Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   GUV Trojaner - Bluescreen nach OTLPENet (https://www.trojaner-board.de/130010-guv-trojaner-bluescreen-otlpenet.html)

OnkelFax 24.01.2013 11:28
GUV Trojaner - Bluescreen nach OTLPENet
 
Hallo,
nun muß ich ich den GUV-Trojaner auch auf einem ThinkPad-Notebook mit Win7 entfernen.

Zuerst habe ich den Rat befolgt und mit Avira AntiVir Rescue System gebootet.
Das Notebook blieb nach wenigen Minuten mit schwarzem Bildschirm stehen.

Dann habe ich mit OTLPENet gebootet. Der Windows-XP Startbildschirm erschien kurz, anschließend ein Bluescreen mit dem Hinweis chkdsk /F auszuführen, was ich allerdings noch nicht getan habe.

Was kann ich nun tun?

Vielen Dank schonmal für's Lesen

Volker

markusg 24.01.2013 11:44
hi
gehe ins bios, prüfe, ob ide oder ahci mode gewählt ist, konfiguriere jeweils den gegenteiligen und versuchs erneut

OnkelFax 28.01.2013 07:52
Danke.
Habe von ahci auf compatible umgestellt. Der Erste Start im abgesicherten Modus endete mit einem ganz kurz sichtbaren Bluescreen.

Dann habe ich mit OTELPENet gebootet. Es wurde dabei allerdings nur die OTL.txt angelegt.
Hier ist sie:
Code:
OTL logfile created on: 1/28/2013 7:44:07 AM - Run
OTLPE by OldTimer - Version 3.1.48.0    Folder = X:\Programs\OTLPE
64bit-Windows 7 Home Premium Service Pack 1 (Version = 6.1.7601) - Type = System
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 89.00% Memory free
3.00 Gb Paging File | 3.00 Gb Available in Paging File | 97.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = E: | %SystemRoot% = E:\Windows | %ProgramFiles% = E:\Program Files (x86)
Drive C: | 100.00 Mb Total Space | 74.35 Mb Free Space | 74.35% Space Free | Partition Type: NTFS
Drive E: | 278.46 Gb Total Space | 237.30 Gb Free Space | 85.22% Space Free | Partition Type: NTFS
Drive F: | 19.53 Gb Total Space | 5.39 Gb Free Space | 27.60% Space Free | Partition Type: NTFS
Drive G: | 3.70 Gb Total Space | 3.70 Gb Free Space | 100.00% Space Free | Partition Type: FAT32
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet001
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - [2012/11/20 09:09:58 | 000,188,760 | ---- | M] () [Auto] -- E:\Program Files\IB Updater\ExtensionUpdaterService.exe -- (IB Updater)
SRV:64bit: - [2012/11/14 05:56:16 | 001,312,624 | ---- | M] () [Auto] -- E:\Windows\System32\dmwu.exe -- (IBUpdaterService)
SRV:64bit: - [2012/09/12 14:21:48 | 000,368,896 | ---- | M] (Microsoft Corporation) [On_Demand] -- E:\Program Files\Microsoft Security Client\NisSrv.exe -- (NisSrv)
SRV:64bit: - [2012/09/12 14:21:48 | 000,022,072 | ---- | M] (Microsoft Corporation) [Auto] -- E:\Program Files\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc)
SRV:64bit: - [2011/06/13 13:36:48 | 000,915,232 | ---- | M] (Broadcom Corporation.) [Auto] -- E:\Program Files\ThinkPad\Bluetooth Software\btwdins.exe -- (btwdins)
SRV:64bit: - [2009/07/13 20:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand] -- E:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2013/01/09 12:32:23 | 000,251,400 | ---- | M] (Adobe Systems Incorporated) [On_Demand] -- E:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012/10/05 10:08:42 | 000,109,064 | ---- | M] (Wajam) [On_Demand] -- E:\Program Files (x86)\Wajam\Updater\WajamUpdater.exe -- (WajamUpdater)
SRV - [2012/01/18 07:38:28 | 000,155,320 | ---- | M] (Avanquest Software) [On_Demand] -- E:\Program Files (x86)\Sony\Sony PC Companion\PCCService.exe -- (Sony PC Companion)
SRV - [2011/07/25 17:18:46 | 000,028,672 | ---- | M] (Lenovo Group Limited) [Auto] -- E:\Program Files (x86)\Lenovo\System Update\SUService.exe -- (SUService)
SRV - [2010/09/30 08:00:28 | 000,253,264 | ---- | M] () [Auto] -- E:\Program Files (x86)\1&1 Surf-Stick\AssistantServices.exe -- (UI Assistant Service)
SRV - [2010/03/18 07:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto] -- E:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009/06/10 16:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled] -- E:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2012/08/30 15:03:48 | 000,128,456 | ---- | M] (Microsoft Corporation) [Kernel | Auto] -- E:\Windows\System32\drivers\NisDrvWFP.sys -- (NisDrv)
DRV:64bit: - [2011/11/15 01:50:44 | 000,054,824 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand] -- E:\Windows\System32\drivers\btusbflt.sys -- (btusbflt)
DRV:64bit: - [2011/06/10 00:34:52 | 000,539,240 | ---- | M] (Realtek                                            ) [Kernel | On_Demand] -- E:\Windows\System32\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2011/02/23 03:14:44 | 001,142,376 | ---- | M] (Realtek Semiconductor Corporation                          ) [Kernel | On_Demand] -- E:\Windows\System32\drivers\rtl8192Ce.sys -- (RTL8192Ce)
DRV:64bit: - [2010/11/28 23:23:18 | 012,252,192 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- E:\Windows\System32\drivers\igdkmd64.sys -- (igfx)
DRV:64bit: - [2010/11/20 22:24:33 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- E:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010/11/20 22:23:47 | 000,031,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- E:\Windows\system32\drivers\TsUsbGD.sys -- (TsUsbGD)
DRV:64bit: - [2009/10/29 13:28:24 | 000,119,680 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand] -- E:\Windows\System32\drivers\ZTEusbser6k.sys -- (ZTEusbser6k)
DRV:64bit: - [2009/10/29 13:28:24 | 000,119,680 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand] -- E:\Windows\System32\drivers\ZTEusbnmea.sys -- (ZTEusbnmea)
DRV:64bit: - [2009/10/29 13:28:24 | 000,119,680 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand] -- E:\Windows\System32\drivers\ZTEusbmdm6k.sys -- (ZTEusbmdm6k)
DRV:64bit: - [2009/10/29 13:28:24 | 000,011,776 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand] -- E:\Windows\System32\drivers\massfilter.sys -- (massfilter)
DRV:64bit: - [2009/06/10 15:38:56 | 000,000,308 | ---- | M] () [File_System | On_Demand] -- E:\Windows\System32\wbem\ntfs.mof -- (Ntfs)
DRV:64bit: - [2009/06/10 15:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- E:\Windows\system32\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009/06/10 15:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- E:\Windows\system32\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009/06/10 15:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- E:\Windows\System32\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2007/02/19 00:56:38 | 000,027,136 | ---- | M] (Lenovo (United States) Inc.) [Kernel | On_Demand] -- E:\Windows\System32\drivers\psadd.sys -- (psadd)
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\Schacht_ON_E\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://mystart.incredibar.com/mb155?a=6R8ScDAwiz&i=26
IE - HKU\Schacht_ON_E\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKU\Schacht_ON_E\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
IE - HKU\Schacht_ON_E\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = B2 D2 BA DF D9 E8 CC 01  [binary data]
IE - HKU\Schacht_ON_E\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE:  File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: E:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: E:\Program Files\Microsoft Office\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: E:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin,version=10.7.2: E:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE:  File not found
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: E:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: E:\Program Files (x86)\Microsoft Office\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: E:\Program Files (x86)\Microsoft Office\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3: E:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9: E:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
 
64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{336D0C35-8A85-403a-B9D2-65C292C39087}: C:\PROGRAM FILES\IB UPDATER\FIREFOX [2013/01/23 08:23:58 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Firefox\Extensions\\{336D0C35-8A85-403a-B9D2-65C292C39087}: C:\Program Files\IB Updater\Firefox [2013/01/23 08:23:58 | 000,000,000 | ---D | M]
 
[2013/01/23 08:24:13 | 000,000,000 | ---D | M] (No name found) -- E:\Program Files (x86)\Mozilla Firefox\extensions
 
