avis - C:\Windows\System32\ff_acm.acm ()

Drivers32: msacm.divxa32 - C:\Windows\System32\DivXa32.acm (Kristal StudioDFileDescription)

Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: msacm.l3codec - C:\Windows\System32\l3codecp.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: msacm.lhacm - C:\Windows\System32\lhacm.acm (Microsoft Corporation)

Drivers32: MSVideo - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)

Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)

Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)

Drivers32: vidc.DIVX - C:\Windows\System32\DivX.dll (DivX, Inc.)

Drivers32: VIDC.FFDS - C:\Windows\System32\ff_vfw.dll ()

Drivers32: VIDC.FPS1 - C:\Windows\System32\frapsvid.dll (Beepa P/L)

Drivers32: vidc.i420 - C:\Windows\System32\lvcodec2.dll (Logitech Inc.)

Drivers32: vidc.XVID - xvidvfw.dll File not found

Drivers32: vidc.yv12 - C:\Windows\System32\DivX.dll (DivX, Inc.)

 

CREATERESTOREPOINT

Restore point Set: OTL Restore Point

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2012.02.23 10:54:47 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{3886E663-1762-4252-A2D9-6837AB777513}

[2012.02.23 10:54:16 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{A5EF1E61-7AA8-4387-8966-D4945030E491}

[2012.02.23 09:50:43 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft

[2012.02.23 09:19:54 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{32D94D4B-CBB3-4B7E-9E4A-BC32841A99FA}

[2012.02.23 06:32:32 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\temp

[2012.02.23 06:26:33 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN

[2012.02.23 00:59:45 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe

[2012.02.23 00:59:45 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe

[2012.02.23 00:59:44 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe

[2012.02.23 00:59:32 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT

[2012.02.23 00:59:29 | 000,000,000 | ---D | C] -- C:\ComboFix

[2012.02.23 00:59:24 | 000,000,000 | ---D | C] -- C:\Qoobox

[2012.02.22 23:16:18 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{B0C7B858-43B7-4924-8591-A40A05F156C1}

[2012.02.22 21:02:04 | 004,417,295 | R--- | C] (Swearware) -- C:\Users\Shadow315\Desktop\ComboFix.exe

[2012.02.22 19:30:47 | 000,583,680 | ---- | C] (OldTimer Tools) -- C:\Users\Shadow315\Desktop\OTL(1).exe

[2012.02.22 11:15:26 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{A69EBF72-C5FF-411D-9A99-18662C7B64B0}

[2012.02.22 11:14:53 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{76F65C0C-38D4-4046-A6DC-D560EABC3A48}

[2012.02.21 19:15:20 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{70369FB5-FDF5-4047-ACE7-EAC3AB076ADC}

[2012.02.21 19:14:44 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{A9B2DCA6-76B1-43FF-86A0-F70E1EEE9EA8}

[2012.02.21 18:39:04 | 000,000,000 | ---D | C] -- C:\Program Files\ESET

[2012.02.21 12:31:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DAEMON Tools Lite

[2012.02.21 12:29:49 | 000,242,240 | ---- | C] (DT Soft Ltd) -- C:\Windows\System32\drivers\dtsoftbus01.sys

[2012.02.21 12:28:47 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Roaming\DAEMON Tools Lite

[2012.02.21 12:22:50 | 000,000,000 | ---D | C] -- C:\ProgramData\DAEMON Tools Lite

[2012.02.21 07:26:39 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Roaming\Malwarebytes

[2012.02.21 07:26:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2012.02.21 07:26:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2012.02.21 07:26:17 | 000,020,464 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys

[2012.02.21 07:26:17 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware

[2012.02.21 07:13:26 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{F24AF1E4-A10B-4A70-BEB1-7EDCBC84D6DF}

[2012.02.21 07:13:06 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{27544704-F64E-44C7-BF51-ADE1D80F822C}

[2012.02.20 21:47:55 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Security Client

[2012.02.20 16:06:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Emsisoft Anti-Malware

[2012.02.20 12:01:37 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{41AAFA97-7F6D-46CD-9897-5759D7404B2C}

[2012.02.20 12:01:07 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{8143BD9A-AE43-4337-8999-D6F4F568ADF6}

[2012.02.20 11:40:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner

[2012.02.20 11:40:19 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner

[2012.02.20 01:34:49 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\Documents\My Webcam Recordings

[2012.02.20 01:34:29 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Roaming\Systweak

[2012.02.20 01:33:45 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\MessengerDiscovery

[2012.02.20 01:33:33 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\Babylon

[2012.02.20 01:33:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Babylon

[2012.02.20 01:33:30 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Roaming\Babylon

[2012.02.20 01:33:04 | 000,000,000 | ---D | C] -- C:\ProgramData\MessengerDiscovery

[2012.02.20 00:00:33 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{77D89F3E-EBCB-475F-8267-93A12962E96B}

[2012.02.19 11:59:53 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{5DD57861-B579-46BA-8E6E-719AD013B49E}

[2012.02.19 11:59:27 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{BE4D851E-B32B-4429-B665-93D5EC85931C}

[2012.02.18 23:58:35 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{204E4CC5-711D-43F6-94B9-E6966E8899A4}

[2012.02.18 11:57:55 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{01585FDF-8634-4906-B8E3-3A6A3FEEC5F2}

[2012.02.18 11:57:32 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{3AC257C3-4755-47DB-BDE4-68002E435479}

[2012.02.17 23:56:45 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{4F9C5384-21A0-4D11-9D81-7488AE728FF8}

[2012.02.17 11:56:05 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{A5DE6D9E-1210-4C28-8788-FFD923B09CF3}

[2012.02.17 11:55:41 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{86B2D14D-4AC3-4DDB-BE76-AF98D9064556}

[2012.02.16 23:55:09 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{1553FBF2-89C8-477F-ABCF-3AFD1D162359}

[2012.02.16 23:54:47 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{9C66E938-635D-4833-B1FE-7667EA36AA80}

[2012.02.16 11:54:19 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{D91C4C36-EC4C-4C40-8123-C67510B66019}

[2012.02.16 11:53:56 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{85D85A01-539E-49B0-9AA8-381427DE7B98}

[2012.02.15 23:53:17 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{63529CF6-DE38-45D8-9225-C189FB3A5884}

[2012.02.15 11:52:38 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{9049A75C-2ABF-4FAD-B15A-C437DF41C3A8}

[2012.02.15 11:52:14 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{B51EBE4B-3D5B-4471-804B-75899572F3ED}

[2012.02.14 23:51:36 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{66613ABE-BE9F-4335-97C0-9635D2B5BAA0}

[2012.02.14 11:50:53 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{25211C75-1B94-470D-AC8C-3E17394E38C9}

[2012.02.14 11:50:29 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{D82F350A-48B8-4242-924F-83AD7755DA6D}

[2012.02.13 23:49:58 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{31832502-5729-46BC-9203-9996A04C12BA}

[2012.02.13 23:49:36 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{C5304BBD-DD08-455B-B27A-3990A26D8DDA}

[2012.02.13 11:48:09 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{5BB8FCC7-E86E-4A04-9E39-F2C2228A962D}

[2012.02.13 11:47:47 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{9FE56245-7F92-4D13-8B66-D566F49F3B69}

[2012.02.12 23:47:15 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{72DF1494-0B94-4D87-8E81-F79E2BBA5BB2}

[2012.02.12 23:46:52 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{8243B488-FA54-4648-83C4-8E477D9EA619}

[2012.02.12 11:46:21 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{26FFCFA4-106E-4F11-A2D7-69B81D9F7C0E}

[2012.02.12 11:46:00 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{D2D0E211-CACF-425F-8E9A-14885D258F4D}

[2012.02.11 23:03:25 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{05D98FCF-AAA3-4C81-8B2B-32B1DEAAC092}

[2012.02.11 11:02:45 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{F7A3C5E5-F676-4BC4-88F4-E6F53A32CF93}

[2012.02.11 11:02:21 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{D952C589-CE28-42A8-AA3A-9616DCFF76A6}

[2012.02.10 23:01:42 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{72B188B0-987C-42D0-A150-A64422146FAA}

[2012.02.10 23:01:17 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{74F69919-0FB5-4C41-A6FB-AF9FBB3B91C5}

[2012.02.10 11:00:45 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{755DB9B5-6DC5-4419-B532-7F8B206AD4A1}

[2012.02.10 11:00:24 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{EA58C833-3C34-46A0-BBF4-6E7D21044A18}

[2012.02.09 22:59:52 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{B8035375-0067-4953-A009-65F112255112}

[2012.02.09 10:59:08 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{60AF0DAC-E6C8-4B88-B6B4-230FD70666AE}

[2012.02.09 10:58:44 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{022D775A-818C-4A15-A97E-9BF25240A2CF}

[2012.02.08 22:58:03 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{26895E1E-3F5A-4FAE-8746-F2F40664FBA1}

[2012.02.08 10:57:27 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{369C0F28-25A8-4DB7-B856-2BDCAA097377}

[2012.02.08 10:57:06 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{C23E9956-0E87-4DF4-8199-188CF99951AE}

[2012.02.07 22:56:36 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{440DEE2B-C1F6-4F38-BD16-66CE35C76648}

[2012.02.07 10:56:00 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{D97EDF86-00FF-4462-8749-F8D251008614}

[2012.02.07 10:55:39 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{C467DCDC-CD8C-4E8E-9F76-44E7A06AB207}

[2012.02.06 22:55:06 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{1A7B318D-2377-44B1-80A0-04BFFAE82153}

[2012.02.06 10:54:28 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{4796BB5A-8163-4181-8507-5470C219DDBB}

[2012.02.06 10:54:07 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{89FB9DA1-B7A9-4AF2-B7E6-CD1C1BCAB632}

[2012.02.05 21:54:27 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{934F41B0-5B91-4795-BCAA-D80410DDA170}

[2012.02.05 09:54:04 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{604DC800-7E53-4B29-B293-9D159B3C0727}

[2012.02.05 09:53:43 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{FFADA01F-81C7-4EDC-BCFE-EC20233EABF0}

[2012.02.03 12:14:20 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{731C4AAD-3FC8-437A-BD5B-44624970AB15}

[2012.02.03 12:14:09 | 000,000,000 | ---D | C] -- C:\Users\Shadow315\AppData\Local\{ED16CA66-A6DC-4B86-BF42-91AD67D42B9C}

[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

 
 ========== Files - Modified Within 30 Days ==========

 

[2012.02.23 13:18:00 | 000,001,104 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

[2012.02.23 12:44:31 | 000,003,264 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0

[2012.02.23 12:44:31 | 000,003,264 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0

[2012.02.23 12:18:01 | 000,001,100 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job

[2012.02.23 10:44:27 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2012.02.23 06:25:59 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts

[2012.02.23 03:20:19 | 000,676,444 | ---- | M] () -- C:\Windows\System32\perfh007.dat

[2012.02.23 03:20:19 | 000,636,302 | ---- | M] () -- C:\Windows\System32\perfh009.dat

[2012.02.23 03:20:19 | 000,146,834 | ---- | M] () -- C:\Windows\System32\perfc007.dat

[2012.02.23 03:20:19 | 000,120,766 | ---- | M] () -- C:\Windows\System32\perfc009.dat

[2012.02.22 21:02:12 | 004,417,295 | R--- | M] (Swearware) -- C:\Users\Shadow315\Desktop\ComboFix.exe

[2012.02.22 19:30:47 | 000,583,680 | ---- | M] (OldTimer Tools) -- C:\Users\Shadow315\Desktop\OTL(1).exe

[2012.02.21 12:31:43 | 000,000,607 | ---- | M] () -- C:\Users\Public\Desktop\DAEMON Tools Lite.lnk

[2012.02.21 12:29:49 | 000,242,240 | ---- | M] (DT Soft Ltd) -- C:\Windows\System32\drivers\dtsoftbus01.sys

[2012.02.21 08:07:40 | 000,203,264 | ---- | M] () -- C:\Users\Shadow315\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2012.02.21 07:26:25 | 000,000,950 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2012.02.21 03:31:07 | 000,306,984 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT

[2012.02.20 21:49:39 | 000,002,154 | ---- | M] () -- C:\Windows\epplauncher.mif

[2012.02.20 16:06:37 | 000,000,932 | ---- | M] () -- C:\Users\Public\Desktop\Emsisoft Anti-Malware.lnk

[2012.02.20 11:40:19 | 000,000,848 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk

[2012.02.20 01:47:41 | 000,000,000 | -HS- | M] () -- C:\Windows\System32\dds_trash_log.cmd

[2012.02.20 01:33:51 | 000,000,237 | ---- | M] () -- C:\user.js

[2012.02.19 13:38:25 | 010,982,955 | ---- | M] () -- C:\Users\Shadow315\Desktop\3p  Licence 2 Kill   SNA Club Mix .mp3

[2012.02.19 11:55:23 | 000,000,841 | ---- | M] () -- C:\Users\Shadow315\Desktop\World of Warcraft.lnk

[2012.02.17 16:40:02 | 000,378,172 | ---- | M] () -- C:\Users\Shadow315\ok.jpg

[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

 
 ========== Files Created - No Company Name ==========

 

[2012.02.23 00:59:45 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe

[2012.02.23 00:59:45 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe

[2012.02.23 00:59:44 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe

[2012.02.23 00:59:44 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe

[2012.02.23 00:59:44 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe

[2012.02.22 00:00:19 | 013,903,445 | ---- | C] () -- C:\Users\Shadow315\Desktop\Allegria.mp3

[2012.02.21 12:31:43 | 000,000,607 | ---- | C] () -- C:\Users\Public\Desktop\DAEMON Tools Lite.lnk

[2012.02.21 07:26:25 | 000,000,950 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2012.02.20 21:49:39 | 000,002,154 | ---- | C] () -- C:\Windows\epplauncher.mif

[2012.02.20 21:48:18 | 000,001,852 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk

[2012.02.20 16:06:37 | 000,000,932 | ---- | C] () -- C:\Users\Public\Desktop\Emsisoft Anti-Malware.lnk

[2012.02.20 11:40:19 | 000,000,848 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk

[2012.02.20 01:43:25 | 000,000,000 | -HS- | C] () -- C:\Windows\System32\dds_trash_log.cmd

[2012.02.20 01:33:43 | 000,000,237 | ---- | C] () -- C:\user.js

[2012.02.19 13:37:54 | 010,982,955 | ---- | C] () -- C:\Users\Shadow315\Desktop\3p  Licence 2 Kill   SNA Club Mix .mp3

[2012.02.17 16:40:02 | 000,378,172 | ---- | C] () -- C:\Users\Shadow315\ok.jpg

[2011.10.12 20:28:52 | 000,037,376 | ---- | C] () -- C:\Windows\System32\atitmpxx.dll

[2011.10.12 16:16:30 | 000,056,832 | ---- | C] () -- C:\Windows\System32\OpenVideo.dll

[2011.08.17 20:48:44 | 000,237,701 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat

[2011.06.02 21:42:26 | 000,000,000 | ---- | C] () -- C:\Windows\System32\imwords.dat

[2011.06.02 21:42:26 | 000,000,000 | ---- | C] () -- C:\Windows\System32\im_markovian.dat

[2011.05.28 09:07:54 | 000,000,000 | ---- | C] () -- C:\Windows\System32\imblacklist.dat

[2011.05.28 08:29:50 | 000,867,468 | ---- | C] () -- C:\ProgramData\bdinstall.bin

[2011.04.09 17:55:28 | 000,179,261 | ---- | C] () -- C:\Windows\System32\xlive.dll.cat

[2011.04.01 06:07:02 | 010,877,272 | ---- | C] () -- C:\Windows\System32\LogiDPP.dll

[2011.04.01 06:07:02 | 000,102,744 | ---- | C] () -- C:\Windows\System32\LogiDPPApp.exe

[2011.04.01 06:06:56 | 000,331,608 | ---- | C] () -- C:\Windows\System32\DevManagerCore.dll

[2011.04.01 05:56:00 | 000,027,872 | ---- | C] () -- C:\Windows\System32\lvcoinst.ini

[2011.03.22 22:58:22 | 000,014,168 | ---- | C] () -- C:\Windows\System32\drivers\iKeyLFT2.dll

[2011.03.17 18:51:44 | 000,003,929 | ---- | C] () -- C:\Windows\System32\atipblag.dat

[2011.02.20 10:43:44 | 000,000,069 | ---- | C] () -- C:\Windows\NeroDigital.ini

[2010.10.24 19:34:19 | 000,000,510 | ---- | C] () -- C:\Windows\WORDPAD.INI

[2010.03.24 00:49:07 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin

[2010.02.24 23:54:59 | 000,021,840 | ---- | C] () -- C:\Windows\System32\SIntfNT.dll

[2010.02.24 23:54:59 | 000,017,212 | ---- | C] () -- C:\Windows\System32\SIntf32.dll

[2010.02.24 23:54:59 | 000,012,067 | ---- | C] () -- C:\Windows\System32\SIntf16.dll

 
 ========== LOP Check ==========

 

[2009.06.17 00:26:49 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\Ankh

[2009.07.28 10:58:31 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\Any Video Converter

[2012.02.20 01:33:30 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\Babylon

[2012.02.20 11:42:11 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\BitTorrent

[2009.10.12 12:32:36 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\BullGuard

[2009.05.13 11:31:34 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\Command & Conquer 3 Kanes Rache

[2010.10.14 19:02:32 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\Command & Conquer 3 Tiberium Wars

[2012.02.21 12:32:18 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\DAEMON Tools Lite

[2012.02.21 07:43:28 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\DataCast

[2010.11.26 20:20:01 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\Extensible XML Editor

[2011.09.24 17:03:33 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\FreshDiagnose

[2011.05.28 14:51:15 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\GetRightToGo

[2008.10.12 22:32:41 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\KaLoMa

[2010.05.22 08:52:01 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\Leadertech

[2011.03.21 08:45:58 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\LolClient

[2009.11.19 20:31:13 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\MAGIX

[2009.08.28 23:57:42 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\Octoshape

[2011.03.20 13:38:40 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\PlayFirst

[2012.02.23 11:53:02 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\QuickScan

[2009.03.19 23:33:42 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\Red Alert 3 Demo

[2011.05.26 18:51:40 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\RIFT

[2010.03.23 15:49:05 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\SystemSuite

[2012.02.21 07:41:21 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\Systweak

[2008.09.22 13:48:35 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\Template

[2010.02.04 10:04:53 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\The Bat!

[2012.02.20 11:42:11 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\TS3Client

[2009.09.09 11:56:50 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\Turbine

[2009.06.17 09:48:47 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\uTorrent

[2009.11.17 23:56:12 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\VistaCodecs

[2008.09.25 20:31:28 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\Xilisoft Corporation

[2012.02.20 11:13:54 | 000,000,000 | ---D | M] -- C:\Users\The_Crow\AppData\Roaming\Systweak

[2012.02.23 10:43:00 | 000,032,628 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

 
 ========== Purity Check ==========

 

 

 
 ========== Custom Scans ==========

 

 
 < %ALLUSERSPROFILE%\Application Data\*. >

 
 < %ALLUSERSPROFILE%\Application Data\*.exe /s >

 
 < %APPDATA%\*. >

[2009.07.26 12:19:33 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\Adobe

[2009.07.26 12:19:33 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\AdobeUM

[2009.06.17 00:26:49 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\Ankh

[2009.07.28 10:58:31 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\Any Video Converter

[2012.02.20 01:33:30 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\Babylon

[2012.02.20 11:42:11 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\BitTorrent

[2009.10.12 12:32:36 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\BullGuard

[2009.05.13 11:31:34 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\Command & Conquer 3 Kanes Rache

[2010.10.14 19:02:32 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\Command & Conquer 3 Tiberium Wars

[2012.02.21 12:32:18 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\DAEMON Tools Lite

[2012.02.21 07:43:28 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\DataCast

[2010.06.01 23:54:40 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\DivX

[2009.02.11 13:09:41 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\Download Manager

[2010.11.26 20:20:01 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\Extensible XML Editor

[2011.09.24 17:03:33 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\FreshDiagnose

[2011.05.28 14:51:15 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\GetRightToGo

[2008.09.10 13:34:28 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\Identities

[2008.10.12 22:32:41 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\KaLoMa

[2010.05.22 08:52:01 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\Leadertech

[2011.03.21 08:45:58 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\LolClient

[2008.09.10 18:27:39 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\Macromedia

[2009.11.19 20:31:13 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\MAGIX

[2012.02.21 07:26:39 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\Malwarebytes

[2006.11.02 13:37:34 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\Media Center Programs

[2010.10.14 11:08:58 | 000,000,000 | --SD | M] -- C:\Users\Shadow315\AppData\Roaming\Microsoft

[2009.06.07 08:23:09 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\Mozilla

[2009.02.21 05:13:08 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\Nero

[2009.08.28 23:57:42 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\Octoshape

[2011.03.20 13:38:40 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\PlayFirst

[2012.02.23 11:53:02 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\QuickScan

[2008.09.12 00:25:49 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\Real

[2009.03.19 23:33:42 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\Red Alert 3 Demo

[2011.05.26 18:51:40 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\RIFT

[2010.10.14 19:00:57 | 000,000,000 | RH-D | M] -- C:\Users\Shadow315\AppData\Roaming\SecuROM

[2012.02.20 11:42:11 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\Skype

[2009.01.27 00:15:21 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\Symantec

[2010.03.23 15:49:05 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\SystemSuite

[2012.02.21 07:41:21 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\Systweak

[2010.02.13 23:01:03 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\teamspeak2

[2008.09.22 13:48:35 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\Template

[2010.02.04 10:04:53 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\The Bat!

[2012.02.20 11:42:11 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\TS3Client

[2009.09.09 11:56:50 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\Turbine

[2009.06.17 09:48:47 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\uTorrent

[2009.11.17 23:56:12 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\VistaCodecs

[2008.09.14 18:51:47 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\WinRAR

[2008.09.25 20:31:28 | 000,000,000 | ---D | M] -- C:\Users\Shadow315\AppData\Roaming\Xilisoft Corporation

 
 < %APPDATA%\*.exe /s >

[2011.06.08 12:47:19 | 003,120,288 | ---- | M] (Adobe Systems, Inc.) -- C:\Users\Shadow315\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\fpupdateax\fpupdateax.exe

[2011.02.16 21:34:15 | 002,832,544 | ---- | M] (Adobe Systems, Inc.) -- C:\Users\Shadow315\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\fpupdatepl\fpupdatepl.exe

[2011.06.15 16:22:38 | 000,053,248 | R--- | M] (Acresso Software Inc.) -- C:\Users\Shadow315\AppData\Roaming\Microsoft\Installer\{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}\ARPPRODUCTICON.exe

 
 < %SYSTEMDRIVE%\*.exe >

 

 
 < MD5 for: AGP440.SYS  >

[2008.01.19 08:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_51b95d75\AGP440.sys

[2008.01.19 08:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys

[2008.01.19 08:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys

[2008.01.19 08:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_bbfe6647bbd2a4c6\AGP440.sys

[2006.11.02 10:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\ERDNT\cache\AGP440.sys

[2006.11.02 10:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\drivers\AGP440.sys

[2006.11.02 10:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys

 
 < MD5 for: ATAPI.SYS  >

[2009.04.11 07:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\ERDNT\cache\atapi.sys

[2009.04.11 07:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\drivers\atapi.sys

[2009.04.11 07:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_b12d8e84\atapi.sys

[2009.04.11 07:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys

[2008.01.19 08:41:30 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys

[2008.01.19 08:41:30 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys

[2006.11.02 10:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys

[2007.04.17 09:30:38 | 000,021,688 | ---- | M] (Microsoft Corporation) MD5=78620BDA3EC87816E5D1FA86F920BC3A -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c2a1b5ae\atapi.sys

[2007.04.17 09:30:38 | 000,021,688 | ---- | M] (Microsoft Corporation) MD5=78620BDA3EC87816E5D1FA86F920BC3A -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20518_none_dbd8b4d73d81c9d0\atapi.sys

[2008.09.11 02:11:21 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_7de13c21\atapi.sys

[2008.09.11 02:11:21 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16632_none_db337a442479c42c\atapi.sys

[2008.09.11 02:11:20 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=E03E8C99D15D0381E02743C36AFC7C6F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_64dfd8ea\atapi.sys

[2008.09.11 02:11:20 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=E03E8C99D15D0381E02743C36AFC7C6F -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20757_none_dbac78a93da31a8b\atapi.sys

 
 < MD5 for: CNGAUDIT.DLL  >

[2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\ERDNT\cache\cngaudit.dll

[2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll

[2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll

 
 < MD5 for: IASTORV.SYS  >

[2008.01.19 08:42:51 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_c9df7691\iaStorV.sys

[2008.01.19 08:42:51 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys

[2006.11.02 10:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\drivers\iaStorV.sys

[2006.11.02 10:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys

 
 < MD5 for: NETLOGON.DLL  >

[2006.11.02 10:46:11 | 000,559,616 | ---- | M] (Microsoft Corporation) MD5=889A2C9F2AACCD8F64EF50AC0B3D553B -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6000.16386_none_fb80f5473b0ed783\netlogon.dll

[2009.04.11 07:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\ERDNT\cache\netlogon.dll

[2009.04.11 07:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\System32\netlogon.dll

[2009.04.11 07:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_ffa3304f351bb3a3\netlogon.dll

[2008.01.19 08:35:36 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll

 
 < MD5 for: NVSTOR.SYS  >

[2006.11.02 10:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\drivers\nvstor.sys

[2006.11.02 10:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys

[2008.01.19 08:42:09 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys

[2008.01.19 08:42:09 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys

 
 < MD5 for: SCECLI.DLL  >

[2008.01.19 08:36:19 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll

[2006.11.02 10:46:12 | 000,176,640 | ---- | M] (Microsoft Corporation) MD5=80E2839D05CA5970A86D7BE2A08BFF61 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6000.16386_none_35d7205fdc305e3e\scecli.dll

[2009.04.11 07:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\ERDNT\cache\scecli.dll

[2009.04.11 07:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\System32\scecli.dll

[2009.04.11 07:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e\scecli.dll

 
 < MD5 for: USER32.DLL  >

[2008.09.11 02:02:10 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=63B4F59D7C89B1BF5277F1FFEFD491CD -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.16438_none_cb39bc5b7047127e\user32.dll

[2009.04.11 07:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) MD5=75510147B94598407666F4802797C75A -- C:\Windows\ERDNT\cache\user32.dll

[2008.09.11 02:02:10 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=9D9F061EDA75425FC67F0365E3467C86 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.20537_none_cbc258dc896598f1\user32.dll

[2008.01.19 08:36:46 | 000,627,200 | ---- | M] (Microsoft Corporation) MD5=B974D9F06DC7D1908E825DC201681269 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_cd386c416d5c7f32\user32.dll

[2006.11.02 10:46:13 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=E698A5437B89A285ACA3FF022356810A -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.16386_none_cb01aa4570716e5e\user32.dll

[2009.04.11 07:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\user32.dll

[2009.04.11 07:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6002.18005_none_cf23e54d6a7e4a7e\user32.dll

 
 < MD5 for: USERINIT.EXE  >

[2008.01.19 08:33:33 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\ERDNT\cache\userinit.exe

[2008.01.19 08:33:33 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe

[2008.01.19 08:33:33 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe

[2006.11.02 10:45:50 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=22027835939F86C3E47AD8E3FBDE3D11 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6000.16386_none_d9f1f819d4c4e737\userinit.exe

 
 < MD5 for: WININIT.EXE  >

[2008.01.19 08:33:37 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\ERDNT\cache\wininit.exe

[2008.01.19 08:33:37 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\System32\wininit.exe

[2008.01.19 08:33:37 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6001.18000_none_30f2b8cf0450a6a2\wininit.exe

[2006.11.02 10:45:57 | 000,095,744 | ---- | M] (Microsoft Corporation) MD5=D4385B03E8CCCEE6F0EE249F827C1F3E -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6000.16386_none_2ebbf6d3076595ce\wininit.exe

 
 < MD5 for: WINLOGON.EXE  >

[2012.01.13 14:53:20 | 000,182,856 | ---- | M] () MD5=63EEC8A8B221AB79045E776E5F592868 -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe

[2009.04.11 07:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\ERDNT\cache\winlogon.exe

[2009.04.11 07:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\System32\winlogon.exe

[2009.04.11 07:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe

[2006.11.02 10:45:57 | 000,308,224 | ---- | M] (Microsoft Corporation) MD5=9F75392B9128A91ABAFB044EA350BAAD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6000.16386_none_6d8c3f1ad8066b21\winlogon.exe

[2008.01.19 08:33:37 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe

 
 < MD5 for: WS2IFSL.SYS  >

[2006.11.02 09:58:26 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=84620AECDCFD2A7A14E6263927D8C0ED -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6000.16386_none_4d4fded8cae2956d\ws2ifsl.sys

[2008.01.19 06:56:49 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\System32\drivers\ws2ifsl.sys

[2008.01.19 06:56:49 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6001.18000_none_4f86a0d4c7cda641\ws2ifsl.sys

 
 < %systemroot%\system32\drivers\*.sys /lockedfiles >

[2011.04.18 13:18:50 | 000,043,392 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\system32\drivers\MpNWMon.sys

 
 < %systemroot%\System32\config\*.sav >

[2006.11.02 11:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV

[2006.11.02 11:34:05 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV

[2006.11.02 11:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV

[2006.11.02 11:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV

[2006.11.02 11:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV

 
 < %systemroot%\*. /mp /s >

 
 < %systemroot%\system32\*.dll /lockedfiles >

 
 ========== Files - Unicode (All) ==========

[2011.06.28 06:19:42 | 000,000,000 | ---- | M] ()(C:\Windows\System32\?????) -- C:\Windows\System32\獷楬汢捯污

[2011.06.28 06:19:42 | 000,000,000 | ---- | C] ()(C:\Windows\System32\?????) -- C:\Windows\System32\獷楬汢捯污

 
 ========== Alternate Data Streams ==========

 

@Alternate Data Stream - 10 bytes -> C:\Users\Shadow315\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\fpupdateax\fpupdateax.exe:BDU
 

< End of report >

Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:

:OTL

FF - prefs.js..browser.search.defaultengine: "Ask.com"

FF - prefs.js..browser.search.defaultenginename: "Ask.com"

FF - prefs.js..browser.search.defaultthis.engineName: "Bigpoint Games DE Customized Web Search"

FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2843456&SearchSource=3&q={searchTerms}"

FF - prefs.js..browser.search.order.1: "Ask.com"

FF - prefs.js..browser.search.selectedEngine: "Bigpoint Games DE Customized Web Search"

FF - prefs.js..browser.search.useDBForOrder: true

FF - prefs.js..browser.startup.homepage: "http://www.united-forum.de/"

FF - prefs.js..extensions.enabledItems: engine@conduit.com:3.3.3.2

FF - prefs.js..keyword.URL: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2843456&q=&SearchSource=2"

2012.02.19 00:13:52 | 000,000,000 | ---D | M] (Bigpoint Games DE Community Toolbar) -- C:\Users\Shadow315\AppData\Roaming\mozilla\Firefox\Profiles\wa7hn65n.default\extensions\{0e3dbc69-a682-48da-84e1-82c63a5d678e}

[2010.10.07 07:43:26 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Shadow315\AppData\Roaming\mozilla\Firefox\Profiles\wa7hn65n.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}

[2012.02.19 00:13:50 | 000,000,000 | ---D | M] (BittorrentBar_DE Community Toolbar) -- C:\Users\Shadow315\AppData\Roaming\mozilla\Firefox\Profiles\wa7hn65n.default\extensions\{64ead72b-ffd4-4e01-aa3a-4c71665d73e4}

[2011.03.31 10:17:29 | 000,000,000 | ---D | M] (Conduit Engine) -- C:\Users\Shadow315\AppData\Roaming\mozilla\Firefox\Profiles\wa7hn65n.default\extensions\engine@conduit.com

[2011.01.12 21:02:48 | 000,000,937 | ---- | M] () -- C:\Users\Shadow315\AppData\Roaming\Mozilla\Firefox\Profiles\wa7hn65n.default\searchplugins\conduit.xml

O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)

O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0

O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-21-1955313859-1678149478-2173258271-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-21-1955313859-1678149478-2173258271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutorun = 0

O7 - HKU\S-1-5-21-1955313859-1678149478-2173258271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O9 - Extra 'Tools' menuitem : Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - Reg Error: Value error. File not found

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

@Alternate Data Stream - 10 bytes -> C:\Users\Shadow315\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\fpupdateax\fpupdateax.exe:BDU

:Files

C:\Users\Shadow315\AppData\Local\Babylon

C:\ProgramData\Babylon

C:\Users\Shadow315\AppData\Roaming\Babylon

C:\Users\Shadow315\AppData\Local\{*

:Commands

[emptytemp]

[resethosts]

Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

OTL Fix-Log:

Code:

All processes killed

========== OTL ==========

Prefs.js: "Ask.com" removed from browser.search.defaultengine

Prefs.js: "Ask.com" removed from browser.search.defaultenginename

Prefs.js: "Bigpoint Games DE Customized Web Search" removed from browser.search.defaultthis.engineName

Prefs.js: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2843456&SearchSource=3&q={searchTerms}" removed from browser.search.defaulturl

Prefs.js: "Ask.com" removed from browser.search.order.1

Prefs.js: "Bigpoint Games DE Customized Web Search" removed from browser.search.selectedEngine

Prefs.js: true removed from browser.search.useDBForOrder

Prefs.js: "hxxp://www.united-forum.de/" removed from browser.startup.homepage

Prefs.js: engine@conduit.com:3.3.3.2 removed from extensions.enabledItems

Prefs.js: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2843456&q=&SearchSource=2" removed from keyword.URL

C:\Users\Shadow315\AppData\Roaming\mozilla\Firefox\Profiles\wa7hn65n.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}\defaults\preferences folder moved successfully.

C:\Users\Shadow315\AppData\Roaming\mozilla\Firefox\Profiles\wa7hn65n.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}\defaults folder moved successfully.

C:\Users\Shadow315\AppData\Roaming\mozilla\Firefox\Profiles\wa7hn65n.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}\chrome folder moved successfully.

C:\Users\Shadow315\AppData\Roaming\mozilla\Firefox\Profiles\wa7hn65n.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} folder moved successfully.

C:\Users\Shadow315\AppData\Roaming\mozilla\Firefox\Profiles\wa7hn65n.default\extensions\{64ead72b-ffd4-4e01-aa3a-4c71665d73e4}\searchplugin folder moved successfully.

C:\Users\Shadow315\AppData\Roaming\mozilla\Firefox\Profiles\wa7hn65n.default\extensions\{64ead72b-ffd4-4e01-aa3a-4c71665d73e4}\modules folder moved successfully.

C:\Users\Shadow315\AppData\Roaming\mozilla\Firefox\Profiles\wa7hn65n.default\extensions\{64ead72b-ffd4-4e01-aa3a-4c71665d73e4}\META-INF folder moved successfully.

C:\Users\Shadow315\AppData\Roaming\mozilla\Firefox\Profiles\wa7hn65n.default\extensions\{64ead72b-ffd4-4e01-aa3a-4c71665d73e4}\defaults folder moved successfully.

C:\Users\Shadow315\AppData\Roaming\mozilla\Firefox\Profiles\wa7hn65n.default\extensions\{64ead72b-ffd4-4e01-aa3a-4c71665d73e4}\components folder moved successfully.

C:\Users\Shadow315\AppData\Roaming\mozilla\Firefox\Profiles\wa7hn65n.default\extensions\{64ead72b-ffd4-4e01-aa3a-4c71665d73e4}\chrome folder moved successfully.

C:\Users\Shadow315\AppData\Roaming\mozilla\Firefox\Profiles\wa7hn65n.default\extensions\{64ead72b-ffd4-4e01-aa3a-4c71665d73e4} folder moved successfully.

C:\Users\Shadow315\AppData\Roaming\mozilla\Firefox\Profiles\wa7hn65n.default\extensions\engine@conduit.com\searchplugin folder moved successfully.

C:\Users\Shadow315\AppData\Roaming\mozilla\Firefox\Profiles\wa7hn65n.default\extensions\engine@conduit.com\META-INF folder moved successfully.

C:\Users\Shadow315\AppData\Roaming\mozilla\Firefox\Profiles\wa7hn65n.default\extensions\engine@conduit.com\lib folder moved successfully.

C:\Users\Shadow315\AppData\Roaming\mozilla\Firefox\Profiles\wa7hn65n.default\extensions\engine@conduit.com\DualPackage folder moved successfully.

C:\Users\Shadow315\AppData\Roaming\mozilla\Firefox\Profiles\wa7hn65n.default\extensions\engine@conduit.com\defaults folder moved successfully.

C:\Users\Shadow315\AppData\Roaming\mozilla\Firefox\Profiles\wa7hn65n.default\extensions\engine@conduit.com\components folder moved successfully.

C:\Users\Shadow315\AppData\Roaming\mozilla\Firefox\Profiles\wa7hn65n.default\extensions\engine@conduit.com\chrome folder moved successfully.

C:\Users\Shadow315\AppData\Roaming\mozilla\Firefox\Profiles\wa7hn65n.default\extensions\engine@conduit.com folder moved successfully.

C:\Users\Shadow315\AppData\Roaming\Mozilla\Firefox\Profiles\wa7hn65n.default\searchplugins\conduit.xml moved successfully.

Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d2ce3e00-f94a-4740-988e-03dc2f38c34f}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d2ce3e00-f94a-4740-988e-03dc2f38c34f}\ deleted successfully.

C:\Program Files\Microsoft\BingBar\BingExt.dll moved successfully.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{8dcb7100-df86-4384-8842-8fa844297b3f} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8dcb7100-df86-4384-8842-8fa844297b3f}\ deleted successfully.

File C:\Program Files\Microsoft\BingBar\BingExt.dll not found.

Registry key HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Restrictions\ deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDrives deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\EnableLUA deleted successfully.

Registry key HKEY_USERS\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found.

Registry key HKEY_USERS\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found.

Registry key HKEY_USERS\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found.

Registry key HKEY_USERS\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found.

Registry key HKEY_USERS\S-1-5-21-1955313859-1678149478-2173258271-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel\ deleted successfully.

Registry value HKEY_USERS\S-1-5-21-1955313859-1678149478-2173258271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveAutorun deleted successfully.

Registry value HKEY_USERS\S-1-5-21-1955313859-1678149478-2173258271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDrives deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{85d1f590-48f4-11d9-9669-0800200c9a66}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{85d1f590-48f4-11d9-9669-0800200c9a66}\ not found.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!

C:\autoexec.bat moved successfully.

ADS C:\Users\Shadow315\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\fpupdateax\fpupdateax.exe:BDU deleted successfully.

========== FILES ==========

C:\Users\Shadow315\AppData\Local\Babylon\Setup\HtmlScreens folder moved successfully.

C:\Users\Shadow315\AppData\Local\Babylon\Setup folder moved successfully.

C:\Users\Shadow315\AppData\Local\Babylon folder moved successfully.

C:\ProgramData\Babylon folder moved successfully.

C:\Users\Shadow315\AppData\Roaming\Babylon folder moved successfully.