O1 HOSTS File: ([2009/06/10 16:00:26 | 000,000,824 | ---- | M]) - E:\Windows\System32\drivers\etc\hosts
O2:64bit: - BHO: (IB Updater) - {336D0C35-8A85-403a-B9D2-65C292C39087} - E:\Program Files\IB Updater\Extension64.dll ()
O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - E:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O2 - BHO: (IB Updater) - {336D0C35-8A85-403a-B9D2-65C292C39087} - E:\Program Files\IB Updater\Extension32.dll ()
O2 - BHO: (Incredibar.com Helper Object) - {6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99} - E:\Program Files (x86)\Incredibar.com\incredibar\1.5.11.14\bh\incredibar.dll (Montera Technologeis LTD)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Wajam) - {A7A6995D-6EE1-4FD1-A258-49395D5BF99C} - E:\Program Files (x86)\Wajam\IE\priam_bho.dll (Wajam)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - E:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - E:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Incredibar Toolbar) - {F9639E4A-801B-4843-AEE3-03D9DA199E77} - E:\Program Files (x86)\Incredibar.com\incredibar\1.5.11.14\incredibarTlbr.dll (Montera Technologeis LTD)
O4:64bit: - HKLM..\Run: [MSC] E:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [UIExec] E:\Program Files (x86)\1&1 Surf-Stick\UIExec.exe ()
O4 - HKU\LocalService_ON_E..\Run: [Sidebar] E:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\NetworkService_ON_E..\Run: [Sidebar] E:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\Schacht_ON_E..\Run: [Sony PC Companion] E:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe (Sony)
O4 - HKU\LocalService_ON_E..\RunOnce: [mctadmin]  File not found
O4 - HKU\NetworkService_ON_E..\RunOnce: [mctadmin]  File not found
O4 - Startup: Error locating startup folders.
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O9:64bit: - Extra Button: @C:\Program Files\ThinkPad\Bluetooth Software\btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - E:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm ()
O9:64bit: - Extra 'Tools' menuitem : @C:\Program Files\ThinkPad\Bluetooth Software\btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - E:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: Senden an Bluetooth - {CCA281CA-C863-46ef-9331-5C8D4460577F} - E:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : Senden an &Bluetooth-Gerät... - {CCA281CA-C863-46ef-9331-5C8D4460577F} - E:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: PokerStars.net - {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - E:\Program Files (x86)\PokerStars.NET\PokerStarsUpdate.exe (PokerStars)
O13:64bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {816BE035-1450-40D0-8A3B-BA7825A83A77} hxxp://support.lenovo.com/Resources/Lenovo/AutoDetect/Lenovo_AutoDetect2.cab (IASRunner Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Reg Error: Value error.)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 10.7.2)
O18:64bit: - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - Reg Error: Key error. File not found
O20:64bit: - HKLM Winlogon: Shell - (C:\PROGRA~3\dsgsdgdsgdsgw.bat) - E:\ProgramData\dsgsdgdsgdsgw.bat ()
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - E:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (C:\PROGRA~3\dsgsdgdsgdsgw.bat) - E:\ProgramData\dsgsdgdsgdsgw.bat ()
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2012/01/21 07:15:30 | 000,000,758 | ---- | M] () - F:\autorun.inf -- [ NTFS ]
O32 - AutoRun File - [2006/03/24 06:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
64bit: O35 - HKLM\..comfile [open] -- "%1" %* File not found
64bit: O35 - HKLM\..exefile [open] -- "%1" %* File not found
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013/01/23 08:24:56 | 000,000,000 | ---D | C] -- E:\Users\Schacht\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Wajam
[2013/01/23 08:24:52 | 000,000,000 | ---D | C] -- E:\Users\Schacht\AppData\Local\Wajam
[2013/01/23 08:24:51 | 000,000,000 | ---D | C] -- E:\Program Files (x86)\Wajam
[2013/01/23 08:24:23 | 000,000,000 | ---D | C] -- E:\Program Files (x86)\Perion
[2013/01/23 08:24:16 | 000,000,000 | ---D | C] -- E:\Program Files (x86)\Incredibar.com
[2013/01/23 08:24:13 | 000,000,000 | ---D | C] -- E:\Program Files (x86)\Mozilla Firefox
[2013/01/23 08:23:57 | 000,000,000 | ---D | C] -- E:\Program Files\IB Updater
[2013/01/23 08:23:38 | 000,829,264 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\msvcr100.dll
[2013/01/23 08:23:37 | 000,608,080 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\msvcp100.dll
[2013/01/23 08:23:37 | 000,035,328 | ---- | C] (IncrediMail, Ltd.) -- E:\Windows\System32\ImHttpComm.dll
[2013/01/23 08:23:37 | 000,000,000 | ---D | C] -- E:\Windows\System32\ARFC
[2013/01/23 08:23:36 | 000,000,000 | ---D | C] -- E:\Windows\SysWow64\WNLT
[2013/01/23 08:22:01 | 000,000,000 | ---D | C] -- E:\Users\Schacht\AppData\Local\Programs
[2013/01/13 11:20:12 | 000,000,000 | ---D | C] -- E:\Users\Schacht\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Skat-Online
[2013/01/13 10:49:34 | 000,000,000 | ---D | C] -- E:\Users\Schacht\Desktop\Neuer Ordner
[2013/01/09 11:46:17 | 000,750,592 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\win32spl.dll
[2013/01/09 11:46:17 | 000,492,032 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\win32spl.dll
[2013/01/09 11:46:01 | 000,307,200 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\ncrypt.dll
[2013/01/09 11:46:01 | 000,220,160 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\ncrypt.dll
[2013/01/09 11:46:00 | 000,800,768 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\usp10.dll
[2013/01/09 11:45:57 | 002,746,368 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\gameux.dll
[2013/01/09 11:45:57 | 002,576,384 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\gameux.dll
[2013/01/09 11:45:57 | 000,441,856 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\Wpc.dll
[2013/01/09 11:45:57 | 000,308,736 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\Wpc.dll
[2013/01/09 11:45:57 | 000,046,592 | ---- | C] (Microsoft) -- E:\Windows\SysWow64\fpb.rs
[2013/01/09 11:45:57 | 000,046,592 | ---- | C] (Microsoft) -- E:\Windows\System32\fpb.rs
[2013/01/09 11:45:57 | 000,045,568 | ---- | C] (Microsoft) -- E:\Windows\SysWow64\oflc-nz.rs
[2013/01/09 11:45:57 | 000,045,568 | ---- | C] (Microsoft) -- E:\Windows\System32\oflc-nz.rs
[2013/01/09 11:45:57 | 000,044,544 | ---- | C] (Microsoft) -- E:\Windows\SysWow64\pegibbfc.rs
[2013/01/09 11:45:57 | 000,044,544 | ---- | C] (Microsoft) -- E:\Windows\System32\pegibbfc.rs
[2013/01/09 11:45:57 | 000,043,520 | ---- | C] (Microsoft) -- E:\Windows\SysWow64\csrr.rs
[2013/01/09 11:45:57 | 000,043,520 | ---- | C] (Microsoft) -- E:\Windows\System32\csrr.rs
[2013/01/09 11:45:57 | 000,040,960 | ---- | C] (Microsoft) -- E:\Windows\SysWow64\cob-au.rs
[2013/01/09 11:45:57 | 000,040,960 | ---- | C] (Microsoft) -- E:\Windows\System32\cob-au.rs
[2013/01/09 11:45:57 | 000,030,720 | ---- | C] (Microsoft) -- E:\Windows\SysWow64\usk.rs
[2013/01/09 11:45:57 | 000,030,720 | ---- | C] (Microsoft) -- E:\Windows\System32\usk.rs
[2013/01/09 11:45:57 | 000,021,504 | ---- | C] (Microsoft) -- E:\Windows\SysWow64\grb.rs
[2013/01/09 11:45:57 | 000,021,504 | ---- | C] (Microsoft) -- E:\Windows\System32\grb.rs
[2013/01/09 11:45:57 | 000,020,480 | ---- | C] (Microsoft) -- E:\Windows\SysWow64\pegi-pt.rs
[2013/01/09 11:45:57 | 000,020,480 | ---- | C] (Microsoft) -- E:\Windows\System32\pegi-pt.rs
[2013/01/09 11:45:57 | 000,020,480 | ---- | C] (Microsoft) -- E:\Windows\SysWow64\pegi.rs
[2013/01/09 11:45:57 | 000,020,480 | ---- | C] (Microsoft) -- E:\Windows\System32\pegi.rs
[2013/01/09 11:45:57 | 000,015,360 | ---- | C] (Microsoft) -- E:\Windows\SysWow64\djctq.rs
[2013/01/09 11:45:57 | 000,015,360 | ---- | C] (Microsoft) -- E:\Windows\System32\djctq.rs
[2013/01/09 11:45:56 | 000,055,296 | ---- | C] (Microsoft) -- E:\Windows\SysWow64\cero.rs
[2013/01/09 11:45:56 | 000,055,296 | ---- | C] (Microsoft) -- E:\Windows\System32\cero.rs
[2013/01/09 11:45:56 | 000,051,712 | ---- | C] (Microsoft) -- E:\Windows\SysWow64\esrb.rs
[2013/01/09 11:45:56 | 000,051,712 | ---- | C] (Microsoft) -- E:\Windows\System32\esrb.rs
[2013/01/09 11:45:56 | 000,023,552 | ---- | C] (Microsoft) -- E:\Windows\SysWow64\oflc.rs
[2013/01/09 11:45:56 | 000,023,552 | ---- | C] (Microsoft) -- E:\Windows\System32\oflc.rs
[2013/01/09 11:45:56 | 000,020,480 | ---- | C] (Microsoft) -- E:\Windows\SysWow64\pegi-fi.rs
[2013/01/09 11:45:56 | 000,020,480 | ---- | C] (Microsoft) -- E:\Windows\System32\pegi-fi.rs
[2013/01/09 11:45:35 | 000,424,448 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\KernelBase.dll
[2013/01/09 11:45:33 | 001,161,216 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\kernel32.dll
[2013/01/09 11:45:32 | 000,362,496 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\wow64win.dll
[2013/01/09 11:45:32 | 000,338,432 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\conhost.exe
[2013/01/09 11:45:32 | 000,243,200 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\wow64.dll
[2013/01/09 11:45:32 | 000,215,040 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\winsrv.dll
[2013/01/09 11:45:32 | 000,013,312 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\wow64cpu.dll
[2013/01/09 11:45:31 | 000,016,384 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\ntvdm64.dll
[2013/01/09 11:45:31 | 000,014,336 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\ntvdm64.dll
[2013/01/09 11:45:31 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\api-ms-win-core-file-l1-1-0.dll
[2013/01/09 11:45:31 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- E:\Windows\System32\api-ms-win-core-file-l1-1-0.dll
[2013/01/09 11:45:31 | 000,005,120 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\wow32.dll
[2013/01/09 11:45:31 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- E:\Windows\System32\api-ms-win-core-string-l1-1-0.dll
[2013/01/09 11:45:31 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\api-ms-win-core-errorhandling-l1-1-0.dll
[2013/01/09 11:45:31 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\api-ms-win-core-delayload-l1-1-0.dll
[2013/01/09 11:45:31 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- E:\Windows\System32\api-ms-win-core-delayload-l1-1-0.dll
[2013/01/09 11:45:30 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- E:\Windows\System32\api-ms-win-security-base-l1-1-0.dll
[2013/01/09 11:45:30 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- E:\Windows\System32\api-ms-win-core-threadpool-l1-1-0.dll
[2013/01/09 11:45:30 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\api-ms-win-core-processthreads-l1-1-0.dll
[2013/01/09 11:45:30 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\api-ms-win-core-sysinfo-l1-1-0.dll
[2013/01/09 11:45:30 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- E:\Windows\System32\api-ms-win-core-sysinfo-l1-1-0.dll
[2013/01/09 11:45:30 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\api-ms-win-core-synch-l1-1-0.dll
[2013/01/09 11:45:30 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- E:\Windows\System32\api-ms-win-core-synch-l1-1-0.dll
[2013/01/09 11:45:30 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- E:\Windows\System32\api-ms-win-core-rtlsupport-l1-1-0.dll
[2013/01/09 11:45:30 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- E:\Windows\System32\api-ms-win-core-xstate-l1-1-0.dll
[2013/01/09 11:45:30 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- E:\Windows\System32\api-ms-win-core-util-l1-1-0.dll
[2013/01/09 11:45:30 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\api-ms-win-core-string-l1-1-0.dll
[2013/01/09 11:45:30 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\api-ms-win-core-profile-l1-1-0.dll
[2013/01/09 11:45:30 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- E:\Windows\System32\api-ms-win-core-profile-l1-1-0.dll
[2013/01/09 11:45:29 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- E:\Windows\System32\api-ms-win-core-processthreads-l1-1-0.dll
[2013/01/09 11:45:29 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\api-ms-win-core-misc-l1-1-0.dll
[2013/01/09 11:45:29 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\api-ms-win-core-processenvironment-l1-1-0.dll
[2013/01/09 11:45:29 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- E:\Windows\System32\api-ms-win-core-processenvironment-l1-1-0.dll
[2013/01/09 11:45:29 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\api-ms-win-core-namedpipe-l1-1-0.dll
[2013/01/09 11:45:29 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- E:\Windows\System32\api-ms-win-core-namedpipe-l1-1-0.dll
[2013/01/09 11:45:29 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- E:\Windows\System32\api-ms-win-core-misc-l1-1-0.dll
[2013/01/09 11:45:29 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\api-ms-win-core-memory-l1-1-0.dll
[2013/01/09 11:45:29 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- E:\Windows\System32\api-ms-win-core-memory-l1-1-0.dll
[2013/01/09 11:45:28 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\api-ms-win-core-localregistry-l1-1-0.dll
[2013/01/09 11:45:28 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- E:\Windows\System32\api-ms-win-core-localregistry-l1-1-0.dll
[2013/01/09 11:45:28 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\api-ms-win-core-libraryloader-l1-1-0.dll
[2013/01/09 11:45:28 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- E:\Windows\System32\api-ms-win-core-libraryloader-l1-1-0.dll
[2013/01/09 11:45:28 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\api-ms-win-core-interlocked-l1-1-0.dll
[2013/01/09 11:45:28 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\api-ms-win-core-heap-l1-1-0.dll
[2013/01/09 11:45:28 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- E:\Windows\System32\api-ms-win-core-heap-l1-1-0.dll
[2013/01/09 11:45:28 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\api-ms-win-core-io-l1-1-0.dll
[2013/01/09 11:45:28 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- E:\Windows\System32\api-ms-win-core-io-l1-1-0.dll
[2013/01/09 11:45:28 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- E:\Windows\System32\api-ms-win-core-interlocked-l1-1-0.dll
[2013/01/09 11:45:28 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\api-ms-win-core-handle-l1-1-0.dll
[2013/01/09 11:45:28 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- E:\Windows\System32\api-ms-win-core-handle-l1-1-0.dll
[2013/01/09 11:45:28 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\api-ms-win-core-fibers-l1-1-0.dll
[2013/01/09 11:45:28 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- E:\Windows\System32\api-ms-win-core-fibers-l1-1-0.dll
[2013/01/09 11:45:28 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- E:\Windows\System32\api-ms-win-core-errorhandling-l1-1-0.dll
[2013/01/09 11:45:28 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\api-ms-win-core-debug-l1-1-0.dll
[2013/01/09 11:45:28 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- E:\Windows\System32\api-ms-win-core-debug-l1-1-0.dll
[2013/01/09 11:45:28 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\api-ms-win-core-datetime-l1-1-0.dll
[2013/01/09 11:45:28 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- E:\Windows\System32\api-ms-win-core-datetime-l1-1-0.dll
[2013/01/09 11:45:27 | 000,025,600 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\setup16.exe
[2013/01/09 11:45:27 | 000,007,680 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\instnm.exe
[2013/01/09 11:45:27 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll
[2013/01/09 11:45:27 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll
[2013/01/09 11:45:27 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\api-ms-win-core-localization-l1-1-0.dll
[2013/01/09 11:45:27 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- E:\Windows\System32\api-ms-win-core-localization-l1-1-0.dll
[2013/01/09 11:45:27 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll
[2013/01/09 11:45:27 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll
[2013/01/09 11:45:27 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\api-ms-win-core-rtlsupport-l1-1-0.dll
[2013/01/09 11:45:27 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\api-ms-win-core-console-l1-1-0.dll
[2013/01/09 11:45:27 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- E:\Windows\System32\api-ms-win-core-console-l1-1-0.dll
[2013/01/09 11:45:27 | 000,002,048 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\user.exe
[2013/01/09 11:44:52 | 000,068,608 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\taskhost.exe
 