C:\Users\Shadow315\AppData\Local\{006F0592-F965-4AF4-BB8C-B8C698DD2777} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{009418C8-3B44-4DB7-99C2-607D7EF497AE} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{00ED1909-FE55-4FBB-9252-F332E2F06F2F} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{0157D99F-9E3E-40EF-8A02-E5392C8FCED9} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{01585FDF-8634-4906-B8E3-3A6A3FEEC5F2} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{022D775A-818C-4A15-A97E-9BF25240A2CF} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{026AC8DD-8642-455C-9E47-D5160791687A} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{02D6050B-4550-481A-BE3A-0C941D693CDC} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{04969B16-AD44-47A4-88A5-92DFE8C5C887} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{04D5CEB7-EDE3-4A55-A9E2-372A97C7B22F} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{04FBCAF7-8E18-42E5-8799-A489D534D58F} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{05216EA5-C6FF-458E-8145-DB3393DB1256} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{0591499F-6F4F-4BA8-A882-27EF456E2520} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{05D98FCF-AAA3-4C81-8B2B-32B1DEAAC092} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{05EEEE45-CE99-4F87-929E-3EEC0F56D480} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{0636149F-7BCA-4563-B31A-3338BF12B580} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{066A8073-B21F-4071-9706-F4AD11EEE19E} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{06971723-06F9-4FE0-80D5-CFDFFA1CB459} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{0733DD9A-540A-4740-A135-52591840A217} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{07E93913-5AA7-442C-B773-3A446234088C} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{07F477D3-E7F8-424E-929B-9614B5AFFA4E} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{07F7436D-CE4C-4F59-8C43-135FF0670934} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{07FB4AF8-83BC-4C71-BE20-8115801255C9} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{08EE990C-3371-4BBB-A4E5-7CE02EAC1D12} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{09453A0A-FAE1-4D79-BD14-7926282E3C82} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{0AA28744-A417-4E25-9CF4-070B87B6B289} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{0AB8C0FB-198C-43CA-BF40-4A654EAEBD0B} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{0B8E554A-33F3-4F34-A79F-976271F06D6F} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{0C046897-13A1-42D1-9E97-3310D15F4212} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{0C55D9EA-F4AB-4D38-92C0-821C24749539} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{0C67378C-FD7F-453D-A501-FF6895B426D0} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{0CEDDA8C-AD30-4522-9DF2-76005DF4F1E8} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{0D208FE5-2133-491E-B28E-AA61FC27ECF0} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{0D5240D6-E7CF-4E86-B8EE-006FB6B254A9} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{0D5D7504-0657-4379-9677-E3C3DCC154B9} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{0D6A38B9-BC2B-48B4-A856-BB4B2F074AD9} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{0E2CBD3D-6158-450B-BF08-26763E43AFFD} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{0E470D62-DFDE-4EED-A484-31482EC38586} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{0E5D8F0C-2FB6-43E2-BE2E-64181EF49B0A} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{0EFAE0A8-E595-4580-9EB2-17902D976B6B} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{0F43BAFE-AAD1-4483-83E9-1343E1D6EA12} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{0F89F5EA-5990-463A-A3D7-A4D3130603D1} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{103B4144-3A0B-480A-BF3C-533ABFA377A5} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{11496562-C8D3-4754-83FB-DA407F6AA4D7} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{12C48C0A-474D-47EE-A600-53FC526255E3} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{145F6995-CF67-4F94-AD05-244F42C8AC29} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{14A3BD41-9E5F-4D85-AE72-EF327403C725} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{14BA84A6-4398-4716-9593-A211A6D0D9F7} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{14D9A3F7-4DEF-4E6B-A8D0-89B6914FCFB8} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{14EA3FCB-C819-4596-AFD4-E0C0CF9E0972} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{1545249A-3357-49FE-8D8D-6B4747016670} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{1553FBF2-89C8-477F-ABCF-3AFD1D162359} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{16E78744-5BCC-402F-A3C5-F9FD743C1F85} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{17A93DBE-3836-4075-BF27-45F106915DDE} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{17C7AC33-A90E-475A-97E4-034002421352} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{1819D974-6F3F-42DA-8648-54F20DFAB5DC} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{183FD842-1F56-4ED6-8C63-6113AE45EEA9} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{18F48B05-4D63-46F5-A7B6-2DD84CCA742F} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{19A0897A-CF38-4BBA-B858-F5BFF3491330} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{19D22AC9-AEBC-4F7E-94FC-BF5FEAF0162C} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{1A7B318D-2377-44B1-80A0-04BFFAE82153} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{1B2B2A69-0DB7-4263-9606-93EB5910D84E} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{1B2BEA10-D589-4F5F-AF03-A7A99B62E2CD} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{1CC261A7-288B-43A2-BDD7-ED7B48412925} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{1DB452D2-76AB-4220-93F1-74B4EC93CC96} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{1DDF35E5-E8CC-4F80-9A59-0FB8ED3E7B92} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{1EA5C689-70D5-4D86-B9AF-B0B57588214D} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{1EFD8F7E-1650-4406-AA63-FCCF876C39F4} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{1F00EE04-6E28-4728-B05E-E456C9428E3E} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{1F382F03-AC97-4074-ADB1-C14C5AE7DE0B} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{1F7D9909-22D6-4443-ABA8-2DA51067A987} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{204E4CC5-711D-43F6-94B9-E6966E8899A4} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{207FB1AB-3922-4267-876A-47906EBDAD8F} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{20A6B79C-7216-4560-982E-9F7D0B7D2A9F} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{21AEB2B0-88F8-4401-98A4-694EE2215465} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{21DD0073-352A-46B2-84FB-381FA874B2A6} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{22FDFC0A-0FD1-4C6E-8BCE-6E5C8159F9E1} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{231F8506-C104-41A4-A32A-CFAC2D4CC457} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{2330CA8B-634A-4189-A76E-ABC4A38B9BB7} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{235E6508-CB98-48AD-B77F-69FDF7085684} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{236B53EA-DE41-4D6D-954B-89D8758B6899} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{250BEBEE-E8DF-4200-B499-83A75F360EF8} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{25211C75-1B94-470D-AC8C-3E17394E38C9} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{25237F7C-D52A-48B5-93E0-8AE0B6D97EF0} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{256A87A1-A1DC-4BEC-B349-E8B9E32864BC} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{257F1DFD-C224-4251-9BC9-029C2657010F} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{263D25ED-7ECE-4963-8E83-E95660C8F3A8} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{26895E1E-3F5A-4FAE-8746-F2F40664FBA1} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{2697CBD9-E264-436D-9741-AE393720A7EF} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{26CE0F84-BF58-4F77-ABB9-CB3FBCC164F0} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{26FFCFA4-106E-4F11-A2D7-69B81D9F7C0E} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{274A4ED9-9EE0-4BF7-84F6-D2435EA58202} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{27544704-F64E-44C7-BF51-ADE1D80F822C} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{27AA579D-637A-4B86-8F88-39A94EC0A4D1} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{2A81D6CD-F398-4497-993F-63753BD066CF} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{2B9A6395-D8FF-4A91-A6DF-8AF8E5943AD1} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{2C24AB05-879B-4C3B-B876-0BE4D166F8DE} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{2CB49AA6-5667-47F1-B087-C9F6C05333E6} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{2CB637B1-7069-4E5D-AC8F-6CC89115A501} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{2D10F739-B36F-446A-BE7E-5AA086906979} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{2D97EBA7-4D6C-4441-835A-BA275F01AF03} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{2DCFD14D-0DAD-4346-8372-965BDA56FFD7} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{2E061DCD-FFE9-440A-8469-F3A785309055} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{2EF1519A-74CA-40D1-85CD-ADF773E2A987} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{2EFC4144-CA46-4AA2-88CE-F48AC74B6B51} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{2FB6BF03-6B92-4301-94B1-86176603CE6A} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{303F4722-5C2C-40E5-A789-2068EC3F9568} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{31224E18-D54D-4D5E-8039-401E3D73CE56} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{31832502-5729-46BC-9203-9996A04C12BA} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{31E2149D-B599-4DB1-86F2-90C1D8BD99BB} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{320F2416-27B4-4BA8-B666-D19B2CADF9C0} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{32BECF14-48E3-46A9-AE6B-1329A8CD5BE1} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{32BEE63B-9C89-4096-94D5-CF70A52B8363} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{32D94D4B-CBB3-4B7E-9E4A-BC32841A99FA} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{3318929A-6095-484A-A22C-2A61315533A2} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{341C291E-E8F6-4AC9-B9EE-0F48C05D991A} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{34379267-E256-4A38-806A-341AD22AB108} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{34515F4F-892A-458D-A707-38070C351D6A} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{34BF0876-C7ED-496D-85A8-FD49CD10634A} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{35C10195-D9B2-42A5-B2D2-9265D54B742B} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{3698B32C-A333-48D6-851D-424FC83C77BC} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{369C0F28-25A8-4DB7-B856-2BDCAA097377} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{36CF51E3-023C-4CD9-8D93-7DF5F01B6418} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{3736769A-A5E0-4CA0-94DA-04F0B5D9DD0E} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{385F053D-4BC2-4389-B1BD-AD59D8DC9EEB} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{3886E663-1762-4252-A2D9-6837AB777513} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{39157578-610F-4B69-A6E7-BE57CA97436E} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{3979068F-02EA-440F-AA89-3B664B9B4A72} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{3A8460B3-2682-41EB-90AA-85EB767B0EEB} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{3AC257C3-4755-47DB-BDE4-68002E435479} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{3BE1CC9E-8C2B-400A-B82D-EAD480E0DA83} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{3C249FC4-50EC-4902-B0CB-B6E4099A5E69} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{3C35DA5C-9522-4D20-8CD7-7D5C6A689E17} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{3C6E6C32-3585-4C20-9BF1-41C8C41DBD73} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{3C847D0D-F8D4-4F02-8F9A-73C5A8B40A9F} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{3D10B07E-7A84-4116-9500-3D82561801FA} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{3D4D84A4-3684-4599-BE60-D58FC87E2794} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{3DBFDB65-D46D-4A7B-8D8B-FC16A3563DF6} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{3E622F4F-AA4F-429E-A066-FEA0E1DF6C5B} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{3E763ED8-FEDC-4C61-A1A3-96E151297A6F} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{3E9A2B23-0EC6-405B-B3C7-376B82047C92} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{3FF17C79-044B-431B-BC2F-2065C6F99F37} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{40CCE7A1-BA70-4AA6-8AE1-3969F0F464D6} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{41AAFA97-7F6D-46CD-9897-5759D7404B2C} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{41C7D3E5-97F2-4AE9-990E-0DDB0E03E0EC} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{440DEE2B-C1F6-4F38-BD16-66CE35C76648} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{44B1C880-3928-46C8-AC27-CBDB58123047} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{44B762C8-0979-42F7-8D0A-DB1296534A2D} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{457EF2AE-99FE-4151-BD66-B0CF11B3381E} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{4690B8AC-10FF-4DE5-A27A-EA46739F6350} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{47253130-4421-4E1C-BC75-5A4142EB8664} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{4796BB5A-8163-4181-8507-5470C219DDBB} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{47C267FD-BD58-44D7-87E1-1226A173C0D1} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{4827D400-E158-4256-9F57-0DF396AC5897} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{4827E8C7-2D28-4AF9-AB17-2B2C52AF5312} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{482D5587-9BD3-4AB6-AFDD-AF1E7DE0A421} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{485C38A2-3D7D-4437-B04E-4E8DE57487DE} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{4887FD25-2A14-4036-9C6C-FA097BA4D695} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{48A20EB9-5F5F-4280-8434-3AEBB4DDDACC} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{4978C1C4-E654-47A8-8127-C267DBAD2D8B} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{4A396C46-2033-42DE-B96C-94F70476DF5B} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{4A9F5E3A-B993-4EEC-AF86-76EC2451496D} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{4AE74407-79DC-4B25-AE75-A6BDA5D0E0EF} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{4BE43EB2-7F26-4F79-901C-BE802BBA9F0A} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{4C641266-C64E-4482-9EAA-1E9B5BA6DC50} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{4C742C35-2A21-4515-9DCC-C2111F6779AC} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{4C7AE8FE-689D-499E-B74A-B51118031D12} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{4C86659D-6A29-46BE-8AC6-8589DFA9E2A6} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{4C9100AC-42DD-4FCA-AFE1-D8B92D8BCD09} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{4CC5F7BF-261E-4E74-BD45-A41C09DE9397} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{4D5773B1-3068-4630-B933-0F0D77148B65} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{4D9697AF-8E42-4F91-82C6-8C60C7A8A631} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{4DF84573-DF79-4AA8-863B-9DC4D45EC7BE} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{4DFDE630-1BE0-42D9-A137-E4CB6C433D90} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{4E10345C-7CC8-4F51-92C2-5FFA8B6F33B4} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{4E1D4F58-9F47-45F9-B923-42BDAA70D212} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{4E665635-BF64-4E49-ADDA-41F013311279} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{4F54957A-B240-43A8-9C26-1DFBF3C21716} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{4F7C2CDE-B4F9-4AF4-9496-C729DA0D7BB5} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{4F9C5384-21A0-4D11-9D81-7488AE728FF8} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{4FF0336D-B8F5-4D84-8D8D-AC439760C0E9} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{5018CDD4-05D2-48B0-86D9-B3B82D92B06D} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{5019F888-6B8A-49D1-B2AC-D445A2D9B07F} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{509E843A-3C02-431B-9B97-D6D7C616DED0} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{50EC99F7-4D9E-4C14-80FD-A10E95CD865A} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{5120586B-BA70-4E69-B641-8A3A290FFB57} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{513E8DE0-C4AA-49B9-9CFD-4059658506C1} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{517DC62F-BA14-410F-9513-439BCD429C6B} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{51C645E9-DF02-4EC8-95DC-7DE25BE54E3D} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{51F2B6BC-67A8-4EFB-B7D7-9E1AE8F0D98F} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{51F81C42-6150-490B-8D86-0DADA1298EC1} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{526A4659-35BE-461C-BBC9-433EB390B875} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{52B15898-6E87-41BB-B68B-88B5859099C2} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{53E6A797-7F5F-4257-8A31-7D704772572D} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{55564DA1-BD2A-4619-92CC-5F73ABEEE7E1} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{557D48B9-C967-49AA-97A2-633822E5AFCE} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{56CE9F34-6219-43BD-B5E4-4F762DE9A0AC} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{56E087A3-DFA0-44DA-BA98-EDE59F676A4D} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{56F6AA7C-0EDB-4371-8162-BEA976304F9F} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{5780D2F8-93B9-468F-8F4D-928109FA3C07} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{57BCF73B-76D4-4AF2-AF25-3A1EFEC2F4D5} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{57D1E6D5-F520-43CA-BDDC-22F3A32794BF} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{5805DA40-0903-4C4F-B8FE-1B0198442496} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{58BABD56-7F75-4F19-8CD3-2480D6CC476B} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{58CE93C0-996E-4E8D-AFC8-FD88F04236B6} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{59D854D0-6DC4-4EF5-864D-64D7FEB1E213} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{5A1A340D-1794-4FE4-BE74-CFB4F56C4774} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{5AD08BDE-DF53-4A80-BE96-ADF1A9EC6A95} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{5B5DCA3F-0C73-4F50-9C1A-8E4967EA4A7C} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{5B842855-88F0-400A-9F2F-510589AD64B3} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{5B96FDEF-17DF-457C-A219-515D181A0469} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{5BB8FCC7-E86E-4A04-9E39-F2C2228A962D} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{5C87B155-078F-4889-A6E6-1FC12371BB5E} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{5C9A7317-E6D9-4348-85F8-BEE32DF8CCE0} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{5CF5AF7E-48DF-468A-904D-A5778810332A} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{5DD57861-B579-46BA-8E6E-719AD013B49E} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{5F1E2A7C-A5F4-4B0E-B956-938790439620} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{604DC800-7E53-4B29-B293-9D159B3C0727} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{60955624-16B9-4143-ABA4-E055B121A4FF} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{60AF0DAC-E6C8-4B88-B6B4-230FD70666AE} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{61A17500-A595-46F8-A7C5-D4B97AD3071E} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{61ADDCA7-096D-4F6C-99CA-A81597FBA63D} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{626BF3B2-8D20-47C3-A6D7-1ED77F370AEB} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{6273B2A0-B162-4226-8C5E-47F6474D47A7} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{6274ACD4-C97F-45D0-9F15-426D4C2C9018} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{63529CF6-DE38-45D8-9225-C189FB3A5884} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{63BE4B41-C178-4240-B106-2040A6B398BA} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{63E92DB4-97DC-41B5-B4B5-3E7F35239B75} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{64D6F743-7885-47C3-B615-A9CCC3F3B458} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{658BD5A4-A945-439A-93BA-977199521477} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{661FB406-598C-4D4D-B292-CC75E175473F} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{66613ABE-BE9F-4335-97C0-9635D2B5BAA0} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{672587C3-5ECB-4E5D-B1EB-83C3800E10AF} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{67EE43A0-B53F-4CF2-B5C3-4C60D56D3809} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{682DB7D3-D5CA-4987-B3AC-828D56C3BBAF} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{68FA4EC8-D310-4D56-A174-D1094FDE0C35} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{69437C1C-93D0-4000-A6F5-E43C1761AF86} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{6AB21541-F236-4FB3-9FDC-43551D3EDADC} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{6AFDC64C-9932-466E-92D5-ECB833086F12} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{6B02E234-BFC7-47FD-8E7A-F2DA91B02E42} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{6B4347BA-DBC5-4DF5-9715-A9ABDEC419F7} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{6B6A24E6-407E-4318-A923-C6FD7E839F07} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{6B8F64A3-9359-4D60-921D-B375B596CBA1} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{6C0EA693-AE76-4736-A83D-4429A8E3B18F} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{6C5FBD0A-0C7A-446C-9651-FFD5EFE23386} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{6C65B052-58E5-430D-94A0-B41AC7835539} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{6D3CBA8B-CD37-4085-94EA-F5652A1267D0} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{6DBB3FEE-230A-46BE-B70B-CB542D6ED89D} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{6E48E01D-8A9E-4581-A4E4-77FC943A1CEC} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{6E8FAAF4-7CF1-4BDA-8361-7096B4C80C76} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{6EC2CBEE-F84F-400D-88E2-D32C05C2D39E} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{6ECDB68A-96F4-44BA-AE46-9C20B5F164B4} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{70369FB5-FDF5-4047-ACE7-EAC3AB076ADC} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{7058D967-17C8-4A15-8BE9-B5D57CB72A0F} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{72B188B0-987C-42D0-A150-A64422146FAA} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{72DF1494-0B94-4D87-8E81-F79E2BBA5BB2} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{731C4AAD-3FC8-437A-BD5B-44624970AB15} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{733A51C8-603E-48A1-AF4D-587F7BF16D5A} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{73FAC001-5A46-4025-8448-7966A7DD437C} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{744AAC39-EAEB-4D2F-BE5C-263A0C84898B} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{74F15D25-676E-48AE-9C91-4AE4929271F0} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{74F69919-0FB5-4C41-A6FB-AF9FBB3B91C5} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{755DB9B5-6DC5-4419-B532-7F8B206AD4A1} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{76564A45-A196-40B3-AE1B-7F6EACD0DAD5} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{7682D2EF-0756-4D28-8842-CD351E7CEB3E} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{768A2E3C-48BD-49A2-B3BB-2E1F34BE8280} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{76C6B91C-26FC-4B12-8F21-29F75DD88DF7} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{76F65C0C-38D4-4046-A6DC-D560EABC3A48} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{77D89F3E-EBCB-475F-8267-93A12962E96B} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{788BC542-F070-464E-84B0-981B459E647E} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{78984351-28F5-44D6-94E8-EBF998DDA566} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{797A1855-F81A-4707-8255-B13BBA9009E2} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{7AF19D3B-081D-4B59-94AA-7A3FF22414EE} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{7B1A0D88-88C6-4898-B861-206BC4303D85} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{7B9ED4C1-A891-4F26-866B-B4631DCFB1E3} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{7BADC895-E0F9-48A1-B51B-7B87EAD5D3CB} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{7E0F8D48-B11C-430D-B1FA-464B4B74ABE3} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{7E632F7D-F718-494E-B837-566ED384DE0D} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{7EE6277F-F9CD-4092-836E-84FB5FA19A03} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{7FF65361-EF77-4438-A774-70DDA737BEB8} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{8034D912-E4E7-4C6C-887B-EEC5E08B5A90} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{8143BD9A-AE43-4337-8999-D6F4F568ADF6} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{816EDFE2-E19D-477E-A062-077F4113E1FD} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{81A17EAC-22EE-4155-A3A7-2AD0AC5002F8} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{81C01F0D-68A9-4C39-9DBF-D1BC6F7A079D} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{8243B488-FA54-4648-83C4-8E477D9EA619} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{82A943B9-8056-490A-ADFB-490EB632AC99} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{82ED085D-1DA2-4F72-BD0C-88BD3FA78CCD} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{830430EA-E691-465A-8854-4DA5FD9ED89C} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{83EE6099-E0F4-49C9-800B-4B192F27EC6B} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{84569B34-67F7-4BB9-BACA-D39E43108CB1} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{84DFF195-B80F-415D-8C8A-011D67C7982E} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{84EA68E3-29FB-4859-9EA9-9EFCFBF972FE} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{85379E68-BE83-4AB9-9D8E-D93BABD7B482} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{85D85A01-539E-49B0-9AA8-381427DE7B98} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{865DB67E-1D66-4B77-82C1-64EBD484EF81} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{868B9C6B-838F-47DA-80D7-45478F3EE465} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{86B2D14D-4AC3-4DDB-BE76-AF98D9064556} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{87DBB701-B759-47EA-92C5-BED80D439251} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{8832F3BD-EC27-4FD2-9AF1-D16063777A21} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{884DCEA9-5BF1-4CF1-BD85-68DBB53175B7} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{88B1EBD3-7F8A-4DCD-BEF9-2387137DCEEC} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{88D77368-04E9-4291-B49D-02CF9D28040A} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{89220DDA-6467-41FB-9AE5-CCD8C9BDB6B3} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{89226179-BB98-4645-920F-F730AD5CA5A6} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{89CA3E97-BC45-4E87-847D-7915B0B9A4A3} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{89FB9DA1-B7A9-4AF2-B7E6-CD1C1BCAB632} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{8A7BEDBD-7015-464C-AD6D-D66D62CDE211} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{8AA5B78D-BF20-4AC0-B032-CEF5293D1161} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{8B88DD0A-EB2C-4C76-918F-CD8A147A7049} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{8C24C02A-2D23-4362-B584-E4F1E559C529} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{8C853DFC-63EE-471F-AE80-30FE60FF534A} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{8CC0FA7F-473B-4BC9-98B1-FF5AB9333751} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{8D966519-2073-403E-B4BD-A7482175AE80} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{8E4D4369-41DE-49BD-BD9A-7ADC4FECC1CD} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{8F20AA89-9BDC-4CFC-8B0B-0E29002080F6} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{9049A75C-2ABF-4FAD-B15A-C437DF41C3A8} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{9054476A-72A6-4B95-96C8-005E23EDDFCE} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{9070D01C-78FF-42EA-945C-7FF9FD6084A4} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{9277B366-2E3F-496C-87D5-B006FE4F1A9F} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{9348376A-649E-483C-B8DE-01D47D1FF419} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{934F41B0-5B91-4795-BCAA-D80410DDA170} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{935DCF75-A274-40BB-B492-C83EDB36F444} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{93B3E166-9D30-4785-A636-FEBAD29DABD4} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{9407D9AA-9565-41E3-8B5A-D5691C571D0B} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{941FC29D-1608-453B-917F-7A4C369D84A7} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{943758D1-245A-4CB3-886F-4D0607E07946} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{947A6AB7-AE25-4286-B382-F71470A6E6C4} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{9507B0ED-E835-4B02-BD62-0932D461626B} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{952A29A1-B535-4CD7-A94B-ECE37EB70176} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{95389941-2A77-471B-9DB7-6B29636258D4} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{95741D17-0EF9-45E2-9E77-A69D76F2BE61} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{960B479F-528F-4572-B53F-99B8DA472A68} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{968BB153-70C2-451B-81DA-C1763A4635C6} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{96D2D2C4-A817-45B1-85D8-866EE5B56FC4} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{985A8DCD-BB2B-4EA4-99F4-BE2A7A5002F4} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{988451C3-871B-45CC-96CC-FD3470900C4A} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{99920E42-53EC-49B1-A994-67F832BF8DD1} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{9A25BD1B-8B9E-4542-BDDF-672119FDCAA8} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{9ACE308C-1F46-4AA1-8AFD-F2269C2BA9BD} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{9B3A63F2-8F84-4DCD-B322-08E5CC2E8611} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{9B4D9662-1A39-47CF-B6B7-DC0BB530D802} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{9B73665E-64AE-4ABA-86C2-19A2021C8646} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{9C66E938-635D-4833-B1FE-7667EA36AA80} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{9CB57826-C814-44DB-93E9-C4B19018B868} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{9DDD2430-3637-4221-B1CB-E658A07BD125} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{9E5912E6-D614-4F2E-A837-2256E5093153} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{9E9EDBBF-5A88-4F4C-A9DC-7682006BD5B0} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{9F50FAD6-64C3-405F-90FF-5F6955601F6D} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{9F9CF9E3-653B-472E-BABA-2B35472D64C7} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{9FAAA53B-FACF-4404-A9A7-A7916652D6B0} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{9FDDF26C-2DC7-4DA8-91A1-3ADB4FCC3094} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{9FE56245-7F92-4D13-8B66-D566F49F3B69} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{A019F078-3F60-476E-A139-26A4974B8424} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{A0695E30-AE48-4D93-8C7F-2F7EED3CEDB5} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{A075F620-EEE0-46BB-B966-B842EFC338A2} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{A101BA41-CD5E-4B01-8961-99E83876CE8F} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{A15A13E8-4CC9-47E9-A658-F4E6448AC4C9} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{A185F7F8-73BC-445B-AE42-961619EEAF65} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{A3461DBF-0C05-4FDD-B1CC-B395720AA412} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{A3EE6E15-E694-4DE5-BE0B-9401F73CA3CE} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{A408CC43-4A2F-456D-99FA-3B9FE52257DE} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{A416C42B-CCEE-47D0-93EC-191081FAE19D} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{A4180847-8C60-4E68-800C-F01078296286} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{A44ADCE1-745F-4E12-9EB2-EF41034741C8} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{A4CBC82E-C3D2-456C-8A9A-AACBCE951272} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{A5DE6D9E-1210-4C28-8788-FFD923B09CF3} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{A5EF1E61-7AA8-4387-8966-D4945030E491} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{A60529EE-D84A-473E-B2C1-5D8C65331239} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{A69EBF72-C5FF-411D-9A99-18662C7B64B0} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{A86052A9-3DDC-41ED-8122-9CAE52BEFBC2} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{A9023B35-E85B-46DB-8005-C6D4173A58B2} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{A9B2DCA6-76B1-43FF-86A0-F70E1EEE9EA8} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{AB5250C4-2D61-4939-8F55-14E43720BAE7} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{ABDEF851-AF6D-4D94-B14F-A4D46BA1ACD1} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{AC115E54-C7A9-486B-89F9-0B923A2E3F38} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{AC2FE170-0A19-4216-9A0F-1C91131EA16A} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{AC553B29-96A3-479E-A7F2-F321DD0B4C3B} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{ACD32DDE-20D2-4EA0-B9CB-5C4149402BFD} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{AD614332-2D5A-4130-8170-EB141CED395E} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{ADC7AB80-39D4-41A6-B076-E3A655A2CCC1} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{ADDC9DBF-1DB1-43B8-BC05-1446D0BF1CC6} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{AE97B367-34F0-4EE1-AC0B-5EEEC92E8585} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{AF02A2D5-486C-45DF-8BBF-C01380597BDF} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{AF5FD4CF-D30D-46C4-8040-144CBDD8765F} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{AF6339E1-DD8D-459B-A378-8CCA4BE568C7} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{B0A224A0-6B60-44BE-839D-0C4C4EAFEC65} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{B0C7B858-43B7-4924-8591-A40A05F156C1} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{B1A7B9D4-D725-4969-9D8F-CFB9AC63C080} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{B1CE644F-9839-42B6-BBA9-3D162FDC0E66} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{B2BC899F-49C5-45D2-8785-F34CF578FCE8} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{B443575E-E985-4826-982C-626647238888} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{B51EBE4B-3D5B-4471-804B-75899572F3ED} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{B56E1BD4-A194-4969-92E8-7C9E5152F6C0} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{B584FFC5-0812-4986-AD90-2B529BDD0806} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{B59F7D5A-3D57-4D30-AF97-B94E5C3E7A1B} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{B5DE289A-C696-4B50-A671-C2800EEBAA57} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{B647B6AB-BF5B-4BE8-82CC-0EA8E5370274} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{B682B1BB-BD32-49FB-BCB2-F29F1E603481} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{B6F42802-A424-4347-8073-73A6EBBF0DF5} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{B8035375-0067-4953-A009-65F112255112} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{B8662203-5754-45EA-9DF1-BB8BF0E73AE7} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{B9721D78-E917-437D-9542-60387B26368C} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{B991ABA3-3179-4B72-B7F0-72D6C015D29B} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{BA51EF7E-8193-475B-99CF-2C6AFC3429E5} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{BAC3AF4A-98AD-4296-9FBD-AB3E8507628E} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{BBD7BCF8-E52B-494C-864E-999C18519D28} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{BBED1DDF-1DEA-49EF-9A97-1B0D339CEBB1} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{BC99E7FB-3C2E-4512-8EE5-A3FB51730538} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{BCCC2372-868C-4BFC-B3A7-BCE72D340923} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{BD0587F4-AE34-4726-A362-C16CFE6BC4B6} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{BD252FDF-860F-4C33-BE49-95B52FB4BD5B} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{BDFF4D03-84A3-4BAE-AAC3-46EF21CC93E4} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{BE4D851E-B32B-4429-B665-93D5EC85931C} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{BF8E994E-8B30-47E8-A200-D073B195C928} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{C0DB2AF9-70C2-47C7-83E4-A33C2AE9017A} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{C168F55D-C642-42B4-9975-B9B6EDEB75F0} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{C22EEA91-0FF0-4239-8888-2F3E7ACC9005} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{C23E9956-0E87-4DF4-8199-188CF99951AE} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{C37B9B9C-909C-4078-8682-0068AB13AEC0} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{C3AB9FCC-4F5C-4049-B487-C0BE64DFEBCA} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{C416481A-EC64-492F-A896-783863CF2B78} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{C41E417C-507A-429D-9B38-E6FB416DCADF} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{C467DCDC-CD8C-4E8E-9F76-44E7A06AB207} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{C4C5CC6D-D6FD-4799-9AD2-D495A18D91AF} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{C4CC69BE-44C5-4F5C-BB51-6529A1569DA1} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{C5304BBD-DD08-455B-B27A-3990A26D8DDA} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{C63CF3ED-D803-4E27-838C-3D1AC603494F} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{C78A1461-5B89-4232-B83D-9E00C4071F9E} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{C79A1B58-4052-4B39-A825-88F01D08C63E} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{C7E0F9F5-4870-413E-AE1B-B9CD0B137265} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{C7E42794-F724-4803-BA07-9DB4898813C3} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{C816F6EE-7F8C-416F-B96E-B90ABFB53A7C} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{C8AEAA86-4611-4646-AEEB-991F41C29E24} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{C8EA96A6-FFD7-4CBE-95C5-3DCA303EC332} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{C9E21730-5E04-43DA-923A-409B827A0363} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{CA1FDCB5-2F8A-4589-B4D9-6DA11DD4EFD2} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{CACC1797-CD0C-4086-B4D3-D1F61204A6B1} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{CC60A842-3522-4899-8311-CC4402B8A995} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{CCA5A4EE-4592-4443-B508-CB15AF4BC4F7} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{CD59D2CD-0E31-4E11-8817-A95807D6E4D3} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{CD8C757A-03A7-4378-8C59-D7EBE530ADEA} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{CDAFE6F2-38AC-4EC5-BEAA-0309DF53B91F} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{CE2344AF-877A-4383-BE2C-4939772F2216} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{CE86EB63-1630-4015-827A-A8B0788ADE17} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{CE96945A-F505-450C-9F10-92AE0CA2FB37} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{CF355942-0EE4-4058-A9CC-8C399980B759} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{D192B7CA-66D4-49DF-BC35-2E6FAC2006E3} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{D1CC03AC-FFC1-47C2-B532-1BB54C55481D} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{D1E2F30F-8E1E-4F97-B34A-15738420F9E5} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{D2D0E211-CACF-425F-8E9A-14885D258F4D} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{D3482E47-7551-4351-BAD9-B60B2AD63961} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{D42BE435-C79E-4C87-96E3-0D1DB3B970FF} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{D4D437E9-2B4B-4B5D-BEA8-1F8D620C8B8A} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{D4E97219-D02C-44C1-83ED-1EF9F34321BD} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{D53CB74D-2D52-44E8-BB43-1493B79987B6} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{D55FAA80-4F28-4245-8F2B-C477E1C46153} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{D5694951-0607-4DAD-9351-FF7F9FE01365} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{D57CA70F-A129-40B5-91E0-5AD5BEB8EEE0} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{D5859964-6055-451C-B289-F6A4A7241AE4} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{D5941F39-F87C-487A-9F67-D3057F5FC9FE} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{D5A2DF63-A7F5-4696-9EBB-58471F08B4EB} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{D6247264-7E84-494F-BD95-9FB7C9871951} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{D62BAD5A-F133-4310-B17D-4FD9BFFDFF35} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{D7AE88DC-98C6-4427-A5FF-93EF4206F71F} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{D7BDBC08-7311-4DC8-90CD-6B3335D2CB67} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{D82F350A-48B8-4242-924F-83AD7755DA6D} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{D84517DB-2A90-4FEE-AA08-1BE57A39A417} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{D8843315-6809-4F10-A27B-3C87333C5096} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{D8997E65-E979-406B-A154-119FE078561D} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{D91C4C36-EC4C-4C40-8123-C67510B66019} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{D9385915-4E32-4C3E-9B2A-D145B72D5038} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{D9515F24-067E-4108-83F2-3C0AC24873D9} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{D952C589-CE28-42A8-AA3A-9616DCFF76A6} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{D976B4F4-950B-4284-BD21-E7AFAABE958F} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{D97EDF86-00FF-4462-8749-F8D251008614} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{D9B35307-EDE4-499A-9D41-7E94F797110C} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{D9DA8B33-D3AF-44FC-9E2D-6875736585CF} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{D9EC5436-2F9F-486A-B84F-01A97DBA9940} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{D9FC2B14-BCE0-424F-AE4B-B4E54F44EE95} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{DA6AB39E-8D89-408E-B8E9-7DA49F95D387} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{DA6F37F7-0540-4AE0-839F-1AC292AD7D4B} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{DC12EAA1-D975-476C-AFF8-34C25EE90034} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{DC66581B-AC5B-4BF6-BFA5-6A680E6A6A7A} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{DE4E2FF8-074F-4E69-B00E-7DC160B3C83A} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{DE6391A4-1C54-4E84-B9F7-9E74339AD6C5} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{DEC013DF-E188-4D46-8762-20CEFDEFBD99} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{DFD7CD8A-CDE0-4DB3-AD3E-436F8A4B1C24} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{E0246EF7-D3EB-4EAE-ADE5-FB88A4B433BA} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{E04416FB-1BFE-41A4-B93A-BAC062651EC4} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{E0B1EB9D-3A50-4D0D-84FE-9532F24F9EFC} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{E0CD6B99-9FFE-4685-B7AF-4460D265556E} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{E1E88E47-D68E-49AE-AE63-84EE6AF6005D} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{E2A693CA-2A31-4AE5-A2CC-EDC3F54C09DF} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{E2B69390-E2F8-407D-A09D-36818428DEA7} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{E4BF6343-7CA1-4DF9-B098-84388BB52157} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{E4EF1C78-D7FE-4FB3-97E4-85E3FA7D3253} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{E58ED186-77F5-459C-8E7D-BC5EFB0C9A1D} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{E63B59F2-BE55-4031-8676-43EDAF7DA6EB} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{E67FA90B-6D68-47DE-820E-4BAF2C140A49} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{E78B8CA3-C64E-43C7-B238-3F4B62E92E09} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{E8759786-79B7-44B8-92DD-B8347079C188} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{E932DAFB-3EF5-4075-BB36-939F384BFEEB} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{E97DEDAA-D501-418A-8321-041E0C1CB97D} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{E9CF1087-020A-4247-A965-8663E98F09A4} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{EA58C833-3C34-46A0-BBF4-6E7D21044A18} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{EB471120-5676-4DB2-A8BE-7FB7AA8E2693} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{ECBAB8C7-4567-4A51-8DB9-F4119D91A5EA} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{ECFA1CA9-EE92-4471-B194-04E07DC4B00B} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{ED16CA66-A6DC-4B86-BF42-91AD67D42B9C} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{ED9A0E17-0118-4241-9C34-8F5E407155B8} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{EE82DF1D-75E3-46E8-A980-26BD8EBA35EC} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{EEC98477-65A3-4AAD-B7B4-917FB0AA5D30} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{EF04D59C-B9BB-4DB0-9398-53196BD59E37} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{EF2A350B-3AF4-4E38-A556-8942D84611A1} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{EFD57A17-83B5-4E4F-A06F-E90674541713} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{F0B04576-E545-437D-B18F-AEC2185FD210} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{F0EFED24-699A-4F7D-8008-FDEE2EE93195} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{F191ED3A-68E3-4168-B7C2-0CBDB264146C} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{F2365C21-1A19-4C05-BCEB-781C0080372F} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{F24AF1E4-A10B-4A70-BEB1-7EDCBC84D6DF} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{F2D3506A-C66B-4C80-9D1B-B92FF8A9ADF5} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{F2DB68D4-108D-41A0-B704-1B24E55FD308} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{F2F7EE53-688D-4A72-B145-EB6CC8EA93F4} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{F2FA054A-91A3-4371-AACE-0CA476616444} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{F309151F-4FE9-44C3-B724-DD0FF08917D1} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{F3107D8F-AA13-407A-9C50-902ED9E96D3B} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{F31E199F-BE9E-4E0C-B77A-50C6D5EB99F3} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{F3AF5928-BD79-4A87-9DBB-B005F08CDB9B} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{F416AA15-A56A-42F3-9A53-FE1EB265A779} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{F4889F4D-EDCB-4076-8396-0DF0ADAF4DB3} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{F4C144E8-6EF1-4CE9-85B2-8511AE9F99CE} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{F4E8B569-C04F-4A6F-B8B5-616859514FA1} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{F501EB54-91F4-452B-8A04-CF63359CE1D5} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{F54F421F-CE65-4C33-B92D-0171DCFF9582} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{F555DF0F-BE7A-4AD6-9778-F284F99CC231} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{F620C11F-33F9-46EA-B34A-4318AAF4A53D} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{F741E37B-A6AB-4C24-A94A-393235743E3F} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{F7A3C5E5-F676-4BC4-88F4-E6F53A32CF93} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{F839E988-2A2A-413A-8183-D29EACA8710C} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{F873699E-7A43-4480-9BD9-497C65D15CEF} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{F88203BB-D8EC-4485-ABE4-7A1A813C9EC4} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{F8F18770-3C7E-4BB6-8DD7-457D86AC9DDE} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{F9624BE9-7D24-49EC-9941-F3A9A6B05579} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{FAAEDC24-63AC-415E-A5B7-136085142867} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{FC1948E1-459D-4246-94B4-C9AB6F2F40DB} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{FC313F70-AB87-451C-B224-2497341E54EA} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{FC3485DD-4D68-4E27-95A4-EB996FB26E45} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{FD368424-2C84-4FC9-A8AE-922E3EED8878} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{FE7F6B73-1932-428F-BB06-60CEA99F76F7} folder moved successfully.