========== Files - Modified Within 30 Days ==========
 
[2013/01/24 04:52:25 | 095,023,320 | ---- | M] () -- E:\ProgramData\dsgsdgdsgdsgw.pad
[2013/01/24 04:52:13 | 000,067,584 | --S- | M] () -- E:\Windows\bootstat.dat
[2013/01/24 04:52:08 | 3061,223,424 | -HS- | M] () -- E:\hiberfil.sys
[2013/01/24 04:26:21 | 000,001,108 | ---- | M] () -- E:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013/01/24 04:14:31 | 000,654,150 | ---- | M] () -- E:\Windows\System32\perfh007.dat
[2013/01/24 04:14:31 | 000,616,032 | ---- | M] () -- E:\Windows\System32\perfh009.dat
[2013/01/24 04:14:31 | 000,130,022 | ---- | M] () -- E:\Windows\System32\perfc007.dat
[2013/01/24 04:14:31 | 000,106,412 | ---- | M] () -- E:\Windows\System32\perfc009.dat
[2013/01/24 04:10:29 | 000,001,053 | ---- | M] () -- E:\Users\Schacht\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\runctf.lnk
[2013/01/24 04:10:29 | 000,000,159 | ---- | M] () -- E:\ProgramData\dsgsdgdsgdsgw.reg
[2013/01/24 04:10:29 | 000,000,068 | ---- | M] () -- E:\ProgramData\dsgsdgdsgdsgw.bat
[2013/01/24 03:24:12 | 000,001,112 | ---- | M] () -- E:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013/01/24 03:24:05 | 000,022,064 | -H-- | M] () -- E:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013/01/24 03:24:05 | 000,022,064 | -H-- | M] () -- E:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013/01/24 02:59:00 | 000,000,884 | ---- | M] () -- E:\Windows\tasks\Adobe Flash Player Updater.job
[2013/01/23 08:27:09 | 000,063,587 | ---- | M] () -- E:\Windows\unins000.dat
[2013/01/23 08:24:17 | 000,000,447 | ---- | M] () -- E:\user.js
[2013/01/23 08:22:01 | 000,001,852 | ---- | M] () -- E:\Users\Schacht\Desktop\Continue Converter Installation.lnk
[2013/01/23 08:22:00 | 000,721,397 | ---- | M] () -- E:\Windows\unins000.exe
[2013/01/13 11:20:12 | 000,002,181 | ---- | M] () -- E:\Users\Schacht\Desktop\Skat-Online V9.lnk
[2013/01/13 10:54:31 | 000,001,437 | ---- | M] () -- E:\Users\Schacht\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2013/01/12 07:37:39 | 000,002,283 | ---- | M] () -- E:\Users\Schacht\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2013/01/11 15:31:55 | 000,000,000 | ---D | M] -- E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
[2013/01/10 11:43:34 | 000,416,312 | ---- | M] () -- E:\Windows\System32\FNTCACHE.DAT
[2013/01/09 12:32:21 | 000,697,864 | ---- | M] (Adobe Systems Incorporated) -- E:\Windows\SysWow64\FlashPlayerApp.exe
[2013/01/09 12:32:21 | 000,074,248 | ---- | M] (Adobe Systems Incorporated) -- E:\Windows\SysWow64\FlashPlayerCPLApp.cpl
 