C:\Users\Shadow315\AppData\Local\{FFADA01F-81C7-4EDC-BCFE-EC20233EABF0} folder moved successfully.

========== COMMANDS ==========

 

[EMPTYTEMP]

 

User: All Users

 

User: Default

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 67 bytes

 

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

 

User: Public

->Temp folder emptied: 0 bytes

 

User: Shadow315

->Temp folder emptied: 1140959 bytes

->Temporary Internet Files folder emptied: 56105838 bytes

->Java cache emptied: 21101234 bytes

->FireFox cache emptied: 26911493 bytes

->Google Chrome cache emptied: 0 bytes

->Flash cache emptied: 5962638 bytes

 

User: The_Crow

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33237 bytes

 

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 4002 bytes

RecycleBin emptied: 0 bytes

 

Total Files Cleaned = 106,00 mb

 

C:\Windows\System32\drivers\etc\Hosts moved successfully.

HOSTS file reset successfully

 

OTL by OldTimer - Version 3.2.33.2 log created on 02232012_204202
 

Files\Folders moved on Reboot...

C:\Users\Shadow315\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TNTKA7LG\messengerscripttracking[1].htm moved successfully.

File\Folder C:\Users\Shadow315\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8YGO2CUZ\ADSAdClient31[1].htm not found!
 

Registry entries deleted on Reboot...

Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten => http://www.trojaner-board.de/82358-t...entfernen.html

Hinweis: Bitte den Virenscanner abstellen bevor du den TDSS-Killer ausführst, denn v.a. Avira meldet im TDSS-Tool oft einen Fehlalarm!

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.
Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition (meistens Laufwerk C:) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtkwmtcxexhp/setting...8_16-25-18.jpg

Falls du durch die Infektion auf deine Dokumente/Eigenen Dateien nicht zugreifen kannst, Verknüpfungen auf dem Desktop oder im Startmenü unter "alle Programme" fehlen, bitte unhide ausführen:
Downloade dir bitte unhide.exe und speichere diese Datei auf deinem Desktop.
Starte das Tool und es sollten alle Dateien und Ordner wieder sichtbar sein. ( Könnte eine Weile dauern )
http://www.trojaner-board.de/images/icons/icon4.gif Windows-Vista und Windows-7-User müssen das Tool per Rechtsklick als Administrator ausführen! http://www.trojaner-board.de/images/icons/icon4.gif

Hier der TDSS-Killer Log:

Code:

23:21:36.0120 3056        TDSS rootkit removing tool 2.7.13.0 Feb 15 2012 19:33:14

23:21:36.0205 3056        ============================================================

23:21:36.0205 3056        Current date / time: 2012/02/23 23:21:36.0205

23:21:36.0205 3056        SystemInfo:

23:21:36.0205 3056        

23:21:36.0206 3056        OS Version: 6.0.6002 ServicePack: 2.0

23:21:36.0206 3056        Product type: Workstation

23:21:36.0206 3056        ComputerName: SHADOW315-PC

23:21:36.0206 3056        UserName: Shadow315

23:21:36.0206 3056        Windows directory: C:\Windows

23:21:36.0206 3056        System windows directory: C:\Windows

23:21:36.0206 3056        Processor architecture: Intel x86

23:21:36.0206 3056        Number of processors: 2

23:21:36.0206 3056        Page size: 0x1000

23:21:36.0206 3056        Boot type: Normal boot

23:21:36.0206 3056        ============================================================

23:21:37.0430 3056        Drive \Device\Harddisk0\DR0 - Size: 0x53D67B6000 (335.35 Gb), SectorSize: 0x200, Cylinders: 0xAB01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050

23:21:37.0513 3056        Drive \Device\Harddisk1\DR1 - Size: 0xE8E0DB6000 (931.51 Gb), SectorSize: 0x200, Cylinders: 0x1DB01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'

23:21:37.0514 3056        \Device\Harddisk0\DR0:

23:21:37.0515 3056        MBR used

23:21:37.0515 3056        \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x276AB000

23:21:37.0534 3056        \Device\Harddisk0\DR0\Partition1: MBR, Type 0xB, StartLBA 0x276AB83F, BlocksNum 0x2807182

23:21:37.0534 3056        \Device\Harddisk1\DR1:

23:21:37.0535 3056        MBR used

23:21:37.0535 3056        \Device\Harddisk1\DR1\Partition0: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x74705982

23:21:37.0655 3056        Initialize success

23:21:37.0655 3056        ============================================================

23:40:40.0764 3844        ============================================================

23:40:40.0764 3844        Scan started

23:40:40.0764 3844        Mode: Manual; SigCheck; TDLFS; 

23:40:40.0764 3844        ============================================================

23:40:41.0123 3844        a2acc           (05dac43a484272de87eac038814a7840) C:\PROGRAM FILES\EMSISOFT ANTI-MALWARE\a2accx86.sys

23:40:41.0279 3844        a2acc - ok

23:40:41.0357 3844        A2DDA           (f7eabca8375ea2dc6f35c4bca4757515) C:\Program Files\Emsisoft Anti-Malware\a2ddax86.sys

23:40:41.0404 3844        A2DDA - ok

23:40:41.0638 3844        ACPI            (82b296ae1892fe3dbee00c9cf92f8ac7) C:\Windows\system32\drivers\acpi.sys

23:40:41.0669 3844        ACPI - ok

23:40:41.0716 3844        adp94xx         (2edc5bbac6c651ece337bde8ed97c9fb) C:\Windows\system32\drivers\adp94xx.sys

23:40:41.0747 3844        adp94xx - ok

23:40:41.0841 3844        adpahci         (b84088ca3cdca97da44a984c6ce1ccad) C:\Windows\system32\drivers\adpahci.sys

23:40:41.0903 3844        adpahci - ok

23:40:41.0934 3844        adpu160m        (7880c67bccc27c86fd05aa2afb5ea469) C:\Windows\system32\drivers\adpu160m.sys

23:40:41.0965 3844        adpu160m - ok

23:40:41.0997 3844        adpu320         (9ae713f8e30efc2abccd84904333df4d) C:\Windows\system32\drivers\adpu320.sys

23:40:42.0028 3844        adpu320 - ok

23:40:42.0215 3844        AFD             (3911b972b55fea0478476b2e777b29fa) C:\Windows\system32\drivers\afd.sys

23:40:42.0340 3844        AFD - ok

23:40:42.0465 3844        aic78xx         (ae1fdf7bf7bb6c6a70f67699d880592a) C:\Windows\system32\drivers\djsvs.sys

23:40:42.0496 3844        aic78xx - ok

23:40:42.0527 3844        aliide          (496eda16a127ac9a38bb285bef17dbb5) C:\Windows\system32\drivers\aliide.sys

23:40:42.0543 3844        aliide - ok

23:40:42.0636 3844        amdagp          (2b13e304c9dfdfa5eb582f6a149fa2c7) C:\Windows\system32\drivers\amdagp.sys

23:40:42.0667 3844        amdagp - ok

23:40:42.0699 3844        amdide          (6f65f4147c54398d7280b18cebbed215) C:\Windows\system32\drivers\amdide.sys

23:40:42.0730 3844        amdide - ok

23:40:42.0745 3844        amdiox86        (ff258424f0b2ef25eb98f04ee386e6e3) C:\Windows\system32\DRIVERS\amdiox86.sys

23:40:42.0777 3844        amdiox86 - ok

23:40:42.0808 3844        AmdK7           (dc487885bcef9f28eece6fac0e5ddfc5) C:\Windows\system32\drivers\amdk7.sys

23:40:43.0026 3844        AmdK7 - ok

23:40:43.0167 3844        AmdK8           (93ae7f7dd54ab986a6f1a1b37be7442d) C:\Windows\system32\DRIVERS\amdk8.sys

23:40:43.0307 3844        AmdK8 - ok

23:40:45.0117 3844        amdkmdag        (fef6346529b840ae859de65a0f4773d2) C:\Windows\system32\DRIVERS\atikmdag.sys

23:40:45.0522 3844        amdkmdag - ok

23:40:45.0803 3844        amdkmdap        (0e245c8be29baf0084b95c4d16542a79) C:\Windows\system32\DRIVERS\atikmpag.sys

23:40:45.0865 3844        amdkmdap - ok

23:40:45.0975 3844        arc             (5f673180268bb1fdb69c99b6619fe379) C:\Windows\system32\drivers\arc.sys

23:40:46.0006 3844        arc - ok

23:40:46.0037 3844        arcsas          (957f7540b5e7f602e44648c7de5a1c05) C:\Windows\system32\drivers\arcsas.sys

23:40:46.0053 3844        arcsas - ok

23:40:46.0162 3844        AsyncMac        (53b202abee6455406254444303e87be1) C:\Windows\system32\DRIVERS\asyncmac.sys

23:40:46.0240 3844        AsyncMac - ok

23:40:46.0489 3844        atapi           (1f05b78ab91c9075565a9d8a4b880bc4) C:\Windows\system32\drivers\atapi.sys

23:40:46.0505 3844        atapi - ok

23:40:46.0583 3844        AtiHDAudioService (f71b6ee018eadf4cfd52f3c83847e5f6) C:\Windows\system32\drivers\AtihdLH3.sys

23:40:46.0630 3844        AtiHDAudioService - ok

23:40:47.0223 3844        atikmdag        (fef6346529b840ae859de65a0f4773d2) C:\Windows\system32\DRIVERS\atikmdag.sys

23:40:47.0441 3844        atikmdag - ok

23:40:47.0644 3844        Beep            (67e506b75bd5326a3ec7b70bd014dfb6) C:\Windows\system32\drivers\Beep.sys

23:40:47.0675 3844        Beep - ok

23:40:47.0784 3844        blbdrive - ok

23:40:47.0847 3844        bowser          (35f376253f687bde63976ccb3f2108ca) C:\Windows\system32\DRIVERS\bowser.sys

23:40:47.0940 3844        bowser - ok

23:40:48.0049 3844        BrFiltLo        (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\drivers\brfiltlo.sys

23:40:48.0159 3844        BrFiltLo - ok

23:40:48.0190 3844        BrFiltUp        (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\drivers\brfiltup.sys

23:40:48.0237 3844        BrFiltUp - ok

23:40:48.0315 3844        Brserid         (b304e75cff293029eddf094246747113) C:\Windows\system32\drivers\brserid.sys

23:40:48.0393 3844        Brserid - ok

23:40:48.0502 3844        BrSerWdm        (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\system32\drivers\brserwdm.sys

23:40:48.0595 3844        BrSerWdm - ok

23:40:48.0751 3844        BrUsbMdm        (bd456606156ba17e60a04e18016ae54b) C:\Windows\system32\drivers\brusbmdm.sys

23:40:48.0783 3844        BrUsbMdm - ok

23:40:48.0829 3844        BrUsbSer        (af72ed54503f717a43268b3cc5faec2e) C:\Windows\system32\drivers\brusbser.sys

23:40:48.0892 3844        BrUsbSer - ok

23:40:48.0954 3844        BTHMODEM        (ad07c1ec6665b8b35741ab91200c6b68) C:\Windows\system32\drivers\bthmodem.sys

23:40:49.0032 3844        BTHMODEM - ok

23:40:49.0344 3844        catchme - ok

23:40:49.0687 3844        cdfs            (7add03e75beb9e6dd102c3081d29840a) C:\Windows\system32\DRIVERS\cdfs.sys

23:40:49.0781 3844        cdfs - ok

23:40:49.0937 3844        cdrom           (6b4bffb9becd728097024276430db314) C:\Windows\system32\DRIVERS\cdrom.sys

23:40:50.0046 3844        cdrom - ok

23:40:50.0249 3844        circlass        (da8e0afc7baa226c538ef53ac2f90897) C:\Windows\system32\drivers\circlass.sys

23:40:50.0296 3844        circlass - ok

23:40:50.0343 3844        CLFS            (d7659d3b5b92c31e84e53c1431f35132) C:\Windows\system32\CLFS.sys

23:40:50.0389 3844        CLFS - ok

23:40:50.0499 3844        cmdide          (59172a0724f2ab769f31d61b0571d75b) C:\Windows\system32\drivers\cmdide.sys

23:40:50.0530 3844        cmdide - ok

23:40:50.0561 3844        Compbatt        (82b8c91d327cfecf76cb58716f7d4997) C:\Windows\system32\drivers\compbatt.sys

23:40:50.0577 3844        Compbatt - ok

23:40:50.0608 3844        crcdisk         (2a213ae086bbec5e937553c7d9a2b22c) C:\Windows\system32\drivers\crcdisk.sys

23:40:50.0623 3844        crcdisk - ok

23:40:50.0670 3844        Crusoe          (22a7f883508176489f559ee745b5bf5d) C:\Windows\system32\drivers\crusoe.sys

23:40:50.0733 3844        Crusoe - ok

23:40:50.0779 3844        DfsC            (622c41a07ca7e6dd91770f50d532cb6c) C:\Windows\system32\Drivers\dfsc.sys

23:40:50.0873 3844        DfsC - ok

23:40:51.0060 3844        disk            (5d4aefc3386920236a548271f8f1af6a) C:\Windows\system32\drivers\disk.sys

23:40:51.0107 3844        disk - ok

23:40:51.0154 3844        drmkaud         (97fef831ab90bee128c9af390e243f80) C:\Windows\system32\drivers\drmkaud.sys

23:40:51.0201 3844        drmkaud - ok

23:40:51.0294 3844        dtsoftbus01     (687af6bb383885ff6a64071b189a7f3e) C:\Windows\system32\DRIVERS\dtsoftbus01.sys

23:40:51.0388 3844        dtsoftbus01 - ok

23:40:51.0637 3844        DXGKrnl         (c68ac676b0ef30cfbb1080adce49eb1f) C:\Windows\System32\drivers\dxgkrnl.sys

23:40:51.0715 3844        DXGKrnl - ok

23:40:51.0747 3844        E1G60           (f88fb26547fd2ce6d0a5af2985892c48) C:\Windows\system32\DRIVERS\E1G60I32.sys

23:40:51.0840 3844        E1G60 - ok

23:40:52.0168 3844        Ecache          (7f64ea048dcfac7acf8b4d7b4e6fe371) C:\Windows\system32\drivers\ecache.sys

23:40:52.0199 3844        Ecache - ok

23:40:52.0261 3844        elxstor         (e8f3f21a71720c84bcf423b80028359f) C:\Windows\system32\drivers\elxstor.sys

23:40:52.0293 3844        elxstor - ok

23:40:52.0371 3844        exfat           (22b408651f9123527bcee54b4f6c5cae) C:\Windows\system32\drivers\exfat.sys

23:40:52.0449 3844        exfat - ok

23:40:52.0901 3844        fastfat         (1e9b9a70d332103c52995e957dc09ef8) C:\Windows\system32\drivers\fastfat.sys

23:40:52.0948 3844        fastfat - ok

23:40:53.0291 3844        fdc             (63bdada84951b9c03e641800e176898a) C:\Windows\system32\DRIVERS\fdc.sys

23:40:53.0369 3844        fdc - ok

23:40:53.0447 3844        FETNDIS         (b2b2c38e916184ff8523c7439ddd417f) C:\Windows\system32\DRIVERS\fetnd5.sys

23:40:53.0525 3844        FETNDIS - ok

23:40:53.0853 3844        FileInfo        (a8c0139a884861e3aae9cfe73b208a9f) C:\Windows\system32\drivers\fileinfo.sys

23:40:53.0899 3844        FileInfo - ok

23:40:54.0009 3844        Filetrace       (0ae429a696aecbc5970e3cf2c62635ae) C:\Windows\system32\drivers\filetrace.sys

23:40:54.0055 3844        Filetrace - ok

23:40:54.0087 3844        flpydisk        (6603957eff5ec62d25075ea8ac27de68) C:\Windows\system32\DRIVERS\flpydisk.sys

23:40:54.0165 3844        flpydisk - ok

23:40:54.0648 3844        FltMgr          (01334f9ea68e6877c4ef05d3ea8abb05) C:\Windows\system32\drivers\fltmgr.sys

23:40:54.0695 3844        FltMgr - ok

23:40:54.0757 3844        FreshIO         (caac750e6d27866c28494e0de9fa802a) C:\Program Files\FreshDevices\FreshDiagnose\FreshIO.sys

23:40:54.0820 3844        FreshIO ( UnsignedFile.Multi.Generic ) - warning

23:40:54.0820 3844        FreshIO - detected UnsignedFile.Multi.Generic (1)

23:40:54.0991 3844        fssfltr         (d909075fa72c090f27aa926c32cb4612) C:\Windows\system32\DRIVERS\fssfltr.sys

23:40:55.0054 3844        fssfltr - ok

23:40:55.0132 3844        Fs_Rec          (65ea8b77b5851854f0c55c43fa51a198) C:\Windows\system32\drivers\Fs_Rec.sys

23:40:55.0194 3844        Fs_Rec - ok

23:40:55.0272 3844        gagp30kx        (4e1cd0a45c50a8882616cae5bf82f3c5) C:\Windows\system32\drivers\gagp30kx.sys

23:40:55.0303 3844        gagp30kx - ok

23:40:55.0428 3844        GEARAspiWDM     (ab8a6a87d9d7255c3884d5b9541a6e80) C:\Windows\system32\Drivers\GEARAspiWDM.sys

23:40:55.0475 3844        GEARAspiWDM - ok

23:40:55.0537 3844        HdAudAddService (3f90e001369a07243763bd5a523d8722) C:\Windows\system32\drivers\HdAudio.sys

23:40:55.0631 3844        HdAudAddService - ok

23:40:55.0693 3844        HDAudBus        (062452b7ffd68c8c042a6261fe8dff4a) C:\Windows\system32\DRIVERS\HDAudBus.sys

23:40:55.0803 3844        HDAudBus - ok

23:40:56.0021 3844        HidBth          (1338520e78d90154ed6be8f84de5fceb) C:\Windows\system32\drivers\hidbth.sys

23:40:56.0115 3844        HidBth - ok

23:40:56.0255 3844        HidIr           (ff3160c3a2445128c5a6d9b076da519e) C:\Windows\system32\drivers\hidir.sys

23:40:56.0333 3844        HidIr - ok

23:40:56.0661 3844        HidUsb          (cca4b519b17e23a00b826c55716809cc) C:\Windows\system32\DRIVERS\hidusb.sys

23:40:56.0723 3844        HidUsb - ok

23:40:56.0770 3844        HpCISSs         (df353b401001246853763c4b7aaa6f50) C:\Windows\system32\drivers\hpcisss.sys

23:40:56.0785 3844        HpCISSs - ok

23:40:57.0051 3844        HTTP            (f870aa3e254628ebeafe754108d664de) C:\Windows\system32\drivers\HTTP.sys

23:40:57.0160 3844        HTTP - ok

23:40:57.0441 3844        i2omp           (324c2152ff2c61abae92d09f3cca4d63) C:\Windows\system32\drivers\i2omp.sys

23:40:57.0487 3844        i2omp - ok

23:40:57.0690 3844        i8042prt        (22d56c8184586b7a1f6fa60be5f5a2bd) C:\Windows\system32\DRIVERS\i8042prt.sys

23:40:57.0768 3844        i8042prt - ok

23:40:58.0080 3844        iaStorV         (c957bf4b5d80b46c5017bf0101e6c906) C:\Windows\system32\drivers\iastorv.sys

23:40:58.0143 3844        iaStorV - ok

23:40:58.0174 3844        iirsp           (2d077bf86e843f901d8db709c95b49a5) C:\Windows\system32\drivers\iirsp.sys

23:40:58.0205 3844        iirsp - ok

23:40:58.0299 3844        intelide        (e5ea1c17da5065032e346591ff64f3af) C:\Windows\system32\drivers\intelide.sys

23:40:58.0314 3844        intelide - ok

23:40:58.0361 3844        intelppm        (ce44cc04262f28216dd4341e9e36a16f) C:\Windows\system32\DRIVERS\intelppm.sys

23:40:58.0423 3844        intelppm - ok

23:40:58.0704 3844        IpFilterDriver  (62c265c38769b864cb25b4bcf62df6c3) C:\Windows\system32\DRIVERS\ipfltdrv.sys

23:40:58.0798 3844        IpFilterDriver - ok

23:40:58.0907 3844        IpInIp - ok

23:40:59.0047 3844        IPMIDRV         (40f34f8aba2a015d780e4b09138b6c17) C:\Windows\system32\drivers\ipmidrv.sys

23:40:59.0157 3844        IPMIDRV - ok

23:40:59.0297 3844        IPNAT           (8793643a67b42cec66490b2a0cf92d68) C:\Windows\system32\DRIVERS\ipnat.sys

23:40:59.0391 3844        IPNAT - ok

23:40:59.0734 3844        IRENUM          (109c0dfb82c3632fbd11949b73aeeac9) C:\Windows\system32\drivers\irenum.sys

23:40:59.0812 3844        IRENUM - ok

23:41:00.0155 3844        isapnp          (350fca7e73cf65bcef43fae1e4e91293) C:\Windows\system32\drivers\isapnp.sys

23:41:00.0202 3844        isapnp - ok

23:41:00.0249 3844        iScsiPrt        (232fa340531d940aac623b121a595034) C:\Windows\system32\DRIVERS\msiscsi.sys

23:41:00.0264 3844        iScsiPrt - ok

23:41:00.0327 3844        iteatapi        (bced60d16156e428f8df8cf27b0df150) C:\Windows\system32\drivers\iteatapi.sys

23:41:00.0358 3844        iteatapi - ok

23:41:00.0373 3844        iteraid         (06fa654504a498c30adca8bec4e87e7e) C:\Windows\system32\drivers\iteraid.sys

23:41:00.0389 3844        iteraid - ok

23:41:00.0436 3844        kbdclass        (37605e0a8cf00cbba538e753e4344c6e) C:\Windows\system32\DRIVERS\kbdclass.sys

23:41:00.0467 3844        kbdclass - ok

23:41:00.0561 3844        kbdhid          (d2600cb17b7408b4a83f231dc9a11ac3) C:\Windows\system32\drivers\kbdhid.sys

23:41:00.0623 3844        kbdhid - ok

23:41:00.0935 3844        KSecDD          (2b2f1638466e8cb091400c9019cc730e) C:\Windows\system32\Drivers\ksecdd.sys

23:41:00.0997 3844        KSecDD - ok

23:41:01.0294 3844        lltdio          (d1c5883087a0c3f1344d9d55a44901f6) C:\Windows\system32\DRIVERS\lltdio.sys

23:41:01.0387 3844        lltdio - ok

23:41:01.0731 3844        LSI_FC          (a2262fb9f28935e862b4db46438c80d2) C:\Windows\system32\drivers\lsi_fc.sys

23:41:01.0762 3844        LSI_FC - ok

23:41:01.0793 3844        LSI_SAS         (30d73327d390f72a62f32c103daf1d6d) C:\Windows\system32\drivers\lsi_sas.sys

23:41:01.0824 3844        LSI_SAS - ok

23:41:01.0887 3844        LSI_SCSI        (e1e36fefd45849a95f1ab81de0159fe3) C:\Windows\system32\drivers\lsi_scsi.sys

23:41:01.0902 3844        LSI_SCSI - ok

23:41:01.0965 3844        luafv           (8f5c7426567798e62a3b3614965d62cc) C:\Windows\system32\drivers\luafv.sys

23:41:02.0058 3844        luafv - ok

23:41:02.0199 3844        LVRS            (b6e1ccd6572984adcae68439afd07011) C:\Windows\system32\DRIVERS\lvrs.sys

23:41:02.0261 3844        LVRS - ok

23:41:02.0604 3844        LVUVC           (6c42815dd57e397f0cd988304b5eb4b3) C:\Windows\system32\DRIVERS\lvuvc.sys

23:41:02.0807 3844        LVUVC - ok

23:41:02.0916 3844        MBAMProtector   (b7ca8cc3f978201856b6ab82f40953c3) C:\Windows\system32\drivers\mbam.sys

23:41:02.0932 3844        MBAMProtector - ok

23:41:03.0057 3844        megasas         (d153b14fc6598eae8422a2037553adce) C:\Windows\system32\drivers\megasas.sys

23:41:03.0088 3844        megasas - ok

23:41:03.0213 3844        Modem           (e13b5ea0f51ba5b1512ec671393d09ba) C:\Windows\system32\drivers\modem.sys

23:41:03.0259 3844        Modem - ok

23:41:03.0353 3844        monitor         (0a9bb33b56e294f686abb7c1e4e2d8a8) C:\Windows\system32\DRIVERS\monitor.sys

23:41:03.0431 3844        monitor - ok

23:41:03.0462 3844        mouclass        (5bf6a1326a335c5298477754a506d263) C:\Windows\system32\DRIVERS\mouclass.sys

23:41:03.0493 3844        mouclass - ok

23:41:03.0509 3844        mouhid          (93b8d4869e12cfbe663915502900876f) C:\Windows\system32\DRIVERS\mouhid.sys

23:41:03.0571 3844        mouhid - ok

23:41:03.0837 3844        MountMgr        (bdafc88aa6b92f7842416ea6a48e1600) C:\Windows\system32\drivers\mountmgr.sys

23:41:03.0883 3844        MountMgr - ok

23:41:03.0946 3844        MpFilter        (fee0baded54222e9f1dae9541212aab1) C:\Windows\system32\DRIVERS\MpFilter.sys

23:41:04.0008 3844        MpFilter - ok

23:41:04.0055 3844        mpio            (583a41f26278d9e0ea548163d6139397) C:\Windows\system32\drivers\mpio.sys

23:41:04.0086 3844        mpio - ok

23:41:04.0211 3844        MpKsle98d41d8   (a69630d039c38018689190234f866d77) c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{7D11FFAB-A961-4D3A-A218-8EF13C3083B8}\MpKsle98d41d8.sys

23:41:04.0242 3844        MpKsle98d41d8 - ok

23:41:04.0336 3844        MpNWMon         (2c3489660d4a8d514c123c3f0d67df46) C:\Windows\system32\DRIVERS\MpNWMon.sys

23:41:04.0351 3844        MpNWMon - ok

23:41:04.0554 3844        mpsdrv          (22241feba9b2defa669c8cb0a8dd7d2e) C:\Windows\system32\drivers\mpsdrv.sys

23:41:04.0601 3844        mpsdrv - ok

23:41:04.0710 3844        Mraid35x        (4fbbb70d30fd20ec51f80061703b001e) C:\Windows\system32\drivers\mraid35x.sys

23:41:04.0741 3844        Mraid35x - ok

23:41:04.0788 3844        MRxDAV          (82cea0395524aacfeb58ba1448e8325c) C:\Windows\system32\drivers\mrxdav.sys

23:41:04.0835 3844        MRxDAV - ok

23:41:05.0069 3844        mrxsmb          (1e94971c4b446ab2290deb71d01cf0c2) C:\Windows\system32\DRIVERS\mrxsmb.sys

23:41:05.0147 3844        mrxsmb - ok

23:41:05.0225 3844        mrxsmb10        (4fccb34d793b116423209c0f8b7a3b03) C:\Windows\system32\DRIVERS\mrxsmb10.sys

23:41:05.0287 3844        mrxsmb10 - ok

23:41:05.0381 3844        mrxsmb20        (c3cb1b40ad4a0124d617a1199b0b9d7c) C:\Windows\system32\DRIVERS\mrxsmb20.sys

23:41:05.0459 3844        mrxsmb20 - ok

23:41:05.0553 3844        msahci          (86068b8b54a5eb092f51657f00b2222a) C:\Windows\system32\drivers\msahci.sys

23:41:05.0584 3844        msahci - ok

23:41:05.0615 3844        msdsm           (3fc82a2ae4cc149165a94699183d3028) C:\Windows\system32\drivers\msdsm.sys

23:41:05.0662 3844        msdsm - ok

23:41:05.0911 3844        Msfs            (a9927f4a46b816c92f461acb90cf8515) C:\Windows\system32\drivers\Msfs.sys

23:41:05.0974 3844        Msfs - ok

23:41:06.0021 3844        msisadrv        (0f400e306f385c56317357d6dea56f62) C:\Windows\system32\drivers\msisadrv.sys

23:41:06.0036 3844        msisadrv - ok

23:41:06.0067 3844        MSKSSRV         (d8c63d34d9c9e56c059e24ec7185cc07) C:\Windows\system32\drivers\MSKSSRV.sys

23:41:06.0130 3844        MSKSSRV - ok

23:41:06.0223 3844        MSPCLOCK        (1d373c90d62ddb641d50e55b9e78d65e) C:\Windows\system32\drivers\MSPCLOCK.sys

23:41:06.0270 3844        MSPCLOCK - ok

23:41:06.0317 3844        MSPQM           (b572da05bf4e098d4bba3a4734fb505b) C:\Windows\system32\drivers\MSPQM.sys

23:41:06.0364 3844        MSPQM - ok

23:41:06.0457 3844        MsRPC           (b49456d70555de905c311bcda6ec6adb) C:\Windows\system32\drivers\MsRPC.sys

23:41:06.0520 3844        MsRPC - ok

23:41:06.0769 3844        mssmbios        (e384487cb84be41d09711c30ca79646c) C:\Windows\system32\DRIVERS\mssmbios.sys

23:41:06.0801 3844        mssmbios - ok

23:41:06.0832 3844        MSTEE           (7199c1eec1e4993caf96b8c0a26bd58a) C:\Windows\system32\drivers\MSTEE.sys

23:41:06.0863 3844        MSTEE - ok

23:41:06.0941 3844        Mup             (6a57b5733d4cb702c8ea4542e836b96c) C:\Windows\system32\Drivers\mup.sys

23:41:06.0972 3844        Mup - ok

23:41:07.0066 3844        NativeWifiP     (85c44fdff9cf7e72a40dcb7ec06a4416) C:\Windows\system32\DRIVERS\nwifi.sys

23:41:07.0159 3844        NativeWifiP - ok

23:41:07.0612 3844        NDIS            (1357274d1883f68300aeadd15d7bbb42) C:\Windows\system32\drivers\ndis.sys

23:41:07.0659 3844        NDIS - ok

23:41:07.0705 3844        NdisTapi        (0e186e90404980569fb449ba7519ae61) C:\Windows\system32\DRIVERS\ndistapi.sys

23:41:07.0752 3844        NdisTapi - ok

23:41:07.0861 3844        Ndisuio         (d6973aa34c4d5d76c0430b181c3cd389) C:\Windows\system32\DRIVERS\ndisuio.sys

23:41:07.0908 3844        Ndisuio - ok

23:41:07.0955 3844        NdisWan         (818f648618ae34f729fdb47ec68345c3) C:\Windows\system32\DRIVERS\ndiswan.sys

23:41:08.0002 3844        NdisWan - ok

23:41:08.0267 3844        NDProxy         (71dab552b41936358f3b541ae5997fb3) C:\Windows\system32\drivers\NDProxy.sys

23:41:08.0361 3844        NDProxy - ok

23:41:08.0485 3844        NetBIOS         (bcd093a5a6777cf626434568dc7dba78) C:\Windows\system32\DRIVERS\netbios.sys

23:41:08.0548 3844        NetBIOS - ok

23:41:08.0595 3844        netbt           (ecd64230a59cbd93c85f1cd1cab9f3f6) C:\Windows\system32\DRIVERS\netbt.sys

23:41:08.0688 3844        netbt - ok

23:41:08.0953 3844        nfrd960         (2e7fb731d4790a1bc6270accefacb36e) C:\Windows\system32\drivers\nfrd960.sys

23:41:08.0985 3844        nfrd960 - ok

23:41:09.0047 3844        NisDrv          (7b01c6172cfd0b10116175e09200d4b4) C:\Windows\system32\DRIVERS\NisDrvWFP.sys

23:41:09.0078 3844        NisDrv - ok

23:41:09.0141 3844        nmwcd           (c82f4cc10ad315b6d6bcb14d0a7cad66) C:\Windows\system32\drivers\ccdcmb.sys

23:41:09.0203 3844        nmwcd - ok

23:41:09.0406 3844        nmwcdc          (60ef5f5621d7832f00a3f190a0c905e2) C:\Windows\system32\drivers\ccdcmbo.sys

23:41:09.0453 3844        nmwcdc - ok

23:41:09.0843 3844        Npfs            (d36f239d7cce1931598e8fb90a0dbc26) C:\Windows\system32\drivers\Npfs.sys

23:41:09.0921 3844        Npfs - ok

23:41:10.0077 3844        nsiproxy        (609773e344a97410ce4ebf74a8914fcf) C:\Windows\system32\drivers\nsiproxy.sys

23:41:10.0139 3844        nsiproxy - ok

23:41:10.0669 3844        Ntfs            (6a4a98cee84cf9e99564510dda4baa47) C:\Windows\system32\drivers\Ntfs.sys

23:41:10.0857 3844        Ntfs - ok

23:41:11.0169 3844        ntrigdigi       (e875c093aec0c978a90f30c9e0dfbb72) C:\Windows\system32\drivers\ntrigdigi.sys

23:41:11.0215 3844        ntrigdigi - ok

23:41:11.0262 3844        Null            (c5dbbcda07d780bda9b685df333bb41e) C:\Windows\system32\drivers\Null.sys

23:41:11.0309 3844        Null - ok

23:41:11.0340 3844        nvraid          (e69e946f80c1c31c53003bfbf50cbb7c) C:\Windows\system32\drivers\nvraid.sys

23:41:11.0371 3844        nvraid - ok

23:41:11.0387 3844        nvstor          (9e0ba19a28c498a6d323d065db76dffc) C:\Windows\system32\drivers\nvstor.sys

23:41:11.0418 3844        nvstor - ok

23:41:11.0449 3844        nv_agp          (07c186427eb8fcc3d8d7927187f260f7) C:\Windows\system32\drivers\nv_agp.sys

23:41:11.0481 3844        nv_agp - ok

23:41:11.0559 3844        NwlnkFlt - ok

23:41:11.0621 3844        NwlnkFwd - ok

23:41:11.0699 3844        ohci1394        (6f310e890d46e246e0e261a63d9b36b4) C:\Windows\system32\DRIVERS\ohci1394.sys

23:41:11.0777 3844        ohci1394 - ok

23:41:12.0198 3844        Parport         (8a79fdf04a73428597e2caf9d0d67850) C:\Windows\system32\DRIVERS\parport.sys

23:41:12.0292 3844        Parport - ok

23:41:12.0463 3844        partmgr         (57389fa59a36d96b3eb09d0cb91e9cdc) C:\Windows\system32\drivers\partmgr.sys

23:41:12.0495 3844        partmgr - ok

23:41:12.0791 3844        Parvdm          (6c580025c81caf3ae9e3617c22cad00e) C:\Windows\system32\DRIVERS\parvdm.sys

23:41:12.0838 3844        Parvdm - ok

23:41:13.0165 3844        pci             (941dc1d19e7e8620f40bbc206981efdb) C:\Windows\system32\drivers\pci.sys

23:41:13.0212 3844        pci - ok

23:41:13.0290 3844        pciide          (1636d43f10416aeb483bc6001097b26c) C:\Windows\system32\drivers\pciide.sys

23:41:13.0306 3844        pciide - ok

23:41:13.0321 3844        pcmcia          (e6f3fb1b86aa519e7698ad05e58b04e5) C:\Windows\system32\drivers\pcmcia.sys

23:41:13.0353 3844        pcmcia - ok

23:41:13.0415 3844        PEAUTH          (6349f6ed9c623b44b52ea3c63c831a92) C:\Windows\system32\drivers\peauth.sys

23:41:13.0555 3844        PEAUTH - ok

23:41:13.0680 3844        PptpMiniport    (ecfffaec0c1ecd8dbc77f39070ea1db1) C:\Windows\system32\DRIVERS\raspptp.sys

23:41:13.0774 3844        PptpMiniport - ok

23:41:13.0836 3844        Processor       (0e3cef5d28b40cf273281d620c50700a) C:\Windows\system32\drivers\processr.sys

23:41:13.0914 3844        Processor - ok

23:41:14.0023 3844        PSched          (99514faa8df93d34b5589187db3aa0ba) C:\Windows\system32\DRIVERS\pacer.sys

23:41:14.0101 3844        PSched - ok

23:41:14.0195 3844        ql2300          (ccdac889326317792480c0a67156a1ec) C:\Windows\system32\drivers\ql2300.sys

23:41:14.0242 3844        ql2300 - ok

23:41:14.0273 3844        ql40xx          (81a7e5c076e59995d54bc1ed3a16e60b) C:\Windows\system32\drivers\ql40xx.sys

23:41:14.0304 3844        ql40xx - ok

23:41:14.0335 3844        QWAVEdrv        (9f5e0e1926014d17486901c88eca2db7) C:\Windows\system32\drivers\qwavedrv.sys

23:41:14.0382 3844        QWAVEdrv - ok

23:41:16.0067 3844        R300            (fef6346529b840ae859de65a0f4773d2) C:\Windows\system32\DRIVERS\atikmdag.sys

23:41:16.0285 3844        R300 - ok

23:41:16.0691 3844        RasAcd          (147d7f9c556d259924351feb0de606c3) C:\Windows\system32\DRIVERS\rasacd.sys

23:41:16.0753 3844        RasAcd - ok

23:41:16.0878 3844        Rasl2tp         (a214adbaf4cb47dd2728859ef31f26b0) C:\Windows\system32\DRIVERS\rasl2tp.sys

23:41:16.0987 3844        Rasl2tp - ok

23:41:17.0253 3844        RasPppoe        (509a98dd18af4375e1fc40bc175f1def) C:\Windows\system32\DRIVERS\raspppoe.sys

23:41:17.0331 3844        RasPppoe - ok

23:41:17.0471 3844        RasSstp         (2005f4a1e05fa09389ac85840f0a9e4d) C:\Windows\system32\DRIVERS\rassstp.sys

23:41:17.0565 3844        RasSstp - ok

23:41:17.0752 3844        rdbss           (b14c9d5b9add2f84f70570bbbfaa7935) C:\Windows\system32\DRIVERS\rdbss.sys

23:41:17.0845 3844        rdbss - ok

23:41:17.0939 3844        RDPCDD          (89e59be9a564262a3fb6c4f4f1cd9899) C:\Windows\system32\DRIVERS\RDPCDD.sys

23:41:17.0970 3844        RDPCDD - ok

23:41:18.0017 3844        rdpdr           (e8bd98d46f2ed77132ba927fccb47d8b) C:\Windows\system32\drivers\rdpdr.sys

23:41:18.0079 3844        rdpdr - ok

23:41:18.0142 3844        RDPENCDD        (9d91fe5286f748862ecffa05f8a0710c) C:\Windows\system32\drivers\rdpencdd.sys

23:41:18.0173 3844        RDPENCDD - ok

23:41:18.0204 3844        RDPWD           (30bfbdfb7f95559ede971f9ddb9a00ba) C:\Windows\system32\drivers\RDPWD.sys

23:41:18.0313 3844        RDPWD - ok

23:41:18.0423 3844        rspndr          (9c508f4074a39e8b4b31d27198146fad) C:\Windows\system32\DRIVERS\rspndr.sys

23:41:18.0501 3844        rspndr - ok

23:41:18.0594 3844        RTL8169         (2d19a7469ea19993d0c12e627f4530bc) C:\Windows\system32\DRIVERS\Rtlh86.sys

23:41:18.0610 3844        RTL8169 - ok

23:41:18.0781 3844        sbp2port        (3ce8f073a557e172b330109436984e30) C:\Windows\system32\drivers\sbp2port.sys

23:41:18.0828 3844        sbp2port - ok

23:41:18.0937 3844        secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys

23:41:19.0000 3844        secdrv - ok

23:41:19.0203 3844        Serenum         (ce9ec966638ef0b10b864ddedf62a099) C:\Windows\system32\DRIVERS\serenum.sys

23:41:19.0249 3844        Serenum - ok

23:41:19.0405 3844        Serial          (6d663022db3e7058907784ae14b69898) C:\Windows\system32\DRIVERS\serial.sys

23:41:19.0546 3844        Serial - ok

23:41:19.0889 3844        sermouse        (8af3d28a879bf75db53a0ee7a4289624) C:\Windows\system32\drivers\sermouse.sys

23:41:19.0920 3844        sermouse - ok

23:41:19.0983 3844        sffdisk         (103b79418da647736ee95645f305f68a) C:\Windows\system32\drivers\sffdisk.sys

23:41:20.0045 3844        sffdisk - ok

23:41:20.0092 3844        sffp_mmc        (8fd08a310645fe872eeec6e08c6bf3ee) C:\Windows\system32\drivers\sffp_mmc.sys

23:41:20.0139 3844        sffp_mmc - ok

23:41:20.0185 3844        sffp_sd         (9cfa05fcfcb7124e69cfc812b72f9614) C:\Windows\system32\drivers\sffp_sd.sys

23:41:20.0217 3844        sffp_sd - ok

23:41:20.0263 3844        sfloppy         (46ed8e91793b2e6f848015445a0ac188) C:\Windows\system32\drivers\sfloppy.sys