========== Files Created - No Company Name ==========
 
[2013/01/24 04:10:29 | 000,001,053 | ---- | C] () -- E:\Users\Schacht\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\runctf.lnk
[2013/01/23 08:27:53 | 000,000,159 | ---- | C] () -- E:\ProgramData\dsgsdgdsgdsgw.reg
[2013/01/23 08:27:53 | 000,000,068 | ---- | C] () -- E:\ProgramData\dsgsdgdsgdsgw.bat
[2013/01/23 08:27:52 | 095,023,320 | ---- | C] () -- E:\ProgramData\dsgsdgdsgdsgw.pad
[2013/01/23 08:27:09 | 000,721,397 | ---- | C] () -- E:\Windows\unins000.exe
[2013/01/23 08:27:09 | 000,063,587 | ---- | C] () -- E:\Windows\unins000.dat
[2013/01/23 08:24:16 | 000,000,447 | ---- | C] () -- E:\user.js
[2013/01/23 08:23:37 | 001,312,624 | ---- | C] () -- E:\Windows\System32\dmwu.exe
[2013/01/23 08:22:01 | 000,001,852 | ---- | C] () -- E:\Users\Schacht\Desktop\Continue Converter Installation.lnk
[2013/01/13 11:20:12 | 000,002,181 | ---- | C] () -- E:\Users\Schacht\Desktop\Skat-Online V9.lnk
[2012/07/03 09:49:33 | 004,503,728 | ---- | C] () -- E:\ProgramData\l_u0_0.pad
[2012/03/20 06:15:11 | 000,000,056 | ---- | C] () -- E:\Windows\molcho2009.ini
[2012/02/20 11:38:39 | 000,000,425 | ---- | C] () -- E:\Windows\BRWMARK.INI
[2012/02/20 11:38:39 | 000,000,027 | ---- | C] () -- E:\Windows\BRPP2KA.INI
[2011/11/15 08:36:35 | 000,000,400 | ---- | C] () -- E:\Windows\ODBC.INI
[2011/11/15 01:40:22 | 001,527,912 | ---- | C] () -- E:\Windows\SysWow64\PerfStringBackup.INI
[2010/11/28 23:21:32 | 000,128,204 | ---- | C] () -- E:\Windows\SysWow64\igcompkrng575.bin
[2010/11/28 23:21:30 | 000,867,020 | ---- | C] () -- E:\Windows\SysWow64\igkrng575.bin
[2010/11/28 23:21:30 | 000,105,408 | ---- | C] () -- E:\Windows\SysWow64\igfcg575m.bin
[2010/11/20 22:24:49 | 000,252,928 | ---- | C] () -- E:\Windows\SysWow64\DShowRdpFilter.dll
[2009/07/14 00:38:36 | 000,067,584 | --S- | C] () -- E:\Windows\bootstat.dat
[2009/07/13 21:35:51 | 000,000,741 | ---- | C] () -- E:\Windows\SysWow64\NOISE.DAT
[2009/07/13 21:34:42 | 000,215,943 | ---- | C] () -- E:\Windows\SysWow64\dssec.dat
[2009/07/13 19:10:29 | 000,043,131 | ---- | C] () -- E:\Windows\mib.bin
[2009/07/13 18:42:10 | 000,064,000 | ---- | C] () -- E:\Windows\SysWow64\BWContextHandler.dll
[2009/07/13 17:25:04 | 000,197,632 | ---- | C] () -- E:\Windows\SysWow64\ir32_32.dll
[2009/07/13 16:03:59 | 000,364,544 | ---- | C] () -- E:\Windows\SysWow64\msjetoledb40.dll
[2009/06/10 16:26:10 | 000,673,088 | ---- | C] () -- E:\Windows\SysWow64\mlang.dat
 
========== LOP Check ==========
 
[2011/11/15 01:29:08 | 000,000,000 | -HSD | M] -- E:\ProgramData\Anwendungsdaten
[2009/07/14 00:08:56 | 000,000,000 | -HSD | M] -- E:\ProgramData\Application Data
[2009/07/14 00:08:56 | 000,000,000 | -HSD | M] -- E:\ProgramData\Desktop
[2009/07/14 00:08:56 | 000,000,000 | -HSD | M] -- E:\ProgramData\Documents
[2011/11/15 01:29:08 | 000,000,000 | -HSD | M] -- E:\ProgramData\Dokumente
[2011/11/15 01:29:08 | 000,000,000 | -HSD | M] -- E:\ProgramData\Favoriten
[2009/07/14 00:08:56 | 000,000,000 | -HSD | M] -- E:\ProgramData\Favorites
[2012/03/17 05:47:18 | 000,000,000 | ---D | M] -- E:\ProgramData\Sony
[2009/07/14 00:08:56 | 000,000,000 | -HSD | M] -- E:\ProgramData\Start Menu
[2011/11/15 01:29:08 | 000,000,000 | -HSD | M] -- E:\ProgramData\Startmenü
[2009/07/14 00:08:56 | 000,000,000 | -HSD | M] -- E:\ProgramData\Templates
[2011/11/15 01:29:08 | 000,000,000 | -HSD | M] -- E:\ProgramData\Vorlagen
[2012/12/27 08:54:12 | 000,032,640 | ---- | M] () -- E:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
< End of report >

markusg 28.01.2013 13:31
auf deinem zweiten pc gehe auf start, programme zubehör editor, kopiere dort
rein:
Code:
:OTL
O20 - HKLM Winlogon: Shell - (C:\PROGRA~3\dsgsdgdsgdsgw.bat) - E:\ProgramData\dsgsdgdsgdsgw.bat ()
O20:64bit: - HKLM Winlogon: Shell - (C:\PROGRA~3\dsgsdgdsgdsgw.bat) - E:\ProgramData\dsgsdgdsgdsgw.bat ()
[2013/01/24 04:10:29 | 000,001,053 | ---- | M] () -- E:\Users\Schacht\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\runctf.lnk
[2013/01/24 04:10:29 | 000,000,159 | ---- | M] () -- E:\ProgramData\dsgsdgdsgdsgw.reg
[2013/01/24 04:10:29 | 000,000,068 | ---- | M] () -- E:\ProgramData\dsgsdgdsgdsgw.bat
:Files
E:\ProgramData\dsgsdgdsgdsgw.bat
:Commands
[EMPTYFLASH]
[emptytemp]


dieses speicherst du auf nem usb stick als fix.txt
nutze nun wieder OTLPENet.exe (starte also von der erstellten cd) und hake alles an, wie es bereits im post zu OTLPENet.exe beschrieben ist.
• Klicke nun bitte auf den Fix Button.
es sollte nun eine meldung ähnlich dieser: "load fix from file" erscheinen, lade also die fix.txt von deinem stick.
wenn dies nicht funktioniert, bitte den fix manuell eintragen.
dann klicke erneut den fix buton. pc startet evtl. neu. wenn ja, nimm die cd aus dem laufwerk, windows sollte nun normal starten und die otl.txt öffnen,
log posten bitte.
bitte vorher den modus im Bios wieder anpassen

OnkelFax 29.01.2013 07:48
Leider ohne Erfolg.

Zitat:
Zitat von markusg (Beitrag 1000286)
nutze nun wieder OTLPENet.exe (starte also von der erstellten cd) und hake alles an, wie es bereits im post zu OTLPENet.exe beschrieben ist.
Diesen Post konnte ich leider nicht finden. Deshalb ließ ich alle Haken da, wo sie auch beim 1. Scan waren.

Den Fix konnte ich im Textfeld eintragen und er wurde bearbeitet.

Nach Beendigung kam zwar der Hinweis, dass gebootet wird, allerdings bootete der Rechner nicht. Auch das manuelle Booten war nicht möglich.