23:41:20.0326 3844        sfloppy - ok

23:41:20.0373 3844        SiSRaid2        (cedd6f4e7d84e9f98b34b3fe988373aa) C:\Windows\system32\drivers\sisraid2.sys

23:41:20.0388 3844        SiSRaid2 - ok

23:41:20.0404 3844        SiSRaid4        (df843c528c4f69d12ce41ce462e973a7) C:\Windows\system32\drivers\sisraid4.sys

23:41:20.0435 3844        SiSRaid4 - ok

23:41:20.0513 3844        Smb             (7b75299a4d201d6a6533603d6914ab04) C:\Windows\system32\DRIVERS\smb.sys

23:41:20.0607 3844        Smb - ok

23:41:20.0841 3844        spldr           (7aebdeef071fe28b0eef2cdd69102bff) C:\Windows\system32\drivers\spldr.sys

23:41:20.0872 3844        spldr - ok

23:41:20.0965 3844        srv             (41987f9fc0e61adf54f581e15029ad91) C:\Windows\system32\DRIVERS\srv.sys

23:41:21.0043 3844        srv - ok

23:41:21.0106 3844        srv2            (ff33aff99564b1aa534f58868cbe41ef) C:\Windows\system32\DRIVERS\srv2.sys

23:41:21.0153 3844        srv2 - ok

23:41:21.0418 3844        srvnet          (7605c0e1d01a08f3ecd743f38b834a44) C:\Windows\system32\DRIVERS\srvnet.sys

23:41:21.0511 3844        srvnet - ok

23:41:21.0917 3844        swenum          (7ba58ecf0c0a9a69d44b3dca62becf56) C:\Windows\system32\DRIVERS\swenum.sys

23:41:21.0948 3844        swenum - ok

23:41:21.0995 3844        Symc8xx         (192aa3ac01df071b541094f251deed10) C:\Windows\system32\drivers\symc8xx.sys

23:41:22.0011 3844        Symc8xx - ok

23:41:22.0026 3844        Sym_hi          (8c8eb8c76736ebaf3b13b633b2e64125) C:\Windows\system32\drivers\sym_hi.sys

23:41:22.0057 3844        Sym_hi - ok

23:41:22.0057 3844        Sym_u3          (8072af52b5fd103bbba387a1e49f62cb) C:\Windows\system32\drivers\sym_u3.sys

23:41:22.0089 3844        Sym_u3 - ok

23:41:22.0666 3844        Tcpip           (16731b631f28f63cd9f4cb60940e7ddd) C:\Windows\system32\drivers\tcpip.sys

23:41:22.0759 3844        Tcpip - ok

23:41:23.0025 3844        Tcpip6          (16731b631f28f63cd9f4cb60940e7ddd) C:\Windows\system32\DRIVERS\tcpip.sys

23:41:23.0087 3844        Tcpip6 - ok

23:41:23.0368 3844        tcpipreg        (3fc13f09af9be487c7b4fac4070a036c) C:\Windows\system32\drivers\tcpipreg.sys

23:41:23.0446 3844        tcpipreg - ok

23:41:23.0727 3844        TDPIPE          (5dcf5e267be67a1ae926f2df77fbcc56) C:\Windows\system32\drivers\tdpipe.sys

23:41:23.0789 3844        TDPIPE - ok

23:41:23.0883 3844        TDTCP           (389c63e32b3cefed425b61ed92d3f021) C:\Windows\system32\drivers\tdtcp.sys

23:41:23.0961 3844        TDTCP - ok

23:41:24.0195 3844        tdx             (76b06eb8a01fc8624d699e7045303e54) C:\Windows\system32\DRIVERS\tdx.sys

23:41:24.0335 3844        tdx - ok

23:41:24.0787 3844        TermDD          (3cad38910468eab9a6479e2f01db43c7) C:\Windows\system32\DRIVERS\termdd.sys

23:41:24.0834 3844        TermDD - ok

23:41:25.0115 3844        tssecsrv        (dcf0f056a2e4f52287264f5ab29cf206) C:\Windows\system32\DRIVERS\tssecsrv.sys

23:41:25.0177 3844        tssecsrv - ok

23:41:25.0302 3844        tunmp           (caecc0120ac49e3d2f758b9169872d38) C:\Windows\system32\DRIVERS\tunmp.sys

23:41:25.0349 3844        tunmp - ok

23:41:25.0583 3844        tunnel          (119b8184e106baedc83fce5ddf3950da) C:\Windows\system32\DRIVERS\tunnel.sys

23:41:25.0645 3844        tunnel - ok

23:41:25.0755 3844        uagp35          (c3ade15414120033a36c0f293d4a4121) C:\Windows\system32\DRIVERS\uagp35.sys

23:41:25.0801 3844        uagp35 - ok

23:41:25.0864 3844        udfs            (d9728af68c4c7693cb100b8441cbdec6) C:\Windows\system32\DRIVERS\udfs.sys

23:41:25.0942 3844        udfs - ok

23:41:26.0035 3844        uliagpkx        (75e6890ebfce0841d3291b02e7a8bdb0) C:\Windows\system32\drivers\uliagpkx.sys

23:41:26.0082 3844        uliagpkx - ok

23:41:26.0098 3844        uliahci         (3cd4ea35a6221b85dcc25daa46313f8d) C:\Windows\system32\drivers\uliahci.sys

23:41:26.0145 3844        uliahci - ok

23:41:26.0425 3844        UlSata          (8514d0e5cd0534467c5fc61be94a569f) C:\Windows\system32\drivers\ulsata.sys

23:41:26.0457 3844        UlSata - ok

23:41:26.0503 3844        ulsata2         (38c3c6e62b157a6bc46594fada45c62b) C:\Windows\system32\drivers\ulsata2.sys

23:41:26.0535 3844        ulsata2 - ok

23:41:26.0566 3844        umbus           (32cff9f809ae9aed85464492bf3e32d2) C:\Windows\system32\DRIVERS\umbus.sys

23:41:26.0613 3844        umbus - ok

23:41:26.0675 3844        upperdev        (bb16932a4189e82d6c455042c11849b6) C:\Windows\system32\DRIVERS\usbser_lowerflt.sys

23:41:26.0722 3844        upperdev - ok

23:41:26.0753 3844        usbaudio        (32db9517628ff0d070682aab61e688f0) C:\Windows\system32\drivers\usbaudio.sys

23:41:26.0831 3844        usbaudio - ok

23:41:27.0174 3844        usbccgp         (caf811ae4c147ffcd5b51750c7f09142) C:\Windows\system32\DRIVERS\usbccgp.sys

23:41:27.0283 3844        usbccgp - ok

23:41:27.0580 3844        usbcir          (e9476e6c486e76bc4898074768fb7131) C:\Windows\system32\drivers\usbcir.sys

23:41:27.0705 3844        usbcir - ok

23:41:27.0876 3844        usbehci         (79e96c23a97ce7b8f14d310da2db0c9b) C:\Windows\system32\DRIVERS\usbehci.sys

23:41:27.0939 3844        usbehci - ok

23:41:27.0970 3844        usbhub          (4673bbcb006af60e7abddbe7a130ba42) C:\Windows\system32\DRIVERS\usbhub.sys

23:41:28.0032 3844        usbhub - ok

23:41:28.0313 3844        usbohci         (ce697fee0d479290d89bec80dfe793b7) C:\Windows\system32\DRIVERS\usbohci.sys

23:41:28.0360 3844        usbohci - ok

23:41:28.0391 3844        usbprint        (b51e52acf758be00ef3a58ea452fe360) C:\Windows\system32\drivers\usbprint.sys

23:41:28.0453 3844        usbprint - ok

23:41:28.0516 3844        usbser          (d575246188f63de0accf6eac5fb59e6a) C:\Windows\system32\DRIVERS\usbser.sys

23:41:28.0563 3844        usbser - ok

23:41:28.0594 3844        UsbserFilt      (e748d50b3b2ec7f40a2ba67fb094cf01) C:\Windows\system32\DRIVERS\usbser_lowerfltj.sys

23:41:28.0625 3844        UsbserFilt - ok

23:41:28.0656 3844        USBSTOR         (be3da31c191bc222d9ad503c5224f2ad) C:\Windows\system32\DRIVERS\USBSTOR.SYS

23:41:28.0719 3844        USBSTOR - ok

23:41:29.0093 3844        usbuhci         (325dbbacb8a36af9988ccf40eac228cc) C:\Windows\system32\DRIVERS\usbuhci.sys

23:41:29.0155 3844        usbuhci - ok

23:41:29.0296 3844        usbvideo        (e67998e8f14cb0627a769f6530bcb352) C:\Windows\system32\Drivers\usbvideo.sys

23:41:29.0327 3844        usbvideo - ok

23:41:29.0577 3844        vga             (7d92be0028ecdedec74617009084b5ef) C:\Windows\system32\DRIVERS\vgapnp.sys

23:41:29.0655 3844        vga - ok

23:41:29.0748 3844        VgaSave         (2e93ac0a1d8c79d019db6c51f036636c) C:\Windows\System32\drivers\vga.sys

23:41:29.0826 3844        VgaSave - ok

23:41:29.0889 3844        viaagp          (045d9961e591cf0674a920b6ba3ba5cb) C:\Windows\system32\drivers\viaagp.sys

23:41:29.0935 3844        viaagp - ok

23:41:30.0123 3844        ViaC7           (56a4de5f02f2e88182b0981119b4dd98) C:\Windows\system32\drivers\viac7.sys

23:41:30.0201 3844        ViaC7 - ok

23:41:30.0466 3844        viaide          (7aa7ec9a08dc2c39649c413b1a26e298) C:\Windows\system32\drivers\viaide.sys

23:41:30.0497 3844        viaide - ok

23:41:30.0528 3844        volmgr          (69503668ac66c77c6cd7af86fbdf8c43) C:\Windows\system32\drivers\volmgr.sys

23:41:30.0559 3844        volmgr - ok

23:41:30.0653 3844        volmgrx         (23e41b834759917bfd6b9a0d625d0c28) C:\Windows\system32\drivers\volmgrx.sys

23:41:30.0715 3844        volmgrx - ok

23:41:31.0012 3844        volsnap         (147281c01fcb1df9252de2a10d5e7093) C:\Windows\system32\drivers\volsnap.sys

23:41:31.0059 3844        volsnap - ok

23:41:31.0183 3844        vsmraid         (d984439746d42b30fc65a4c3546c6829) C:\Windows\system32\drivers\vsmraid.sys

23:41:31.0230 3844        vsmraid - ok

23:41:31.0417 3844        WacomPen        (48dfee8f1af7c8235d4e626f0c4fe031) C:\Windows\system32\drivers\wacompen.sys

23:41:31.0480 3844        WacomPen - ok

23:41:31.0667 3844        Wanarp          (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys

23:41:31.0745 3844        Wanarp - ok

23:41:31.0776 3844        Wanarpv6        (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys

23:41:31.0823 3844        Wanarpv6 - ok

23:41:32.0119 3844        Wd              (afc5ad65b991c1e205cf25cfdbf7a6f4) C:\Windows\system32\drivers\wd.sys

23:41:32.0151 3844        Wd - ok

23:41:32.0213 3844        Wdf01000        (b6f0a7ad6d4bd325fbcd8bac96cd8d96) C:\Windows\system32\drivers\Wdf01000.sys

23:41:32.0244 3844        Wdf01000 - ok

23:41:32.0416 3844        WmiAcpi         (701a9f884a294327e9141d73746ee279) C:\Windows\system32\drivers\wmiacpi.sys

23:41:32.0478 3844        WmiAcpi - ok

23:41:32.0541 3844        WpdUsb          (de9d36f91a4df3d911626643debf11ea) C:\Windows\system32\DRIVERS\wpdusb.sys

23:41:32.0619 3844        WpdUsb - ok

23:41:32.0837 3844        ws2ifsl         (e3a3cb253c0ec2494d4a61f5e43a389c) C:\Windows\system32\drivers\ws2ifsl.sys

23:41:32.0884 3844        ws2ifsl - ok

23:41:32.0946 3844        WUDFRd          (ac13cb789d93412106b0fb6c7eb2bcb6) C:\Windows\system32\DRIVERS\WUDFRd.sys

23:41:33.0055 3844        WUDFRd - ok

23:41:33.0087 3844        MBR (0x1B8)     (5c616939100b85e558da92b899a0fc36) \Device\Harddisk0\DR0

23:41:33.0477 3844        \Device\Harddisk0\DR0 - ok

23:41:33.0477 3844        MBR (0x1B8)     (5fb38429d5d77768867c76dcbdb35194) \Device\Harddisk1\DR1

23:41:33.0633 3844        \Device\Harddisk1\DR1 - ok

23:41:33.0664 3844        Boot (0x1200)   (3a4550dff08573ed6059fa8e4cbcbb42) \Device\Harddisk0\DR0\Partition0

23:41:33.0664 3844        \Device\Harddisk0\DR0\Partition0 - ok

23:41:33.0679 3844        Boot (0x1200)   (81ffe6bde6ef7541e96011620057ba48) \Device\Harddisk0\DR0\Partition1

23:41:33.0679 3844        \Device\Harddisk0\DR0\Partition1 - ok

23:41:33.0695 3844        Boot (0x1200)   (978558cc10777eb89e5b62c3a87b4164) \Device\Harddisk1\DR1\Partition0

23:41:33.0695 3844        \Device\Harddisk1\DR1\Partition0 - ok

23:41:33.0695 3844        ============================================================

23:41:33.0695 3844        Scan finished

23:41:33.0695 3844        ============================================================

23:41:33.0695 5124        Detected object count: 1

23:41:33.0695 5124        Actual detected object count: 1

23:41:46.0830 5124        FreshIO ( UnsignedFile.Multi.Generic ) - skipped by user

23:41:46.0830 5124        FreshIO ( UnsignedFile.Multi.Generic ) - User select action: Skip

Werde jetzt erstmal abwarten, bevor ich unhide ausführe oder sonstwas
mache. :)

Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM!

Downloade dir bitte

aswMBR.exe und speichere die Datei auf deinem Desktop.

Starte die aswMBR.exe - (aswMBR.exe Anleitung)
Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten".
Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
Klicke auf Scan.
Warte bitte bis Scan finished successfully im DOS-Fenster steht.
Drücke auf Save Log und speichere diese auf dem Desktop.

Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).

GMER funktioniert wie in der Erklärung erwähnt bei mir auch nicht.
Daher hier die anderen Logs.

OSAM-Log:

Code:

Report of OSAM: Autorun Manager v5.0.11926.0

hxxp://www.online-solutions.ru/en/

Saved at 14:17:29 on 24.02.2012
 

OS: Windows Vista Home Premium Edition Service Pack 2 (Build 6002), 32-bit

Default Browser: Mozilla Corporation Firefox 10.0.2
 

Scanner Settings

[x] Rootkits detection (hidden registry)

[x] Rootkits detection (hidden files)

[x] Retrieve files information

[x] Check Microsoft signatures
 

Filters

[ ] Trusted entries

[ ] Empty entries

[x] Hidden registry entries (rootkit activity)

[x] Exclusively opened files

[x] Not found files

[x] Files without detailed information

[x] Existing files

[ ] Non-startable services

[ ] Non-startable drivers

[x] Active entries

[x] Disabled entries
 
 

[Common]

-----( %SystemRoot%\Tasks )-----

"GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe

"GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
 

[Control Panel Objects]

-----( %SystemRoot%\system32 )-----

"DivXControlPanelApplet.cpl" - "DivX, Inc." - C:\Windows\system32\DivXControlPanelApplet.cpl

"FlashPlayerCPLApp.cpl" - "Adobe Systems Incorporated" - C:\Windows\system32\FlashPlayerCPLApp.cpl

"PhysX.cpl" - "NVIDIA Corporation" - C:\Windows\system32\PhysX.cpl

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----

"Nero BurnRights" - "Nero AG" - C:\Program Files\Nero\Nero 9\Nero BurnRights\NeroBurnRights_cpl.cpl

"Pando" - "Pando Networks" - C:\Program Files\Pando Networks\Media Booster\PMB.cpl

"QuickTime" - "Apple Inc." - C:\Program Files\QuickTime\QTSystem\QuickTime.cpl
 

[Drivers]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"A2 Direct Disk Access Support Driver" (A2DDA) - "Emsi Software GmbH" - C:\Program Files\Emsisoft Anti-Malware\a2ddax86.sys

"a2acc" (a2acc) - "Emsi Software GmbH" - C:\PROGRAM FILES\EMSISOFT ANTI-MALWARE\a2accx86.sys

"catchme" (catchme) - ? - C:\ComboFix\catchme.sys  (File not found)

"FreshIO" (FreshIO) - ? - C:\Program Files\FreshDevices\FreshDiagnose\FreshIO.sys  (File found, but it contains no detailed information)

"FssFltr" (fssfltr) - "Microsoft Corporation" - C:\Windows\System32\DRIVERS\fssfltr.sys

"IP in IP Tunnel Driver" (IpInIp) - ? - C:\Windows\System32\DRIVERS\ipinip.sys  (File not found)

"IPX Traffic Filter Driver" (NwlnkFlt) - ? - C:\Windows\System32\DRIVERS\nwlnkflt.sys  (File not found)

"IPX Traffic Forwarder Driver" (NwlnkFwd) - ? - C:\Windows\System32\DRIVERS\nwlnkfwd.sys  (File not found)

"MBAMProtector" (MBAMProtector) - "Malwarebytes Corporation" - C:\Windows\system32\drivers\mbam.sys

"MpKsl98e08d68" (MpKsl98e08d68) - "Microsoft Corporation" - c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{7D11FFAB-A961-4D3A-A218-8EF13C3083B8}\MpKsl98e08d68.sys

"ugroiuog" (ugroiuog) - ? - C:\Users\SHADOW~1\AppData\Local\Temp\ugroiuog.sys  (Hidden registry entry, rootkit activity | File not found)
 

[Explorer]

-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----

{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll

{0561EC90-CE54-4f0c-9C55-E226110A740C} "{0561EC90-CE54-4f0c-9C55-E226110A740C}" - ? -   (File not found | COM-object registry key not found)

-----( HKLM\Software\Classes\Protocols\Handler )-----

{E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} "Album Download IE Asynchronous Pluggable Protocol Interface" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll

{828030A1-22C1-4009-854F-8E305202313F} "livecall" - "Microsoft Corporation" - C:\Program Files\Windows Live\Messenger\msgrapp.dll

{828030A1-22C1-4009-854F-8E305202313F} "msnim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Messenger\msgrapp.dll

{03C514A3-1EFB-4856-9F99-10D7BE1653C0} "Windows Live Mail HTML Asynchronous Pluggable Protocol Handler" - "Microsoft Corporation" - C:\Program Files\Windows Live\Mail\mailcomm.dll

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----

{911051fa-c21c-4246-b470-070cd8df6dc4} ".cab or .zip files" - ? -   (File not found | COM-object registry key not found)

{AB77609F-2178-4E6F-9C4B-44AC179D937A} "a-squared Anti-Malware Shell Extension" - "Emsi Software GmbH" - C:\Program Files\Emsisoft Anti-Malware\a2contmenu.dll

{1b24a030-9b20-49bc-97ac-1be4426f9e59} "ActiveDirectory Folder" - ? -   (File not found | COM-object registry key not found)

{34449847-FD14-4fc8-A75A-7432F5181EFB} "ActiveDirectory Folder" - ? -   (File not found | COM-object registry key not found)

{0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48} "Contacts folder" - ? -   (File not found | COM-object registry key not found)

{09A47860-11B0-4DA5-AFA5-26D86198A780} "EPP" - "Microsoft Corporation" - c:\PROGRA~1\MI239C~1\shellext.dll

{2C2577C2-63A7-40e3-9B7F-586602617ECB} "Explorer Query Band" - ? -   (File not found | COM-object registry key not found)

{00020d75-0000-0000-c000-000000000046} "lnkfile" - ? -   (File not found | COM-object registry key not found)

{97F68CE3-7146-45FF-BE24-D9A7DD7CB8A2} "NeroCoverEdLiveIcons Class" - "Nero AG" - C:\Program Files\Nero\Nero 9\Nero CoverDesigner\CoverEdExtension.dll