Nach dem Kaltstart fand ein automatischer CHKDSK statt. Danach startete Windows wieder mit dem GUV-Fenster...

Nach erneutem Start mit OTLPENet konnte ich 2 Logfiles und 2 Verzeichnisse gleichen Namens finden.
Das Verzeichnis 01292013_070419 ist leer
und das Verzeichnis 01292013_073339 enthält weitere Ordner.

Datei 01292013_070419.log:

Code:
========== OTL ==========
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell:C:\PROGRA~3\dsgsdgdsgdsgw.bat deleted successfully.
File E:\ProgramData\dsgsdgdsgdsgw.bat not found.
64bit-Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell:C:\PROGRA~3\dsgsdgdsgdsgw.bat deleted successfully.
File E:\ProgramData\dsgsdgdsgdsgw.bat not found.
File E:\Users\Schacht\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\runctf.lnk not found.
File E:\ProgramData\dsgsdgdsgdsgw.reg not found.
File E:\ProgramData\dsgsdgdsgdsgw.bat not found.
========== FILES ==========
File\Folder E:\ProgramData\dsgsdgdsgdsgw.bat not found.
========== COMMANDS ==========
 
[EMPTYFLASH]
 
User: All Users
 
User: Default
 
User: Default User
 
User: Public
 
User: Schacht
 
Total Flash Files Cleaned = 0.00 mb
 
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
 
User: Default User
 
User: Public
 
User: Schacht
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 563968824 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 50451 bytes
 
Total Files Cleaned = 538.00 mb
 
 
OTLPE by OldTimer - Version 3.1.48.0 log created on 01292013_070419
und Datei 01292013_073339.log:

Code:
========== OTL ==========
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell:C:\PROGRA~3\dsgsdgdsgdsgw.bat deleted successfully.
E:\ProgramData\dsgsdgdsgdsgw.bat moved successfully.
64bit-Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell:C:\PROGRA~3\dsgsdgdsgdsgw.bat deleted successfully.
File E:\ProgramData\dsgsdgdsgdsgw.bat not found.
E:\Users\Schacht\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\runctf.lnk moved successfully.
E:\ProgramData\dsgsdgdsgdsgw.reg moved successfully.
File E:\ProgramData\dsgsdgdsgdsgw.bat not found.
========== FILES ==========
File\Folder E:\ProgramData\dsgsdgdsgdsgw.bat not found.
========== COMMANDS ==========
 
[EMPTYFLASH]
 
User: All Users
 
User: Default
 
User: Default User
 
User: Public
 
User: Schacht
 
Total Flash Files Cleaned = 0.00 mb
 
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
 
User: Default User
 
User: Public
 
User: Schacht
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 1052298 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 33170 bytes
 
Total Files Cleaned = 1.00 mb
 
 
OTLPE by OldTimer - Version 3.1.48.0 log created on 01292013_073339

markusg 29.01.2013 15:04
dann erstelle und poste noch mal ein neues otl log

OnkelFax 30.01.2013 08:27
Hier ist es:

Code:
OTL logfile created on: 1/30/2013 8:19:51 AM - Run
OTLPE by OldTimer - Version 3.1.48.0    Folder = X:\Programs\OTLPE
64bit-Windows 7 Home Premium Service Pack 1 (Version = 6.1.7601) - Type = System
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 90.00% Memory free
3.00 Gb Paging File | 3.00 Gb Available in Paging File | 98.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = E: | %SystemRoot% = E:\Windows | %ProgramFiles% = E:\Program Files (x86)
Drive C: | 100.00 Mb Total Space | 74.35 Mb Free Space | 74.35% Space Free | Partition Type: NTFS
Drive E: | 278.46 Gb Total Space | 237.82 Gb Free Space | 85.40% Space Free | Partition Type: NTFS
Drive F: | 19.53 Gb Total Space | 5.39 Gb Free Space | 27.60% Space Free | Partition Type: NTFS
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet001
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - [2012/11/20 09:09:58 | 000,188,760 | ---- | M] () [Auto] -- E:\Program Files\IB Updater\ExtensionUpdaterService.exe -- (IB Updater)
SRV:64bit: - [2012/11/14 05:56:16 | 001,312,624 | ---- | M] () [Auto] -- E:\Windows\System32\dmwu.exe -- (IBUpdaterService)
SRV:64bit: - [2012/09/12 14:21:48 | 000,368,896 | ---- | M] (Microsoft Corporation) [On_Demand] -- E:\Program Files\Microsoft Security Client\NisSrv.exe -- (NisSrv)
SRV:64bit: - [2012/09/12 14:21:48 | 000,022,072 | ---- | M] (Microsoft Corporation) [Auto] -- E:\Program Files\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc)
SRV:64bit: - [2011/06/13 13:36:48 | 000,915,232 | ---- | M] (Broadcom Corporation.) [Auto] -- E:\Program Files\ThinkPad\Bluetooth Software\btwdins.exe -- (btwdins)
SRV:64bit: - [2009/07/13 20:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand] -- E:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2013/01/09 12:32:23 | 000,251,400 | ---- | M] (Adobe Systems Incorporated) [On_Demand] -- E:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012/10/05 10:08:42 | 000,109,064 | ---- | M] (Wajam) [On_Demand] -- E:\Program Files (x86)\Wajam\Updater\WajamUpdater.exe -- (WajamUpdater)
SRV - [2012/01/18 07:38:28 | 000,155,320 | ---- | M] (Avanquest Software) [On_Demand] -- E:\Program Files (x86)\Sony\Sony PC Companion\PCCService.exe -- (Sony PC Companion)
SRV - [2011/07/25 17:18:46 | 000,028,672 | ---- | M] (Lenovo Group Limited) [Auto] -- E:\Program Files (x86)\Lenovo\System Update\SUService.exe -- (SUService)
SRV - [2010/09/30 08:00:28 | 000,253,264 | ---- | M] () [Auto] -- E:\Program Files (x86)\1&1 Surf-Stick\AssistantServices.exe -- (UI Assistant Service)
SRV - [2010/03/18 07:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto] -- E:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009/06/10 16:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled] -- E:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2012/08/30 15:03:48 | 000,128,456 | ---- | M] (Microsoft Corporation) [Kernel | Auto] -- E:\Windows\System32\drivers\NisDrvWFP.sys -- (NisDrv)
DRV:64bit: - [2011/11/15 01:50:44 | 000,054,824 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand] -- E:\Windows\System32\drivers\btusbflt.sys -- (btusbflt)
DRV:64bit: - [2011/06/10 00:34:52 | 000,539,240 | ---- | M] (Realtek                                            ) [Kernel | On_Demand] -- E:\Windows\System32\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2011/02/23 03:14:44 | 001,142,376 | ---- | M] (Realtek Semiconductor Corporation                          ) [Kernel | On_Demand] -- E:\Windows\System32\drivers\rtl8192Ce.sys -- (RTL8192Ce)
DRV:64bit: - [2010/11/28 23:23:18 | 012,252,192 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- E:\Windows\System32\drivers\igdkmd64.sys -- (igfx)
DRV:64bit: - [2010/11/20 22:24:33 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- E:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010/11/20 22:23:47 | 000,031,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- E:\Windows\system32\drivers\TsUsbGD.sys -- (TsUsbGD)
DRV:64bit: - [2009/10/29 13:28:24 | 000,119,680 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand] -- E:\Windows\System32\drivers\ZTEusbser6k.sys -- (ZTEusbser6k)
DRV:64bit: - [2009/10/29 13:28:24 | 000,119,680 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand] -- E:\Windows\System32\drivers\ZTEusbnmea.sys -- (ZTEusbnmea)
DRV:64bit: - [2009/10/29 13:28:24 | 000,119,680 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand] -- E:\Windows\System32\drivers\ZTEusbmdm6k.sys -- (ZTEusbmdm6k)
DRV:64bit: - [2009/10/29 13:28:24 | 000,011,776 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand] -- E:\Windows\System32\drivers\massfilter.sys -- (massfilter)
DRV:64bit: - [2009/06/10 15:38:56 | 000,000,308 | ---- | M] () [File_System | On_Demand] -- E:\Windows\System32\wbem\ntfs.mof -- (Ntfs)
DRV:64bit: - [2009/06/10 15:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- E:\Windows\system32\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009/06/10 15:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- E:\Windows\system32\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009/06/10 15:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- E:\Windows\System32\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2007/02/19 00:56:38 | 000,027,136 | ---- | M] (Lenovo (United States) Inc.) [Kernel | On_Demand] -- E:\Windows\System32\drivers\psadd.sys -- (psadd)
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\Schacht_ON_E\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://mystart.incredibar.com/mb155?a=6R8ScDAwiz&i=26
IE - HKU\Schacht_ON_E\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKU\Schacht_ON_E\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
IE - HKU\Schacht_ON_E\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = B2 D2 BA DF D9 E8 CC 01  [binary data]
IE - HKU\Schacht_ON_E\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE:  File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: E:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: E:\Program Files\Microsoft Office\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: E:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin,version=10.7.2: E:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE:  File not found
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: E:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: E:\Program Files (x86)\Microsoft Office\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: E:\Program Files (x86)\Microsoft Office\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3: E:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9: E:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
 
64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{336D0C35-8A85-403a-B9D2-65C292C39087}: C:\PROGRAM FILES\IB UPDATER\FIREFOX [2013/01/23 08:23:58 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Firefox\Extensions\\{336D0C35-8A85-403a-B9D2-65C292C39087}: C:\Program Files\IB Updater\Firefox [2013/01/23 08:23:58 | 000,000,000 | ---D | M]
 
[2013/01/23 08:24:13 | 000,000,000 | ---D | M] (No name found) -- E:\Program Files (x86)\Mozilla Firefox\extensions
 
O1 HOSTS File: ([2009/06/10 16:00:26 | 000,000,824 | ---- | M]) - E:\Windows\System32\drivers\etc\hosts
O2:64bit: - BHO: (IB Updater) - {336D0C35-8A85-403a-B9D2-65C292C39087} - E:\Program Files\IB Updater\Extension64.dll ()
O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - E:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O2 - BHO: (IB Updater) - {336D0C35-8A85-403a-B9D2-65C292C39087} - E:\Program Files\IB Updater\Extension32.dll ()
O2 - BHO: (Incredibar.com Helper Object) - {6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99} - E:\Program Files (x86)\Incredibar.com\incredibar\1.5.11.14\bh\incredibar.dll (Montera Technologeis LTD)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Wajam) - {A7A6995D-6EE1-4FD1-A258-49395D5BF99C} - E:\Program Files (x86)\Wajam\IE\priam_bho.dll (Wajam)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - E:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - E:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Incredibar Toolbar) - {F9639E4A-801B-4843-AEE3-03D9DA199E77} - E:\Program Files (x86)\Incredibar.com\incredibar\1.5.11.14\incredibarTlbr.dll (Montera Technologeis LTD)
O4:64bit: - HKLM..\Run: [MSC] E:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [UIExec] E:\Program Files (x86)\1&1 Surf-Stick\UIExec.exe ()
O4 - HKU\LocalService_ON_E..\Run: [Sidebar] E:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\NetworkService_ON_E..\Run: [Sidebar] E:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\Schacht_ON_E..\Run: [Sony PC Companion] E:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe (Sony)
O4 - HKU\LocalService_ON_E..\RunOnce: [mctadmin]  File not found
O4 - HKU\NetworkService_ON_E..\RunOnce: [mctadmin]  File not found
O4 - Startup: Error locating startup folders.
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O9:64bit: - Extra Button: @C:\Program Files\ThinkPad\Bluetooth Software\btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - E:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm ()
O9:64bit: - Extra 'Tools' menuitem : @C:\Program Files\ThinkPad\Bluetooth Software\btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - E:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: Senden an Bluetooth - {CCA281CA-C863-46ef-9331-5C8D4460577F} - E:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : Senden an &Bluetooth-Gerät... - {CCA281CA-C863-46ef-9331-5C8D4460577F} - E:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: PokerStars.net - {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - E:\Program Files (x86)\PokerStars.NET\PokerStarsUpdate.exe (PokerStars)
O13:64bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {816BE035-1450-40D0-8A3B-BA7825A83A77} hxxp://support.lenovo.com/Resources/Lenovo/AutoDetect/Lenovo_AutoDetect2.cab (IASRunner Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Reg Error: Value error.)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 10.7.2)
O18:64bit: - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - Reg Error: Key error. File not found
O20:64bit: - HKLM Winlogon: Shell - (C:\PROGRA~3\dsgsdgdsgdsgw.bat) -  File not found
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - E:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (C:\PROGRA~3\dsgsdgdsgdsgw.bat) -  File not found
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2012/01/21 07:15:30 | 000,000,758 | ---- | M] () - F:\autorun.inf -- [ NTFS ]
O32 - AutoRun File - [2006/03/24 06:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
64bit: O35 - HKLM\..comfile [open] -- "%1" %* File not found
64bit: O35 - HKLM\..exefile [open] -- "%1" %* File not found
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013/01/29 09:45:47 | 000,000,000 | -HSD | C] -- E:\RECYCLER
[2013/01/29 07:04:25 | 002,237,440 | R--- | C] (OldTimer Tools) -- E:\OTLPE.exe
[2013/01/29 07:04:19 | 000,000,000 | ---D | C] -- E:\_OTL
[2013/01/23 08:24:56 | 000,000,000 | ---D | C] -- E:\Users\Schacht\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Wajam
[2013/01/23 08:24:52 | 000,000,000 | ---D | C] -- E:\Users\Schacht\AppData\Local\Wajam
[2013/01/23 08:24:51 | 000,000,000 | ---D | C] -- E:\Program Files (x86)\Wajam
[2013/01/23 08:24:23 | 000,000,000 | ---D | C] -- E:\Program Files (x86)\Perion
[2013/01/23 08:24:16 | 000,000,000 | ---D | C] -- E:\Program Files (x86)\Incredibar.com
[2013/01/23 08:24:13 | 000,000,000 | ---D | C] -- E:\Program Files (x86)\Mozilla Firefox
[2013/01/23 08:23:57 | 000,000,000 | ---D | C] -- E:\Program Files\IB Updater
[2013/01/23 08:23:38 | 000,829,264 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\msvcr100.dll
[2013/01/23 08:23:37 | 000,608,080 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\msvcp100.dll
[2013/01/23 08:23:37 | 000,035,328 | ---- | C] (IncrediMail, Ltd.) -- E:\Windows\System32\ImHttpComm.dll
[2013/01/23 08:23:37 | 000,000,000 | ---D | C] -- E:\Windows\System32\ARFC
[2013/01/23 08:23:36 | 000,000,000 | ---D | C] -- E:\Windows\SysWow64\WNLT
[2013/01/23 08:22:01 | 000,000,000 | ---D | C] -- E:\Users\Schacht\AppData\Local\Programs
[2013/01/13 11:20:12 | 000,000,000 | ---D | C] -- E:\Users\Schacht\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Skat-Online
[2013/01/13 10:49:34 | 000,000,000 | ---D | C] -- E:\Users\Schacht\Desktop\Neuer Ordner
[2013/01/09 11:46:17 | 000,750,592 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\win32spl.dll
[2013/01/09 11:46:17 | 000,492,032 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\win32spl.dll
[2013/01/09 11:46:01 | 000,307,200 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\ncrypt.dll
[2013/01/09 11:46:01 | 000,220,160 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\ncrypt.dll
[2013/01/09 11:46:00 | 000,800,768 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\usp10.dll
[2013/01/09 11:45:57 | 002,746,368 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\gameux.dll
[2013/01/09 11:45:57 | 002,576,384 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\gameux.dll
[2013/01/09 11:45:57 | 000,441,856 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\Wpc.dll
[2013/01/09 11:45:57 | 000,308,736 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\Wpc.dll
[2013/01/09 11:45:57 | 000,046,592 | ---- | C] (Microsoft) -- E:\Windows\SysWow64\fpb.rs
[2013/01/09 11:45:57 | 000,046,592 | ---- | C] (Microsoft) -- E:\Windows\System32\fpb.rs
[2013/01/09 11:45:57 | 000,045,568 | ---- | C] (Microsoft) -- E:\Windows\SysWow64\oflc-nz.rs
[2013/01/09 11:45:57 | 000,045,568 | ---- | C] (Microsoft) -- E:\Windows\System32\oflc-nz.rs
[2013/01/09 11:45:57 | 000,044,544 | ---- | C] (Microsoft) -- E:\Windows\SysWow64\pegibbfc.rs
[2013/01/09 11:45:57 | 000,044,544 | ---- | C] (Microsoft) -- E:\Windows\System32\pegibbfc.rs
[2013/01/09 11:45:57 | 000,043,520 | ---- | C] (Microsoft) -- E:\Windows\SysWow64\csrr.rs
[2013/01/09 11:45:57 | 000,043,520 | ---- | C] (Microsoft) -- E:\Windows\System32\csrr.rs
[2013/01/09 11:45:57 | 000,040,960 | ---- | C] (Microsoft) -- E:\Windows\SysWow64\cob-au.rs
[2013/01/09 11:45:57 | 000,040,960 | ---- | C] (Microsoft) -- E:\Windows\System32\cob-au.rs
[2013/01/09 11:45:57 | 000,030,720 | ---- | C] (Microsoft) -- E:\Windows\SysWow64\usk.rs
[2013/01/09 11:45:57 | 000,030,720 | ---- | C] (Microsoft) -- E:\Windows\System32\usk.rs
[2013/01/09 11:45:57 | 000,021,504 | ---- | C] (Microsoft) -- E:\Windows\SysWow64\grb.rs
[2013/01/09 11:45:57 | 000,021,504 | ---- | C] (Microsoft) -- E:\Windows\System32\grb.rs
[2013/01/09 11:45:57 | 000,020,480 | ---- | C] (Microsoft) -- E:\Windows\SysWow64\pegi-pt.rs
[2013/01/09 11:45:57 | 000,020,480 | ---- | C] (Microsoft) -- E:\Windows\System32\pegi-pt.rs
[2013/01/09 11:45:57 | 000,020,480 | ---- | C] (Microsoft) -- E:\Windows\SysWow64\pegi.rs
[2013/01/09 11:45:57 | 000,020,480 | ---- | C] (Microsoft) -- E:\Windows\System32\pegi.rs
[2013/01/09 11:45:57 | 000,015,360 | ---- | C] (Microsoft) -- E:\Windows\SysWow64\djctq.rs
[2013/01/09 11:45:57 | 000,015,360 | ---- | C] (Microsoft) -- E:\Windows\System32\djctq.rs
[2013/01/09 11:45:56 | 000,055,296 | ---- | C] (Microsoft) -- E:\Windows\SysWow64\cero.rs
[2013/01/09 11:45:56 | 000,055,296 | ---- | C] (Microsoft) -- E:\Windows\System32\cero.rs
[2013/01/09 11:45:56 | 000,051,712 | ---- | C] (Microsoft) -- E:\Windows\SysWow64\esrb.rs
[2013/01/09 11:45:56 | 000,051,712 | ---- | C] (Microsoft) -- E:\Windows\System32\esrb.rs
[2013/01/09 11:45:56 | 000,023,552 | ---- | C] (Microsoft) -- E:\Windows\SysWow64\oflc.rs
[2013/01/09 11:45:56 | 000,023,552 | ---- | C] (Microsoft) -- E:\Windows\System32\oflc.rs
[2013/01/09 11:45:56 | 000,020,480 | ---- | C] (Microsoft) -- E:\Windows\SysWow64\pegi-fi.rs
[2013/01/09 11:45:56 | 000,020,480 | ---- | C] (Microsoft) -- E:\Windows\System32\pegi-fi.rs
[2013/01/09 11:45:35 | 000,424,448 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\KernelBase.dll
[2013/01/09 11:45:33 | 001,161,216 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\kernel32.dll
[2013/01/09 11:45:32 | 000,362,496 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\wow64win.dll
[2013/01/09 11:45:32 | 000,338,432 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\conhost.exe
[2013/01/09 11:45:32 | 000,243,200 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\wow64.dll
[2013/01/09 11:45:32 | 000,215,040 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\winsrv.dll
[2013/01/09 11:45:32 | 000,013,312 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\wow64cpu.dll
[2013/01/09 11:45:31 | 000,016,384 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\ntvdm64.dll
[2013/01/09 11:45:31 | 000,014,336 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\ntvdm64.dll
[2013/01/09 11:45:31 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\api-ms-win-core-file-l1-1-0.dll
[2013/01/09 11:45:31 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- E:\Windows\System32\api-ms-win-core-file-l1-1-0.dll
[2013/01/09 11:45:31 | 000,005,120 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\wow32.dll
[2013/01/09 11:45:31 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- E:\Windows\System32\api-ms-win-core-string-l1-1-0.dll
[2013/01/09 11:45:31 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\api-ms-win-core-errorhandling-l1-1-0.dll
[2013/01/09 11:45:31 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\api-ms-win-core-delayload-l1-1-0.dll
[2013/01/09 11:45:31 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- E:\Windows\System32\api-ms-win-core-delayload-l1-1-0.dll
[2013/01/09 11:45:30 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- E:\Windows\System32\api-ms-win-security-base-l1-1-0.dll
[2013/01/09 11:45:30 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- E:\Windows\System32\api-ms-win-core-threadpool-l1-1-0.dll
[2013/01/09 11:45:30 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\api-ms-win-core-processthreads-l1-1-0.dll
[2013/01/09 11:45:30 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\api-ms-win-core-sysinfo-l1-1-0.dll
[2013/01/09 11:45:30 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- E:\Windows\System32\api-ms-win-core-sysinfo-l1-1-0.dll
[2013/01/09 11:45:30 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\api-ms-win-core-synch-l1-1-0.dll
[2013/01/09 11:45:30 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- E:\Windows\System32\api-ms-win-core-synch-l1-1-0.dll
[2013/01/09 11:45:30 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- E:\Windows\System32\api-ms-win-core-rtlsupport-l1-1-0.dll
[2013/01/09 11:45:30 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- E:\Windows\System32\api-ms-win-core-xstate-l1-1-0.dll
[2013/01/09 11:45:30 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- E:\Windows\System32\api-ms-win-core-util-l1-1-0.dll
[2013/01/09 11:45:30 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\api-ms-win-core-string-l1-1-0.dll
[2013/01/09 11:45:30 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\api-ms-win-core-profile-l1-1-0.dll
[2013/01/09 11:45:30 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- E:\Windows\System32\api-ms-win-core-profile-l1-1-0.dll
[2013/01/09 11:45:29 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- E:\Windows\System32\api-ms-win-core-processthreads-l1-1-0.dll
[2013/01/09 11:45:29 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\api-ms-win-core-misc-l1-1-0.dll
[2013/01/09 11:45:29 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\api-ms-win-core-processenvironment-l1-1-0.dll
[2013/01/09 11:45:29 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- E:\Windows\System32\api-ms-win-core-processenvironment-l1-1-0.dll
[2013/01/09 11:45:29 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\api-ms-win-core-namedpipe-l1-1-0.dll
[2013/01/09 11:45:29 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- E:\Windows\System32\api-ms-win-core-namedpipe-l1-1-0.dll
[2013/01/09 11:45:29 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- E:\Windows\System32\api-ms-win-core-misc-l1-1-0.dll
[2013/01/09 11:45:29 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\api-ms-win-core-memory-l1-1-0.dll
[2013/01/09 11:45:29 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- E:\Windows\System32\api-ms-win-core-memory-l1-1-0.dll
[2013/01/09 11:45:28 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\api-ms-win-core-localregistry-l1-1-0.dll
[2013/01/09 11:45:28 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- E:\Windows\System32\api-ms-win-core-localregistry-l1-1-0.dll
[2013/01/09 11:45:28 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\api-ms-win-core-libraryloader-l1-1-0.dll
[2013/01/09 11:45:28 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- E:\Windows\System32\api-ms-win-core-libraryloader-l1-1-0.dll
[2013/01/09 11:45:28 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\api-ms-win-core-interlocked-l1-1-0.dll
[2013/01/09 11:45:28 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\api-ms-win-core-heap-l1-1-0.dll
[2013/01/09 11:45:28 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- E:\Windows\System32\api-ms-win-core-heap-l1-1-0.dll
[2013/01/09 11:45:28 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\api-ms-win-core-io-l1-1-0.dll
[2013/01/09 11:45:28 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- E:\Windows\System32\api-ms-win-core-io-l1-1-0.dll
[2013/01/09 11:45:28 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- E:\Windows\System32\api-ms-win-core-interlocked-l1-1-0.dll
[2013/01/09 11:45:28 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\api-ms-win-core-handle-l1-1-0.dll
[2013/01/09 11:45:28 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- E:\Windows\System32\api-ms-win-core-handle-l1-1-0.dll
[2013/01/09 11:45:28 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\api-ms-win-core-fibers-l1-1-0.dll
[2013/01/09 11:45:28 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- E:\Windows\System32\api-ms-win-core-fibers-l1-1-0.dll
[2013/01/09 11:45:28 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- E:\Windows\System32\api-ms-win-core-errorhandling-l1-1-0.dll
[2013/01/09 11:45:28 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\api-ms-win-core-debug-l1-1-0.dll
[2013/01/09 11:45:28 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- E:\Windows\System32\api-ms-win-core-debug-l1-1-0.dll
[2013/01/09 11:45:28 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\api-ms-win-core-datetime-l1-1-0.dll
[2013/01/09 11:45:28 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- E:\Windows\System32\api-ms-win-core-datetime-l1-1-0.dll
[2013/01/09 11:45:27 | 000,025,600 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\setup16.exe
[2013/01/09 11:45:27 | 000,007,680 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\instnm.exe
[2013/01/09 11:45:27 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll
[2013/01/09 11:45:27 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll
[2013/01/09 11:45:27 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\api-ms-win-core-localization-l1-1-0.dll
[2013/01/09 11:45:27 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- E:\Windows\System32\api-ms-win-core-localization-l1-1-0.dll
[2013/01/09 11:45:27 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll
[2013/01/09 11:45:27 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll
[2013/01/09 11:45:27 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\api-ms-win-core-rtlsupport-l1-1-0.dll
[2013/01/09 11:45:27 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\api-ms-win-core-console-l1-1-0.dll
[2013/01/09 11:45:27 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- E:\Windows\System32\api-ms-win-core-console-l1-1-0.dll
[2013/01/09 11:45:27 | 000,002,048 | ---- | C] (Microsoft Corporation) -- E:\Windows\SysWow64\user.exe
[2013/01/09 11:44:52 | 000,068,608 | ---- | C] (Microsoft Corporation) -- E:\Windows\System32\taskhost.exe
 
========== Files - Modified Within 30 Days ==========
 
[2013/01/29 01:15:06 | 000,067,584 | --S- | M] () -- E:\Windows\bootstat.dat
[2013/01/29 01:14:50 | 095,023,320 | ---- | M] () -- E:\ProgramData\dsgsdgdsgdsgw.pad
[2013/01/29 01:14:30 | 3061,223,424 | -HS- | M] () -- E:\hiberfil.sys
[2013/01/29 01:11:21 | 000,001,108 | ---- | M] () -- E:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013/01/29 01:10:28 | 000,003,304 | ---- | M] () -- E:\bootsqm.dat
[2013/01/24 04:14:31 | 000,654,150 | ---- | M] () -- E:\Windows\System32\perfh007.dat
[2013/01/24 04:14:31 | 000,616,032 | ---- | M] () -- E:\Windows\System32\perfh009.dat
[2013/01/24 04:14:31 | 000,130,022 | ---- | M] () -- E:\Windows\System32\perfc007.dat
[2013/01/24 04:14:31 | 000,106,412 | ---- | M] () -- E:\Windows\System32\perfc009.dat
[2013/01/24 03:24:12 | 000,001,112 | ---- | M] () -- E:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013/01/24 03:24:05 | 000,022,064 | -H-- | M] () -- E:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013/01/24 03:24:05 | 000,022,064 | -H-- | M] () -- E:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013/01/24 02:59:00 | 000,000,884 | ---- | M] () -- E:\Windows\tasks\Adobe Flash Player Updater.job
[2013/01/23 08:27:09 | 000,063,587 | ---- | M] () -- E:\Windows\unins000.dat
[2013/01/23 08:24:17 | 000,000,447 | ---- | M] () -- E:\user.js
[2013/01/23 08:22:01 | 000,001,852 | ---- | M] () -- E:\Users\Schacht\Desktop\Continue Converter Installation.lnk
[2013/01/23 08:22:00 | 000,721,397 | ---- | M] () -- E:\Windows\unins000.exe
[2013/01/13 11:20:12 | 000,002,181 | ---- | M] () -- E:\Users\Schacht\Desktop\Skat-Online V9.lnk
[2013/01/13 10:54:31 | 000,001,437 | ---- | M] () -- E:\Users\Schacht\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2013/01/12 07:37:39 | 000,002,283 | ---- | M] () -- E:\Users\Schacht\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2013/01/11 15:31:55 | 000,000,000 | ---D | M] -- E:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
[2013/01/10 11:43:34 | 000,416,312 | ---- | M] () -- E:\Windows\System32\FNTCACHE.DAT
[2013/01/09 12:32:21 | 000,697,864 | ---- | M] (Adobe Systems Incorporated) -- E:\Windows\SysWow64\FlashPlayerApp.exe
[2013/01/09 12:32:21 | 000,074,248 | ---- | M] (Adobe Systems Incorporated) -- E:\Windows\SysWow64\FlashPlayerCPLApp.cpl
 
========== Files Created - No Company Name ==========
 
[2013/01/29 01:10:28 | 000,003,304 | ---- | C] () -- E:\bootsqm.dat
[2013/01/23 08:27:52 | 095,023,320 | ---- | C] () -- E:\ProgramData\dsgsdgdsgdsgw.pad
[2013/01/23 08:27:09 | 000,721,397 | ---- | C] () -- E:\Windows\unins000.exe
[2013/01/23 08:27:09 | 000,063,587 | ---- | C] () -- E:\Windows\unins000.dat
[2013/01/23 08:24:16 | 000,000,447 | ---- | C] () -- E:\user.js
[2013/01/23 08:23:37 | 001,312,624 | ---- | C] () -- E:\Windows\System32\dmwu.exe
[2013/01/23 08:22:01 | 000,001,852 | ---- | C] () -- E:\Users\Schacht\Desktop\Continue Converter Installation.lnk
[2013/01/13 11:20:12 | 000,002,181 | ---- | C] () -- E:\Users\Schacht\Desktop\Skat-Online V9.lnk
[2012/07/03 09:49:33 | 004,503,728 | ---- | C] () -- E:\ProgramData\l_u0_0.pad
[2012/03/20 06:15:11 | 000,000,056 | ---- | C] () -- E:\Windows\molcho2009.ini
[2012/02/20 11:38:39 | 000,000,425 | ---- | C] () -- E:\Windows\BRWMARK.INI
[2012/02/20 11:38:39 | 000,000,027 | ---- | C] () -- E:\Windows\BRPP2KA.INI
[2011/11/15 08:36:35 | 000,000,400 | ---- | C] () -- E:\Windows\ODBC.INI
[2011/11/15 01:40:22 | 001,527,912 | ---- | C] () -- E:\Windows\SysWow64\PerfStringBackup.INI
[2010/11/28 23:21:32 | 000,128,204 | ---- | C] () -- E:\Windows\SysWow64\igcompkrng575.bin
[2010/11/28 23:21:30 | 000,867,020 | ---- | C] () -- E:\Windows\SysWow64\igkrng575.bin
[2010/11/28 23:21:30 | 000,105,408 | ---- | C] () -- E:\Windows\SysWow64\igfcg575m.bin
[2010/11/20 22:24:49 | 000,252,928 | ---- | C] () -- E:\Windows\SysWow64\DShowRdpFilter.dll
[2009/07/14 00:38:36 | 000,067,584 | --S- | C] () -- E:\Windows\bootstat.dat
[2009/07/13 21:35:51 | 000,000,741 | ---- | C] () -- E:\Windows\SysWow64\NOISE.DAT
[2009/07/13 21:34:42 | 000,215,943 | ---- | C] () -- E:\Windows\SysWow64\dssec.dat
[2009/07/13 19:10:29 | 000,043,131 | ---- | C] () -- E:\Windows\mib.bin
[2009/07/13 18:42:10 | 000,064,000 | ---- | C] () -- E:\Windows\SysWow64\BWContextHandler.dll
[2009/07/13 17:25:04 | 000,197,632 | ---- | C] () -- E:\Windows\SysWow64\ir32_32.dll
[2009/07/13 16:03:59 | 000,364,544 | ---- | C] () -- E:\Windows\SysWow64\msjetoledb40.dll
[2009/06/10 16:26:10 | 000,673,088 | ---- | C] () -- E:\Windows\SysWow64\mlang.dat
 
========== LOP Check ==========
 
[2011/11/15 01:29:08 | 000,000,000 | -HSD | M] -- E:\ProgramData\Anwendungsdaten
[2009/07/14 00:08:56 | 000,000,000 | -HSD | M] -- E:\ProgramData\Application Data
[2009/07/14 00:08:56 | 000,000,000 | -HSD | M] -- E:\ProgramData\Desktop
[2009/07/14 00:08:56 | 000,000,000 | -HSD | M] -- E:\ProgramData\Documents
[2011/11/15 01:29:08 | 000,000,000 | -HSD | M] -- E:\ProgramData\Dokumente
[2011/11/15 01:29:08 | 000,000,000 | -HSD | M] -- E:\ProgramData\Favoriten
[2009/07/14 00:08:56 | 000,000,000 | -HSD | M] -- E:\ProgramData\Favorites
[2012/03/17 05:47:18 | 000,000,000 | ---D | M] -- E:\ProgramData\Sony
[2009/07/14 00:08:56 | 000,000,000 | -HSD | M] -- E:\ProgramData\Start Menu
[2011/11/15 01:29:08 | 000,000,000 | -HSD | M] -- E:\ProgramData\Startmenü
[2009/07/14 00:08:56 | 000,000,000 | -HSD | M] -- E:\ProgramData\Templates
[2011/11/15 01:29:08 | 000,000,000 | -HSD | M] -- E:\ProgramData\Vorlagen
[2012/12/27 08:54:12 | 000,032,640 | ---- | M] () -- E:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
< End of report >

markusg 31.01.2013 13:47
auf deinem zweiten pc gehe auf start, programme zubehör editor, kopiere dort
rein:
Code:
:OTL
O20:64bit: - HKLM Winlogon: Shell - (C:\PROGRA~3\dsgsdgdsgdsgw.bat) -  File not found
O20 - HKLM Winlogon: Shell - (C:\PROGRA~3\dsgsdgdsgdsgw.bat) -  File not found
:Files
:Commands
[EMPTYFLASH]
[emptytemp]


dieses speicherst du auf nem usb stick als fix.txt
nutze nun wieder OTLPENet.exe (starte also von der erstellten cd) und hake alles an, wie es bereits im post zu OTLPENet.exe beschrieben ist.
• Klicke nun bitte auf den Fix Button.
es sollte nun eine meldung ähnlich dieser: "load fix from file" erscheinen, lade also die fix.txt von deinem stick.
wenn dies nicht funktioniert, bitte den fix manuell eintragen.
dann klicke erneut den fix buton. pc startet evtl. neu. wenn ja, nimm die cd aus dem laufwerk, windows sollte nun normal starten und die otl.txt öffnen,
log posten bitte.


Alle Zeitangaben in WEZ +1. Es ist jetzt 14:26 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131