{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4} "RealOne Player Context Menu Class" - "RealNetworks, Inc." - C:\Program Files\Real\RealPlayer\rpshell.dll

{C8494E42-ACDD-4739-B0FB-217361E4894F} "Sam Account Folder" - ? -   (File not found | COM-object registry key not found)

{E29F9716-5C08-4FCD-955A-119FDB5A522D} "Sam Account Folder" - ? -   (File not found | COM-object registry key not found)

{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - ? -   (File not found | COM-object registry key not found)

{2BE99FD4-A181-4996-BFA9-58C5FFD11F6C} "Windows Live Photo Gallery Autoplay Drop Target" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoGallery.exe

{00F30F64-AC33-42F5-8FD1-5DC2D3FDE06C} "Windows Live Photo Gallery Editor Drop Target" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoGallery.exe

{00F3712A-CA79-45B4-9E4D-D7891E7F8B9D} "Windows Live Photo Gallery Editor Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll

{00F30F90-3E96-453B-AFCD-D71989ECC2C7} "Windows Live Photo Gallery Viewer Autoplay Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll

{00F33137-EE26-412F-8D71-F84E4C2C6625} "Windows Live Photo Gallery Viewer Autoplay Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll

{00F374B7-B390-4884-B372-2FC349F2172B} "Windows Live Photo Gallery Viewer Drop Target" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoGallery.exe

{00F346CB-35A4-465B-8B8F-65A29DBAB1F6} "Windows Live Photo Gallery Viewer Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll

{da67b8ad-e81b-4c70-9b91b417b5e33527} "Windows Search Shell Service" - ? -   (File not found | COM-object registry key not found)

{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - ? - C:\Program Files\WinRAR\rarext.dll  (File found, but it contains no detailed information)

{06A2568A-CED6-4187-BB20-400B8C02BE5A} "{06A2568A-CED6-4187-BB20-400B8C02BE5A}" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoAcquireWizard.exe
 

[Internet Explorer]

-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----

ITBar7Height "ITBar7Height" - ? -   (File not found | COM-object registry key not found)

<binary data> "ITBar7Layout" - ? -   (File not found | COM-object registry key not found)

-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----

{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_25" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab

{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} "Java Plug-in 1.6.0_25" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----

{B63DBA5F-523F-4B9C-A43D-65DF1977EAD3} "@C:\Program Files\Windows Live\Companion\companionlang.dll,-600" - "Microsoft Corporation" - C:\Program Files\Windows Live\Companion\companioncore.dll

{5F7B1267-94A9-47F5-98DB-E99415F33AEC} "@C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004" - "Microsoft Corporation" - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----

{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2ssv.dll

{3049C3E9-B461-4BC5-8870-4C09146192CA} "RealPlayer Download and Record Plugin for Internet Explorer" - "RealPlayer" - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll

{9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live ID Sign-in Helper" - "Microsoft Corp." - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

{9FDDE16B-836F-4806-AB1F-1455CBEFF289} "Windows Live Messenger Companion Helper" - "Microsoft Corporation" - C:\Program Files\Windows Live\Companion\companioncore.dll
 

[Logon]

-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----

"desktop.ini" - ? - C:\Users\Shadow315\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini

-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----

"DAEMON Tools Lite" - ? - "J:\DAEMON Tools Lite\DTLite.exe" -autorun  (File not found)

"msnmsgr" - "Microsoft Corporation" - "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background

-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----

"StartupPrograms" - ? - rdpclip  (File not found)

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----

"Malwarebytes' Anti-Malware" - "Malwarebytes Corporation" - "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray

"MSC" - "Microsoft Corporation" - "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
 

[Services]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"@c:\Program Files\Microsoft Security Client\Antimalware\MpAsDesc.dll,-243" (NisSrv) - "Microsoft Corporation" - c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe

"@C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe,-100" (WPFFontCache_v0400) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe

"AMD FUEL Service" (AMD FUEL Service) - "Advanced Micro Devices, Inc." - C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe

"Bing Bar Update Service" (BBSvc) - "Microsoft Corporation." - C:\Program Files\Microsoft\BingBar\BBSvc.EXE

"Emsisoft Anti-Malware 6.0 - Service" (a2AntiMalware) - "Emsi Software GmbH" - C:\Program Files\Emsisoft Anti-Malware\a2service.exe

"Google Update Service (gupdate)" (gupdate) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe

"Google Update-Dienst (gupdatem)" (gupdatem) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe

"MBAMService" (MBAMService) - "Malwarebytes Corporation" - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

"Microsoft Antimalware Service" (MsMpSvc) - "Microsoft Corporation" - c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe

"SeaPort" (SeaPort) - "Microsoft Corporation" - C:\Program Files\Microsoft\BingBar\SeaPort.EXE

"Steam Client Service" (Steam Client Service) - "Valve Corporation" - C:\Program Files\Common Files\Steam\SteamService.exe

"Windows Live Family Safety Service" (fsssvc) - "Microsoft Corporation" - C:\Program Files\Windows Live\Family Safety\fsssvc.exe

"Windows Live ID Sign-in Assistant" (wlidsvc) - "Microsoft Corp." - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
 

===[ Logfile end ]=========================================[ Logfile end ]===
 

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru

Und der aswMBR-Log:

Code:

aswMBR version 0.9.9.1649 Copyright(c) 2011 AVAST Software

Run date: 2012-02-24 14:18:45

-----------------------------

14:18:45.256    OS Version: Windows 6.0.6002 Service Pack 2

14:18:45.256    Number of processors: 2 586 0x4303

14:18:45.257    ComputerName: SHADOW315-PC  UserName: Shadow315

14:18:46.672    Initialize success

14:19:26.374    AVAST engine defs: 12022400

14:19:37.872    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T1L0-6

14:19:37.874    Disk 0 Vendor: ST3360320AS 3.AAM Size: 343399MB BusType: 3

14:19:37.886    Disk 0 MBR read successfully

14:19:37.888    Disk 0 MBR scan

14:19:37.956    Disk 0 Windows VISTA default MBR code

14:19:37.969    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS       322902 MB offset 2048

14:19:37.982    Disk 0 Partition - 00     0F Extended LBA             20494 MB offset 661305344

14:19:38.004    Disk 0 Partition 2 00     0B        FAT32 MSDOS5.0    20494 MB offset 661305407

14:19:38.124    Disk 0 scanning sectors +703277505

14:19:38.204    Disk 0 scanning C:\Windows\system32\drivers

14:19:52.532    Service scanning

14:20:07.161    Service MpKsl98e08d68 c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{7D11FFAB-A961-4D3A-A218-8EF13C3083B8}\MpKsl98e08d68.sys **LOCKED** 32

14:20:07.259    Service MpNWMon C:\Windows\system32\DRIVERS\MpNWMon.sys **LOCKED** 32

14:20:23.170    Modules scanning

14:20:29.842    Disk 0 trace - called modules:

14:20:29.866    ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll ataport.SYS pciide.sys 

14:20:29.871    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x84e37330]

14:20:29.875    3 CLASSPNP.SYS[87fae8b3] -> nt!IofCallDriver -> [0x84c09c10]

14:20:29.880    5 acpi.sys[806096bc] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T1L0-6[0x84c2d5a8]

14:20:31.368    AVAST engine scan C:\Windows

14:20:37.425    AVAST engine scan C:\Windows\system32

14:24:50.877    AVAST engine scan C:\Windows\system32\drivers

14:25:10.783    AVAST engine scan C:\Users\Shadow315

14:37:33.637    AVAST engine scan C:\ProgramData

14:45:15.357    Scan finished successfully

16:31:40.411    Disk 0 MBR has been saved successfully to "C:\Users\Shadow315\Desktop\MBR.dat"

16:31:40.493    The log file has been saved successfully to "C:\Users\Shadow315\Desktop\aswMBR.txt"

Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

Hier erstmal der Log von SAS:

Code:

SUPERAntiSpyware Scan Log

hxxp://www.superantispyware.com
 

Generated 02/24/2012 at 11:29 PM
 

Application Version : 5.0.1144
 

Core Rules Database Version : 8275

Trace Rules Database Version: 6087
 

Scan type       : Complete Scan

Total Scan Time : 02:30:33
 

Operating System Information

Windows Vista Home Premium 32-bit, Service Pack 2 (Build 6.00.6002)

UAC On - Administrator
 

Memory items scanned      : 651

Memory threats detected   : 0

Registry items scanned    : 33316

Registry threats detected : 1

File items scanned        : 181423

File threats detected     : 313
 

Adware.Tracking Cookie

        C:\Users\Shadow315\AppData\Roaming\Microsoft\Windows\Cookies\21WSVO6L.txt [ /serving-sys.com ]

        C:\Users\Shadow315\AppData\Roaming\Microsoft\Windows\Cookies\WNIML749.txt [ /atdmt.com ]

        C:\Users\Shadow315\AppData\Roaming\Microsoft\Windows\Cookies\IZ2HJJE0.txt [ /bs.serving-sys.com ]

        C:\Users\Shadow315\AppData\Roaming\Microsoft\Windows\Cookies\044OMGIS.txt [ /media6degrees.com ]

        C:\Users\Shadow315\AppData\Roaming\Microsoft\Windows\Cookies\1CFB9PMS.txt [ /apmebf.com ]

        C:\Users\Shadow315\AppData\Roaming\Microsoft\Windows\Cookies\57HRI45Q.txt [ /doubleclick.net ]

        C:\Users\Shadow315\AppData\Roaming\Microsoft\Windows\Cookies\UY2463F3.txt [ /invitemedia.com ]

        C:\Users\Shadow315\AppData\Roaming\Microsoft\Windows\Cookies\TGV7UI71.txt [ /mediaplex.com ]

        C:\USERS\SHADOW315\AppData\Roaming\Microsoft\Windows\Cookies\Low\BD7QQNX8.txt [ Cookie:shadow315@doubleclick.net/ ]

        C:\USERS\SHADOW315\Cookies\21WSVO6L.txt [ Cookie:shadow315@serving-sys.com/ ]

        C:\USERS\SHADOW315\Cookies\WNIML749.txt [ Cookie:shadow315@atdmt.com/ ]

        C:\USERS\SHADOW315\Cookies\1CFB9PMS.txt [ Cookie:shadow315@apmebf.com/ ]

        C:\USERS\SHADOW315\Cookies\57HRI45Q.txt [ Cookie:shadow315@doubleclick.net/ ]

        C:\USERS\SHADOW315\Cookies\UY2463F3.txt [ Cookie:shadow315@invitemedia.com/ ]

        C:\USERS\SHADOW315\Cookies\TGV7UI71.txt [ Cookie:shadow315@mediaplex.com/ ]

        delivery.ibanner.de [ C:\USERS\SHADOW315\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\MBY8BZH3 ]

        .smartadserver.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .smartadserver.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .serving-sys.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .serving-sys.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .doubleclick.net [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .invitemedia.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .adxvalue.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        ad.yieldmanager.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .adtech.de [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .revsci.net [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .microsoftsto.112.2o7.net [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .atdmt.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .imrworldwide.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .imrworldwide.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .adtech.de [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .eaeacom.112.2o7.net [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .atdmt.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .atdmt.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .invitemedia.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .serving-sys.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .apmebf.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .mediaplex.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        adt.traffictrack.de [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        accounts.youtube.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        accounts.google.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        accounts.google.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        www.zanox-affiliate.de [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .xiti.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .adserver.adtechus.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .server.cpmstar.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .bs.serving-sys.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .server.cpmstar.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .server.cpmstar.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .server.cpmstar.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        www.youporn.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        www.youporn.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        rts.pgmediaserve.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        rts.pgmediaserve.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        rts.pgmediaserve.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .partypoker.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .partypoker.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .partypoker.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .partypoker.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .partypoker.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .de.partypoker.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .partypoker.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .partypoker.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .counter.sexsuche.tv [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        counter2.sexmoney.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .ad.adnet.de [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        www.unitymedia.de [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        www.unitymedia.de [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        tracking.dc-storm.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .unitymedia.de [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        www.unitymedia.de [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .www.unitymedia.de [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        tracking.dc-storm.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .c.atdmt.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .c.atdmt.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .tracking.quisma.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .invitemedia.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .invitemedia.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .account.swtor.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        studivz.adfarm1.adition.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        studivz.adfarm1.adition.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .amazon-adsystem.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .amazon-adsystem.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .im.banner.t-online.de [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        de.sitestat.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .revsci.net [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .im.banner.t-online.de [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        mediachannelx.npage.de [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        mediachannelx.npage.de [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        mediachannelx.npage.de [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .tracking.quisma.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        tracking.quisma.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .tracking.quisma.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        count.asnetworks.de [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .adbrite.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .adbrite.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .casalemedia.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        tracking.quisma.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        tracking.quisma.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        tracking.quisma.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        tracking.quisma.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        tracking.quisma.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .adbrite.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .adbrite.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .adbrite.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .adbrite.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .adbrite.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .statcounter.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .advertising.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .ad-emea.doubleclick.net [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .ad-emea.doubleclick.net [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .ad-emea.doubleclick.net [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .dyntracker.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        tracking.mlsat02.de [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        adfarm1.adition.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .a.revenuemax.de [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        www.active-tracking.de [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        www.active-tracking.de [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        www.active-tracking.de [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        ads.crakmedia.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .exoclick.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .syndication.traffichaus.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .syndication.traffichaus.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .syndication.traffichaus.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        stat.ed.cupidplc.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        ads.trafficjunky.net [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .youporn.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .youporn.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .youporn.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .sexad.net [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .microsoftwllivemkt.112.2o7.net [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .c.atdmt.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .c.atdmt.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .c.atdmt.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .c.atdmt.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .atdmt.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .atdmt.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .lfstmedia.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .lfstmedia.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .lfstmedia.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        track.adform.net [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .invitemedia.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .invitemedia.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .invitemedia.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .invitemedia.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        track.adform.net [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .adform.net [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        adx.chip.de [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        adx.chip.de [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .toplist.cz [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .zedo.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .revsci.net [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .at.atwola.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .tribalfusion.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        track.solocpm.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        track.solocpm.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        track.solocpm.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        track.solocpm.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        track.solocpm.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        track.solocpm.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        track.solocpm.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        track.solocpm.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        track.solocpm.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        track.solocpm.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        track.solocpm.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        track.solocpm.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        track.solocpm.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        track.solocpm.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        track.solocpm.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        track.solocpm.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        track.solocpm.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        track.solocpm.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        track.solocpm.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .zedo.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .zedo.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .revsci.net [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .zedo.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .zedo.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .zedo.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .smartadserver.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .smartadserver.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        tracking.quisma.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        wstat.wibiya.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .advertising.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .luroxmedia.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .luroxmedia.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .luroxmedia.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .luroxmedia.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        ad.yieldmanager.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        ad.yieldmanager.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .invitemedia.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .fastclick.net [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .tracking.quisma.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .specificclick.net [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .adviva.net [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .im.banner.t-online.de [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        ad4.adfarm1.adition.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .zanox-affiliate.de [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .dmtracker.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .traffictrack.de [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .tracking.quisma.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .unitymedia.de [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .unitymedia.de [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .tracking.quisma.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .tradedoubler.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .apmebf.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .fastclick.net [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .tradedoubler.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .tradedoubler.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .tradedoubler.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .mediaplex.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        ad.yieldmanager.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        ad.yieldmanager.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        ad.yieldmanager.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        www.blogcounter.de [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .media6degrees.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .media6degrees.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .media6degrees.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .media6degrees.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        ad3.adfarm1.adition.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .revsci.net [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .revsci.net [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .revsci.net [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .smartadserver.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .smartadserver.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .smartadserver.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        ww251.smartadserver.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .serving-sys.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .serving-sys.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        ad1.adfarm1.adition.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .zanox.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        ad.zanox.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .doubleclick.net [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .atdmt.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .h.atdmt.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .h.atdmt.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .h.atdmt.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .h.atdmt.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        ad2.adfarm1.adition.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        ad.yieldmanager.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        ad.yieldmanager.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .tripod.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .tripod.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .casalemedia.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .casalemedia.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .casalemedia.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .casalemedia.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .casalemedia.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .casalemedia.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        .casalemedia.com [ C:\USERS\SHADOW315\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WA7HN65N.DEFAULT\COOKIES.SQLITE ]

        cdn2.baronsmedia.com [ C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\FXDZA2X3 ]

        content.yieldmanager.edgesuite.net [ C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\FXDZA2X3 ]

        delivery.ibanner.de [ C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\FXDZA2X3 ]

        media1.break.com [ C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\FXDZA2X3 ]

        objects.tremormedia.com [ C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\FXDZA2X3 ]
 

Trojan.Agent/Gen-Malintent

        C:\PROGRAM FILES\WINRAR\DEFAULT.SFX
 

System.BrokenFileAssociation

        HKCR\.com

Habe direkt im Anschluss alle entdeckten infizierten Dateien bereinigt
bzw löschen lassen.

Den Vollscan von Malwarebytes lasse ich über Nacht laufen und
poste den Log dann morgen früh.

Hier der Vollscanlog von Malwarebytes:

Code:

Malwarebytes Anti-Malware (Test) 1.60.1.1000

www.malwarebytes.org
 

Datenbank Version: v2012.02.24.04
 

Windows Vista Service Pack 2 x86 NTFS

Internet Explorer 9.0.8112.16421

Shadow315 :: SHADOW315-PC [Administrator]
 

Schutz: Deaktiviert
 

25.02.2012 00:26:34

mbam-log-2012-02-25 (00-26-34).txt
 

Art des Suchlaufs: Vollständiger Suchlauf

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 345321

Laufzeit: 1 Stunde(n), 38 Minute(n), 34 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 0

(Keine bösartigen Objekte gefunden)
 

(Ende)

Sieht ok aus, da wurden nur Cookies gefunden. Die können weg. Und ein Fehlalarm war dabei.
Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie )

Ist das System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?

Das System läuft, allerdings sind einige Sachen auch nach unhide nicht
wieder aufgetaucht. Die normalen Naviationssymbole, die man über -Start-
erreicht, sind hingegen alle wieder genau da, wie ursprünglich.

Vielen, vielen Dank nochmal an dieser Stelle.

Dann beschrieb nochmal ganz genau was fehlt.

Ansonsten wären wir erstmal durch! :abklatsch:

Die Programme, die hier zum Einsatz kamen, können alle wieder runter. CF kann über Start, Ausführen mit combofix /uninstall entfernt werden. Melde dich falls es da Fehlermeldungen zu gibt.
Malwarebytes zu behalten ist kein Fehler. Kannst ja 1x im Monat damit scannen, aber immer vorher ans Update denken.

Bitte abschließend die Updates prüfen, unten mein Leitfaden dazu. Um in Zukunft die Aktualität der installierten Programme besser im Überblick zu halten, kannst du zB Secunia PSI verwenden.
Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern.

Microsoftupdate

Windows XP: Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.

Windows Vista/7: Anleitung Windows-Update

PDF-Reader aktualisieren
Ein veralteter AdobeReader stellt ein großes Sicherheitsrisiko dar. Du solltest daher besser alte Versionen vom AdobeReader über Systemsteuerung => Software bzw. Programme und Funktionen deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst. (falls du AdobeReader installiert hast)

Ich empfehle einen alternativen PDF-Reader wie PDF Xchange Viewer, SumatraPDF oder Foxit PDF Reader, die sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers:

Adobe - Andere Version des Adobe Flash Player installieren

Notfalls kann man auch von Chip.de runterladen => http://filepony.de/?q=Flash+Player

Natürlich auch darauf achten, dass andere installierte Browser wie zB Firefox, Opera oder Chrome aktuell sind.

Java-Update
Veraltete Java-Installationen sind ein Sicherheitsrisiko, daher solltest Du die alten Versionen löschen (falls vorhanden, am besten mit JavaRa) und auf die neuste aktualisieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.

Zum Beispiel fehlen mir ein paar installierte Spiele wie Starcraft II
aber auch kleinere Programme - wobei mir hier lediglich -Paint- aufgefallen
ist, sind irgendwie weg. Aber ganz ehrlich, das ist kein Beinbruch,
erst Recht nicht, nach all dem, was jetzt hinter mir liegt. :party: