Trojaner-Board
Seite 1 von 3 1 23
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   SystemTool 2011 - und nun? (https://www.trojaner-board.de/94619-systemtool-2011-a.html)

supidupi 09.01.2011 18:26
SystemTool 2011 - und nun?
 
Hallo,

ich bin schon ganz verzweifelt. Mein Sohn kam heute aus den USA zurück und erzählte mir, an dem PC seines Vaters war so ein komischer Virus und nichts ging mehr.
Dann dauerte es 1 Stunde, und er kam zu mir - mit seinem Lappi - und zeigte mir, "genau so sah es bei Papa auch aus". Nichts ging mehr.

Ich habe dann mit meinem PC recherchiert und gefunden, dass es sich um Malware handelt. Verschiedene Freeware Programme habe ich probiert - aber keiner erkennt es. Wenn es einer erkennt - muss man das Programm kaufen. Ein Schlem, wer sich dabei denkt, dass die beiden Firmen zusammenarbeiten:rolleyes:.

Die manuelle Entfernung, wie sie oft im Web erwähnt wird, traue ich mir nicht zu. Ich bin noch im abgesicherten Modus.

Er vermutet übrigens, dass auf dem Chip aus der Kamera seines Vaters etwas drauf gewesen sein muss - denn er hatte hier noch nichts installiert oder so - nur den Chip in den Slot gesteckt, wie bei seinem Vater auch.

Kann mir jemand sagen, was ich genau machen muss, um den Mist wieder runterzubekommen?

Danke.

markusg 09.01.2011 18:50
du bist im abgesicherten modus? bleib gleich dort.
Systemscan mit OTL
download otl:
http://filepony.de/download-otl/

Doppelklick auf die OTL.exe
(user von Windows 7 und Vista: Rechtsklick als Administrator ausführen)
1. Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
2. Hake an "scan all users"
3. Unter "Extra Registry wähle:
"Use Safelist" "LOP Check" "Purity Check"
4. Kopiere in die Textbox:
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
explorer.exe
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT
5. Klicke "Scan"
6. 2 reporte werden erstellt:
OTL.Txt
Extras.Txt
beide posten.

supidupi 09.01.2011 19:24
OK, gemacht. Also:

OTL.TxTOTL Logfile:
Code:
OTL logfile created on: 09.01.2011 19:10:51 - Run 1
OTL by OldTimer - Version 3.2.20.1    Folder = C:\Users\Brandon\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6002.18005)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 82,00% Memory free
6,00 Gb Paging File | 5,00 Gb Available in Paging File | 95,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 192,06 Gb Total Space | 154,81 Gb Free Space | 80,61% Space Free | Partition Type: NTFS
Drive D: | 97,03 Gb Total Space | 44,98 Gb Free Space | 46,36% Space Free | Partition Type: NTFS
 
Computer Name: BRANDON-PC | User Name: Brandon | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Brandon\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Programme\Microsoft Office\Office12\OUTLOOK.EXE (Microsoft Corporation)
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Users\Brandon\Downloads\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (sp_rssrv) -- C:\Program Files\Spyware Terminator\sp_rsser.exe (Crawler.com)
SRV - (AVKService) -- C:\Program Files\G Data\AntiVirus\AVK\AVKService.exe (G Data Software AG)
SRV - (AVKProxy) -- C:\Program Files\Common Files\G Data\AVKProxy\AVKProxy.exe (G Data Software AG)
SRV - (AVKWCtl) -- C:\Program Files\G Data\AntiVirus\AVK\AVKWCtl.exe ()
SRV - (GDScan) -- C:\Program Files\Common Files\G Data\GDScan\GDScan.exe (G Data Software AG)
SRV - (FontCache) -- C:\Windows\System32\FntCache.dll (Microsoft Corporation)
SRV - (TestHandler) -- C:\Program Files\Fujitsu Siemens Computers\SystemDiagnostics\OnlineDiagnostic\TestManager\TestHandler.exe (Fujitsu Siemens Computers)
SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (WisLMSvc) -- C:\Program Files\Launch Manager\WisLMSvc.exe (Wistron Corp.)
SRV - (GoogleDesktopManager-022208-143751) -- C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (Google)
SRV - (FSCLBaseUpdaterService) -- C:\Program Files\Fujitsu Siemens Computers\FSCLounge\FSCWBaseUpdaterService\2\FSCWBaseUpdaterService.exe ()
 
 
========== Driver Services (SafeList) ==========
 
DRV - (NwlnkFwd) -- C:\Windows\System32\DRIVERS\nwlnkfwd.sys File not found
DRV - (NwlnkFlt) -- C:\Windows\System32\DRIVERS\nwlnkflt.sys File not found
DRV - (IpInIp) -- C:\Windows\System32\DRIVERS\ipinip.sys File not found
DRV - (GRD) -- C:\Windows\System32\drivers\GRD.sys (G Data Software)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\Windows\System32\drivers\RTKVHDA.sys (Realtek Semiconductor Corp.)
DRV - (atikmdag) -- C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (ahcix86s) -- C:\Windows\system32\drivers\ahcix86s.sys (AMD Technologies Inc.)
DRV - (AtiPcie) ATI PCI Express (3GIO) -- C:\Windows\system32\DRIVERS\AtiPcie.sys (ATI Technologies Inc.)
DRV - (JMCR) -- C:\Windows\System32\drivers\jmcr.sys (JMicron Technology Corp.)
DRV - (JRAID) -- C:\Windows\system32\drivers\jraid.sys (JMicron Technology Corp.)
DRV - (athr) -- C:\Windows\System32\drivers\athr.sys (Atheros Communications, Inc.)
DRV - (RTL8169) -- C:\Windows\System32\drivers\Rtlh86.sys (Realtek Corporation                                            )
DRV - (MegaSR) -- C:\Windows\system32\drivers\megasr.sys (LSI Corporation, Inc.)
DRV - (adpu320) -- C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.)
DRV - (megasas) -- C:\Windows\system32\drivers\megasas.sys (LSI Corporation)
DRV - (adpu160m) -- C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.)
DRV - (SiSRaid4) -- C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems)
DRV - (HpCISSs) -- C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company)
DRV - (adpahci) -- C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.)
DRV - (LSI_SAS) -- C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic)
DRV - (ql2300) -- C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation)
DRV - (E1G60) Intel(R) -- C:\Windows\System32\drivers\E1G60I32.sys (Intel Corporation)
DRV - (arcsas) -- C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.)
DRV - (iaStorV) -- C:\Windows\system32\drivers\iastorv.sys (Intel Corporation)
DRV - (vsmraid) -- C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (ulsata2) -- C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.)
DRV - (LSI_SCSI) -- C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic)
DRV - (LSI_FC) -- C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic)
DRV - (arc) -- C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.)
DRV - (elxstor) -- C:\Windows\system32\drivers\elxstor.sys (Emulex)
DRV - (adp94xx) -- C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.)
DRV - (nvraid) -- C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation)
DRV - (nvstor) -- C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation)
DRV - (uliahci) -- C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.)
DRV - (viaide) -- C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.)
DRV - (cmdide) -- C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.)
DRV - (aliide) -- C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.)
DRV - (GDMnIcpt) -- C:\Windows\System32\drivers\MiniIcpt.sys (G Data Software AG)
DRV - (HookCentre) -- C:\Windows\System32\drivers\HookCentre.sys (G Data Software AG)
DRV - (GDBehave) -- C:\Windows\system32\drivers\GDBehave.sys (G Data Software AG)
DRV - (gdwfpcd) -- C:\Windows\System32\drivers\gdwfpcd32.sys (G DATA Software AG)
DRV - (iaStor) -- C:\Windows\system32\drivers\iastor.sys (Intel Corporation)
DRV - (SynTP) -- C:\Windows\System32\drivers\SynTP.sys (Synaptics, Inc.)
DRV - (ql40xx) -- C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation)
DRV - (UlSata) -- C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.)
DRV - (nfrd960) -- C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation)
DRV - (iirsp) -- C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (aic78xx) -- C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.)
DRV - (iteraid) -- C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.)
DRV - (iteatapi) -- C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.)
DRV - (Symc8xx) -- C:\Windows\system32\drivers\symc8xx.sys (LSI Logic)
DRV - (Sym_u3) -- C:\Windows\system32\drivers\sym_u3.sys (LSI Logic)
DRV - (Mraid35x) -- C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation)
DRV - (Sym_hi) -- C:\Windows\system32\drivers\sym_hi.sys (LSI Logic)
DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) -- C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.)
DRV - (BrUsbSer) -- C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.)
DRV - (BrFiltUp) -- C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.)
DRV - (BrFiltLo) -- C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.)
DRV - (BrSerWdm) -- C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.)
DRV - (BrUsbMdm) -- C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.)
DRV - (ntrigdigi) -- C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies)
DRV - (Hotkey) -- C:\Windows\System32\drivers\HOTKEY.sys ()
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=FUJD&bmod=FUJD
 
 
IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=FUJD&bmod=FUJD
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=FUJD&bmod=FUJD
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-4048956899-1286244931-2967521482-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=FUJD&bmod=FUJD
IE - HKU\S-1-5-21-4048956899-1286244931-2967521482-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-4048956899-1286244931-2967521482-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:5.0.0.6906
 
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2008.01.12 20:05:09 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2008.01.12 21:13:26 | 000,000,000 | ---D | M]
 
[2008.01.12 20:05:30 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Brandon\AppData\Roaming\mozilla\Extensions
[2008.01.12 20:05:30 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Brandon\AppData\Roaming\mozilla\Firefox\Profiles\wb3p44e5.default\extensions
[2011.01.09 10:54:43 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2011.01.09 10:54:43 | 000,000,000 | ---D | M] (Skype extension) -- C:\Programme\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2011.01.09 10:54:43 | 000,000,000 | ---D | M] (Skype extension) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{AB2CE124-6272-4B12-94A9-7303C7397BD1}
[2010.12.03 19:14:08 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2010.12.03 19:14:08 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml
[2010.12.03 19:14:08 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2010.12.03 19:14:08 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2010.12.03 19:14:08 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2006.09.18 22:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: ::1            localhost
O2 - BHO: (G Data WebFilter) - {0124123D-61B4-456f-AF86-78C53A0790C5} - C:\Programme\G Data\AntiVirus\Webfilter\AvkWebIE.dll (G Data Software AG)
O2 - BHO: (Skype Plug-In) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O3 - HKLM\..\Toolbar: (G Data WebFilter) - {0124123D-61B4-456f-AF86-78C53A0790C5} - C:\Programme\G Data\AntiVirus\Webfilter\AvkWebIE.dll (G Data Software AG)
O4 - HKLM..\Run: [FSCRecovery] c:\Programme\Fujitsu Siemens Computers\Fujitsu Siemens Computers Recovery\FSCRecoveryReminder.exe (Fujitsu Siemens Computers GmbH)
O4 - HKLM..\Run: [G Data AntiVirus Tray Application] C:\Programme\G Data\AntiVirus\AVKTray\AVKTray.exe (G Data Software AG)
O4 - HKLM..\Run: [Google Desktop Search] C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (Google)
O4 - HKLM..\Run: [Google EULA Launcher] c:\Program Files\Google\Google EULA\GoogleEULALauncher.exe ( )
O4 - HKLM..\Run: [HotkeyApp] C:\Program Files\Launch Manager\HotkeyApp.exe (Wistron)
O4 - HKLM..\Run: [LanguageShortcut] C:\Program Files\CyberLink\PowerDVD\Language\Language.exe ()
O4 - HKLM..\Run: [LMgrOSD] C:\Program Files\Launch Manager\OSDCtrl.exe ()
O4 - HKLM..\Run: [LMgrVolOSD] C:\Program Files\Launch Manager\OSD.exe (Wistron Corp.)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [Skytel] C:\Windows\SkyTel.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [StartCCC] c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [SynTPStart] C:\Programme\Synaptics\SynTP\SynTPStart.exe (Synaptics, Inc.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKLM..\Run: [WisKeyState] C:\Program Files\Launch Manager\WisKeyState.exe (Wistron Corp.)
O4 - HKU\.DEFAULT..\Run: [fsc-reg] c:\fsc-reg\fscreg.exe File not found
O4 - HKU\.DEFAULT..\Run: [Picasa Media Detector] C:\Programme\Picasa2\PicasaMediaDetector.exe (Google Inc.)
O4 - HKU\S-1-5-18..\Run: [fsc-reg] c:\fsc-reg\fscreg.exe File not found
O4 - HKU\S-1-5-18..\Run: [Picasa Media Detector] C:\Programme\Picasa2\PicasaMediaDetector.exe (Google Inc.)
O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-21-4048956899-1286244931-2967521482-1000..\Run: [Picasa Media Detector] C:\Programme\Picasa2\PicasaMediaDetector.exe (Google Inc.)
O4 - HKU\S-1-5-21-4048956899-1286244931-2967521482-1000..\Run: [SpywareTerminatorUpdate] C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe (Crawler.com)
O4 - HKU\S-1-5-21-4048956899-1286244931-2967521482-1000..\RunOnce: [eFjBp01804] C:\ProgramData\eFjBp01804\eFjBp01804.exe ()
O7 - HKU\S-1-5-21-4048956899-1286244931-2967521482-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O13 - gopher Prefix: missing
O15 - HKU\S-1-5-21-4048956899-1286244931-2967521482-1000\..Trusted Ranges: GD ([http] in Local intranet)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL) - C:\Programme\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Brandon\Pictures\Fledermaus.jpg
O24 - Desktop BackupWallPaper: C:\Users\Brandon\Pictures\Fledermaus.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias -  File not found
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
 
SafeBootMin: AppMgmt - Service
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: NTDS -  File not found
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet: AppMgmt - Service
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger -  File not found
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: NTDS -  File not found
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootNet: WudfPf - Driver
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} -
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} -
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
 
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
 
%SYSTEMROOT%\SYSTEM32\*.DLL /LOCKEDFILES CREATERESTOREPOINT
Error creating restore point.
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.01.09 17:44:38 | 000,000,000 | ---D | C] -- C:\Users\Brandon\AppData\Roaming\Spyware Terminator
[2011.01.09 17:44:34 | 000,000,000 | ---D | C] -- C:\Programme\Spyware Terminator
[2011.01.09 17:44:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Spyware Terminator
[2011.01.09 17:44:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spyware Terminator
[2011.01.09 17:29:15 | 000,000,000 | ---D | C] -- C:\ProgramData\TEMP
[2011.01.09 16:46:39 | 000,000,000 | ---D | C] -- C:\ProgramData\WindowsSearch
[2011.01.09 16:38:50 | 000,000,000 | ---D | C] -- C:\Users\Brandon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tool
[2011.01.09 16:29:19 | 000,000,000 | ---D | C] -- C:\ProgramData\eFjBp01804
[2011.01.09 15:58:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Blizzard Entertainment
[2011.01.09 15:45:24 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\Blizzard Entertainment
[2011.01.09 10:56:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
[2011.01.09 10:56:03 | 000,000,000 | ---D | C] -- C:\Users\Brandon\AppData\Roaming\skypePM
[2011.01.09 10:54:17 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\Skype
[2011.01.09 10:54:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2011.01.09 10:54:16 | 000,000,000 | R--D | C] -- C:\Programme\Skype
[2011.01.09 10:54:15 | 000,000,000 | ---D | C] -- C:\Users\Brandon\AppData\Roaming\Skype
[2011.01.09 10:54:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Skype
[2011.01.09 09:14:36 | 000,000,000 | ---D | C] -- C:\Users\Brandon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink PowerDVD
[2011.01.09 09:09:04 | 000,000,000 | ---D | C] -- C:\Programme\Windows Portable Devices
[2010.12.26 18:13:51 | 000,092,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\UIAnimation.dll
[2010.12.26 18:13:50 | 003,023,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\UIRibbon.dll
[2010.12.26 18:13:50 | 001,164,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\UIRibbonRes.dll
[2010.12.26 18:12:33 | 000,829,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10warp.dll
[2010.12.26 18:12:33 | 000,369,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WMPhoto.dll
[2010.12.26 18:12:33 | 000,037,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\cdd.dll
[2010.12.26 18:12:33 | 000,026,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\printfilterpipelineprxy.dll
[2010.12.26 18:12:32 | 001,554,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xpsservices.dll
[2010.12.26 18:12:32 | 001,064,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\DWrite.dll
[2010.12.26 18:12:32 | 001,030,144 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10.dll
[2010.12.26 18:12:32 | 000,974,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WindowsCodecs.dll
[2010.12.26 18:12:32 | 000,847,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\OpcServices.dll
[2010.12.26 18:12:32 | 000,828,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d2d1.dll
[2010.12.26 18:12:32 | 000,793,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\FntCache.dll
[2010.12.26 18:12:32 | 000,667,648 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\printfilterpipelinesvc.exe
[2010.12.26 18:12:32 | 000,519,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d11.dll
[2010.12.26 18:12:32 | 000,486,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10level9.dll
[2010.12.26 18:12:32 | 000,481,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dxgi.dll
[2010.12.26 18:12:32 | 000,351,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XpsPrint.dll
[2010.12.26 18:12:32 | 000,321,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PhotoMetadataHandler.dll
[2010.12.26 18:12:32 | 000,280,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XpsGdiConverter.dll
[2010.12.26 18:12:32 | 000,252,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dxdiag.exe
[2010.12.26 18:12:32 | 000,218,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10_1core.dll
[2010.12.26 18:12:32 | 000,195,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dxdiagn.dll
[2010.12.26 18:12:32 | 000,190,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10core.dll
[2010.12.26 18:12:32 | 000,189,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WindowsCodecsExt.dll
[2010.12.26 18:12:32 | 000,161,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10_1.dll
[2010.12.26 18:12:32 | 000,135,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XpsRasterService.dll
[2010.12.26 18:11:24 | 000,031,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\BthMtpContextHandler.dll
[2010.12.26 18:11:24 | 000,030,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WPDShextAutoplay.exe
[2010.12.26 18:11:23 | 000,060,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PortableDeviceConnectApi.dll
[2010.12.26 18:11:22 | 000,546,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wpd_ci.dll
[2010.12.26 18:11:22 | 000,334,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PortableDeviceApi.dll
[2010.12.26 18:11:22 | 000,160,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PortableDeviceTypes.dll
[2010.12.26 18:11:22 | 000,100,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PortableDeviceClassExtension.dll
[2010.12.26 18:11:21 | 000,350,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WPDSp.dll
[2010.12.26 18:11:21 | 000,196,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PortableDeviceWMDRM.dll
[2010.12.26 18:09:11 | 000,555,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\UIAutomationCore.dll
[2010.12.26 18:09:11 | 000,004,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\oleaccrc.dll
[2010.12.26 17:50:09 | 000,295,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PresentationHost.exe
[2010.12.26 17:50:09 | 000,099,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PresentationHostProxy.dll
[2010.12.26 17:50:09 | 000,049,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\netfxperf.dll
[2010.12.26 17:48:38 | 000,293,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\browserchoice.exe
[2010.12.26 17:30:46 | 000,024,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\nshhttp.dll
[2010.12.26 17:30:45 | 000,030,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\httpapi.dll
[2010.12.26 17:29:33 | 000,000,000 | ---D | C] -- C:\Programme\MSXML 4.0
[2010.12.26 16:22:57 | 008,147,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wmploc.DLL
[2010.12.26 16:22:34 | 000,105,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\netiohlp.dll
[2010.12.26 16:22:33 | 000,027,136 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\NETSTAT.EXE
[2010.12.26 16:22:33 | 000,019,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ARP.EXE
[2010.12.26 16:22:33 | 000,017,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ROUTE.EXE
[2010.12.26 16:22:33 | 000,017,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\netevent.dll
[2010.12.26 16:22:33 | 000,011,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MRINFO.EXE
[2010.12.26 16:22:33 | 000,010,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\finger.exe
[2010.12.26 16:22:33 | 000,008,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\HOSTNAME.EXE
[2010.12.26 16:22:20 | 000,302,592 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wlansec.dll
[2010.12.26 16:22:20 | 000,293,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wlanmsm.dll
[2010.12.26 16:22:20 | 000,127,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\L2SecHC.dll
[2010.12.26 16:22:19 | 000,065,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wlanapi.dll
[2010.12.26 16:22:11 | 000,081,920 | ---- | C] (Radius Inc.) -- C:\Windows\System32\iccvid.dll
[2010.12.26 16:22:06 | 002,386,944 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WMVCORE.DLL
[2010.12.26 16:22:05 | 002,868,224 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mf.dll
[2010.12.26 16:22:04 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\asycfilt.dll
[2010.12.26 16:22:03 | 000,430,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\vbscript.dll
[2010.12.26 16:21:48 | 002,038,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2010.12.26 16:21:45 | 000,157,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\t2embed.dll
[2010.12.26 16:21:39 | 000,714,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\timedate.cpl
[2010.12.26 16:21:36 | 001,696,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\gameux.dll
[2010.12.26 16:21:34 | 004,240,384 | ---- | C] (Microsoft) -- C:\Windows\System32\GameUXLegacyGDFs.dll
[2010.12.26 16:21:34 | 000,028,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\Apphlpdm.dll
[2010.12.26 16:21:32 | 000,317,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MP4SDECD.DLL
[2010.12.26 16:21:31 | 000,623,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\localspl.dll
[2010.12.26 16:21:29 | 000,954,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfc40.dll
[2010.12.26 16:21:29 | 000,954,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfc40u.dll
[2010.12.26 16:21:27 | 000,036,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rtutils.dll
[2010.12.26 16:21:16 | 001,259,008 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\lsasrv.dll
[2010.12.26 16:21:12 | 003,600,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntkrnlpa.exe
[2010.12.26 16:21:12 | 003,548,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntoskrnl.exe
[2010.12.26 16:21:10 | 000,867,328 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wmpmde.dll
[2010.12.26 16:21:09 | 000,220,672 | ---- | C] (Fraunhofer Institut Integrierte Schaltungen IIS) -- C:\Windows\System32\l3codecp.acm
[2010.12.26 16:21:09 | 000,062,464 | ---- | C] (Fraunhofer Institut Integrierte Schaltungen IIS) -- C:\Windows\System32\l3codeca.acm
[2010.12.26 16:21:06 | 000,512,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript.dll
[2010.12.26 16:21:01 | 000,352,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\taskschd.dll
[2010.12.26 16:21:00 | 000,345,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wmicmiplugin.dll
[2010.12.26 16:20:59 | 000,270,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\taskcomp.dll
[2010.12.26 16:20:57 | 000,081,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\consent.exe
[2010.12.26 16:20:55 | 000,292,352 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\System32\atmfd.dll
[2010.12.26 16:20:55 | 000,072,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\fontsub.dll
[2010.12.26 16:20:55 | 000,034,304 | ---- | C] (Adobe Systems) -- C:\Windows\System32\atmlib.dll
[2010.12.26 16:20:55 | 000,010,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dciman32.dll
[2010.12.26 16:20:52 | 002,452,872 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieapfltr.dat
[2010.12.26 16:20:48 | 000,671,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mstime.dll
[2010.12.26 16:20:48 | 000,471,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll
[2010.12.26 16:20:47 | 000,389,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\html.iec
[2010.12.26 16:20:47 | 000,193,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll
[2010.12.26 16:20:47 | 000,180,736 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2010.12.26 16:20:47 | 000,078,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieencode.dll
[2010.12.26 16:20:46 | 000,380,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieapfltr.dll
[2010.12.26 16:20:40 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\tzres.dll
[2010.12.26 16:20:14 | 000,043,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msdxm.tlb
[2010.12.26 16:20:14 | 000,018,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\amcompat.tlb
[2010.12.26 16:20:11 | 000,471,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\secproc_isv.dll
[2010.12.26 16:20:11 | 000,471,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\secproc.dll
[2010.12.26 16:20:10 | 000,526,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\RMActivate_isv.exe
[2010.12.26 16:20:10 | 000,347,136 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\RMActivate_ssp.exe
[2010.12.26 16:20:10 | 000,346,624 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\RMActivate_ssp_isv.exe
[2010.12.26 16:20:09 | 000,518,144 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\RMActivate.exe
[2010.12.26 16:20:09 | 000,332,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msdrm.dll
[2010.12.26 16:20:09 | 000,152,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\secproc_ssp_isv.dll
[2010.12.26 16:20:09 | 000,152,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\secproc_ssp.dll
[2010.12.26 16:19:50 | 000,243,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rastls.dll
[2010.12.26 16:19:48 | 000,355,328 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WSDApi.dll
[2010.12.26 16:19:22 | 000,231,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msshsq.dll
[2010.12.26 16:19:20 | 001,314,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\quartz.dll
[2010.12.26 16:19:19 | 000,123,904 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msvfw32.dll
[2010.12.26 16:19:19 | 000,091,136 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\avifil32.dll
[2010.12.26 16:19:19 | 000,082,944 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mciavi32.dll
[2010.12.26 16:19:17 | 000,604,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WMSPDMOD.DLL
[2010.12.26 16:19:06 | 000,310,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\unregmp2.exe
[2010.12.26 16:19:05 | 000,007,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\spwmp.dll
[2010.12.26 16:19:05 | 000,004,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msdxm.ocx
[2010.12.26 16:19:05 | 000,004,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dxmasf.dll
[2010.12.26 15:50:06 | 000,222,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MpSigStub.exe
[2010.12.26 15:48:35 | 000,000,000 | ---D | C] -- C:\Users\Brandon\AppData\Roaming\Macromedia
[2010.12.25 22:09:21 | 000,029,992 | ---- | C] (G Data Software) -- C:\Windows\System32\drivers\GRD.sys
[2010.12.25 21:55:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\IZArc
[2010.12.25 21:54:56 | 000,000,000 | ---D | C] -- C:\Programme\IZArc
 
========== Files - Modified Within 30 Days ==========
 
[2011.01.09 19:05:43 | 000,620,966 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2011.01.09 19:05:43 | 000,589,472 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011.01.09 19:05:43 | 000,123,268 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2011.01.09 19:05:43 | 000,101,484 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011.01.09 18:42:37 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011.01.09 18:40:45 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011.01.09 18:40:40 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011.01.09 18:40:40 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011.01.09 17:44:46 | 000,000,925 | ---- | M] () -- C:\Users\Public\Desktop\Spyware Terminator.lnk
[2011.01.09 17:44:39 | 000,142,592 | ---- | M] () -- C:\Windows\System32\drivers\sp_rsdrv2.sys
[2011.01.09 17:02:59 | 000,001,098 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011.01.09 16:38:50 | 000,000,772 | ---- | M] () -- C:\Users\Brandon\Desktop\System Tool 2011.lnk
[2011.01.09 14:36:02 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_07_00.Wdf
[2011.01.09 10:56:46 | 000,001,977 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk
[2011.01.09 10:56:12 | 000,000,056 | -H-- | M] () -- C:\ProgramData\ezsidmv.dat
[2011.01.09 10:54:17 | 000,001,880 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk
[2011.01.09 09:12:36 | 000,380,136 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2010.12.26 16:27:05 | 000,029,992 | ---- | M] (G Data Software) -- C:\Windows\System32\drivers\GRD.sys
[2010.12.25 22:08:23 | 000,002,631 | ---- | M] () -- C:\Users\Brandon\Desktop\Microsoft Office Word 2007.lnk
[2010.12.25 21:56:48 | 000,002,735 | ---- | M] () -- C:\Users\Brandon\Desktop\Microsoft Office Outlook 2007.lnk
 
========== Files Created - No Company Name ==========
 
[2011.01.09 17:44:46 | 000,000,925 | ---- | C] () -- C:\Users\Public\Desktop\Spyware Terminator.lnk
[2011.01.09 17:44:39 | 000,142,592 | ---- | C] () -- C:\Windows\System32\drivers\sp_rsdrv2.sys
[2011.01.09 16:38:48 | 000,000,772 | ---- | C] () -- C:\Users\Brandon\Desktop\System Tool 2011.lnk
[2011.01.09 14:36:02 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_07_00.Wdf
[2011.01.09 10:56:46 | 000,001,977 | ---- | C] () -- C:\Users\Public\Desktop\Google Chrome.lnk
[2011.01.09 10:56:12 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2011.01.09 10:55:46 | 000,001,098 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011.01.09 10:55:45 | 000,001,094 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011.01.09 10:54:17 | 000,001,880 | ---- | C] () -- C:\Users\Public\Desktop\Skype.lnk
[2010.12.26 16:22:19 | 002,501,921 | ---- | C] () -- C:\Windows\System32\wlan.tmf
[2008.10.22 13:02:51 | 000,009,867 | ---- | C] () -- C:\Windows\System32\drivers\HOTKEY.sys
[2008.10.22 13:01:42 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll
[2008.10.22 12:53:31 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll
[2008.04.25 14:23:38 | 000,012,288 | ---- | C] () -- C:\Windows\System32\EvOnlDiag.dll
[2008.01.12 20:27:13 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2008.01.12 19:30:48 | 000,000,342 | ---- | C] () -- C:\Windows\{9A3BC157-B94F-4EFD-ABA9-1E56DEB00655}_WiseFW.ini
[2006.11.02 13:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006.11.02 08:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
 
========== LOP Check ==========
 
[2011.01.09 17:46:25 | 000,000,000 | ---D | M] -- C:\Users\Brandon\AppData\Roaming\Spyware Terminator
[2011.01.09 18:39:16 | 000,009,658 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s %APPDATA%\*. >
 
< %APPDATA%\*.exe /s >
[2008.01.12 19:30:53 | 000,008,704 | R--- | M] () -- C:\Users\Brandon\AppData\Roaming\Microsoft\Installer\{9A3BC157-B94F-4EFD-ABA9-1E56DEB00655}\Icon9A3BC1573.exe
 
< %SYSTEMDRIVE%\*.exe >
 
 
< MD5 for: AGP440.SYS  >
[2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\drivers\AGP440.sys
[2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_51b95d75\AGP440.sys
[2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys
[2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys
[2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_bbfe6647bbd2a4c6\AGP440.sys
[2006.11.02 10:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys
 
< MD5 for: AHCIX86S.SYS  >
[2008.05.27 12:55:54 | 000,173,576 | ---- | M] (AMD Technologies Inc.) MD5=FBE4016F9EF3AB3DB547E40A936B6CD9 -- C:\DRIVER\SATA\AMD\ahcix86s.sys
[2008.05.27 12:55:54 | 000,173,576 | ---- | M] (AMD Technologies Inc.) MD5=FBE4016F9EF3AB3DB547E40A936B6CD9 -- C:\Windows\System32\drivers\ahcix86s.sys
[2008.05.27 12:55:54 | 000,173,576 | ---- | M] (AMD Technologies Inc.) MD5=FBE4016F9EF3AB3DB547E40A936B6CD9 -- C:\Windows\System32\DriverStore\FileRepository\ahcix86s.inf_c617648e\ahcix86s.sys
 
< MD5 for: ATAPI.SYS  >
[2009.04.10 23:32:28 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_b12d8e84\atapi.sys
[2009.04.10 23:32:28 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys
[2008.01.21 03:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\drivers\atapi.sys
[2008.01.21 03:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys
[2008.01.21 03:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys
[2006.11.02 10:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys
[2008.08.16 13:03:39 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=66A1A71D66C5235A31C16F30147E7AF6 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_181d523c\atapi.sys
[2008.08.16 13:03:39 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=66A1A71D66C5235A31C16F30147E7AF6 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.22245_none_dd9b888d3ac35a04\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll
[2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll
 
< MD5 for: EXPLORER.EXE  >
[2009.04.10 23:27:38 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\explorer.exe
[2009.04.10 23:27:38 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_53a0201e76de3a0b\explorer.exe
[2008.01.21 03:24:24 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=FFA764631CB70A30065C12EF8E174F9F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_51b4a71279bc6ebf\explorer.exe
 
< MD5 for: IASTOR.SYS  >
[2007.09.29 23:03:12 | 000,308,248 | ---- | M] (Intel Corporation) MD5=E5A0034847537EAEE3C00349D5C34C5F -- C:\Windows\System32\drivers\iaStor.sys
[2007.09.29 23:03:12 | 000,308,248 | ---- | M] (Intel Corporation) MD5=E5A0034847537EAEE3C00349D5C34C5F -- C:\Windows\System32\DriverStore\FileRepository\iaahci.inf_7baf6192\iaStor.sys
[2007.09.29 23:03:12 | 000,308,248 | ---- | M] (Intel Corporation) MD5=E5A0034847537EAEE3C00349D5C34C5F -- C:\Windows\System32\DriverStore\FileRepository\iastor.inf_41af7b1f\iaStor.sys
 
< MD5 for: IASTORV.SYS  >
[2008.01.21 03:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\drivers\iaStorV.sys
[2008.01.21 03:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_c9df7691\iaStorV.sys
[2008.01.21 03:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys
[2006.11.02 10:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2009.04.10 23:28:24 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\System32\netlogon.dll
[2009.04.10 23:28:24 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_ffa3304f351bb3a3\netlogon.dll
[2008.01.21 03:24:05 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2006.11.02 10:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys
[2008.01.21 03:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\drivers\nvstor.sys
[2008.01.21 03:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys
[2008.01.21 03:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2008.01.21 03:24:50 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll
[2009.04.10 23:28:26 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\System32\scecli.dll
[2009.04.10 23:28:26 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e\scecli.dll
 
< MD5 for: USER32.DLL  >
[2009.04.10 23:28:26 | 000,627,712 | ---- | M] (Microsoft Corporation) MD5=75510147B94598407666F4802797C75A -- C:\Windows\System32\user32.dll
[2009.04.10 23:28:26 | 000,627,712 | ---- | M] (Microsoft Corporation) MD5=75510147B94598407666F4802797C75A -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6002.18005_none_cf23e54d6a7e4a7e\user32.dll
[2008.01.21 03:24:21 | 000,627,200 | ---- | M] (Microsoft Corporation) MD5=B974D9F06DC7D1908E825DC201681269 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_cd386c416d5c7f32\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2008.01.21 03:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe
[2008.01.21 03:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2009.04.10 23:28:14 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\System32\winlogon.exe
[2009.04.10 23:28:14 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe
[2008.01.21 03:24:49 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2008.01.21 03:24:47 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\System32\drivers\ws2ifsl.sys
[2008.01.21 03:24:47 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6001.18000_none_4f86a0d4c7cda641\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles %systemroot%\System32\config\*.sav >
 
< %systemroot%\*. /mp /s >
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 121 bytes -> C:\ProgramData\TEMP:DFC5A2B2

< End of report >
--- --- ---




Extras.Txt
OTL Logfile:
Code:
OTL Extras logfile created on: 09.01.2011 19:10:51 - Run 1
OTL by OldTimer - Version 3.2.20.1    Folder = C:\Users\Brandon\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6002.18005)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 82,00% Memory free
6,00 Gb Paging File | 5,00 Gb Available in Paging File | 95,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 192,06 Gb Total Space | 154,81 Gb Free Space | 80,61% Space Free | Partition Type: NTFS
Drive D: | 97,03 Gb Total Space | 44,98 Gb Free Space | 46,36% Space Free | Partition Type: NTFS
 
Computer Name: BRANDON-PC | User Name: Brandon | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = ChromeHTML] -- C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.)
 
[HKEY_USERS\S-1-5-21-4048956899-1286244931-2967521482-1000\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
http [open] -- "C:\Program Files\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
https [open] -- "C:\Program Files\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{099A04C9-9840-40F7-8A67-2ABDE9D9A08E}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe |
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{3E48C035-0396-4DE6-8F0C-956A06124BFC}" = dir=in | app=c:\program files\cyberlink\powerdvd\powerdvd.exe |
"{5D1602A8-F88E-44B6-9CAD-672D96FDBFE4}" = protocol=6 | dir=in | app=f:\brandon!\wow\launcher.exe |
"{7D451B0E-3D95-4F83-AFE7-48E7FB21AEC4}" = protocol=6 | dir=in | app=f:\brandon!\wow\launcher.patch.exe |
"{8A51C416-37E4-4620-A8EA-D388962C784F}" = protocol=17 | dir=in | app=f:\brandon!\wow\launcher.exe |
"{D3DBF350-7B60-4353-B56F-7B66A572CB30}" = protocol=6 | dir=in | app=c:\program files\fujitsu siemens computers\fsclounge\fscwbaseupdaterservice\2\fscwbaseupdaterservice.exe |
"{EC113663-81B6-48F6-8AE6-52D51DFDEEC1}" = protocol=17 | dir=in | app=f:\brandon!\wow\launcher.patch.exe |
"{FB55B487-F0AE-432B-968C-601E404181F5}" = protocol=17 | dir=in | app=c:\program files\fujitsu siemens computers\fsclounge\fscwbaseupdaterservice\2\fscwbaseupdaterservice.exe |
"{FF07C710-2504-4828-842E-C7042B226CCE}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"TCP Query User{8944A0F0-3A9A-40F3-9A83-8271E89E77BF}C:\program files\spyware terminator\spywareterminatorupdate.exe" = protocol=6 | dir=in | app=c:\program files\spyware terminator\spywareterminatorupdate.exe |
"TCP Query User{BA2F84DC-2EC3-4B8D-B0FB-A622D3809D8C}F:\brandon!\wow\blizzard downloader.exe" = protocol=6 | dir=in | app=f:\brandon!\wow\blizzard downloader.exe |
"UDP Query User{63C55140-173C-46BF-AE51-C43886711065}F:\brandon!\wow\blizzard downloader.exe" = protocol=17 | dir=in | app=f:\brandon!\wow\blizzard downloader.exe |
"UDP Query User{6C36225E-ACBE-4FAB-B84C-1EF73747061E}C:\program files\spyware terminator\spywareterminatorupdate.exe" = protocol=17 | dir=in | app=c:\program files\spyware terminator\spywareterminatorupdate.exe |
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{016F5FA1-FD85-FA69-885F-96A03EEEF9C1}" = CCC Help Dutch
"{017C6E75-766C-DE1C-1B48-D0230CB155BC}" = Catalyst Control Center Localization Korean
"{021C8270-F2A6-C941-3A19-EBE139C966E7}" = Catalyst Control Center Graphics Full Existing
"{04FC3DE9-BC19-E2A2-2FB9-24684DA82A36}" = CCC Help Spanish
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{05DD3745-0898-FCA7-0A52-689F128B84F9}" = CCC Help French
"{0739951F-27F4-F7FF-C26D-3C44A681933F}" = ccc-utility
"{099F2D26-B862-F04A-FC7B-E7B0B6196CA7}" = CCC Help Chinese Standard
"{0C58BA84-88A3-39FD-61DB-4DF780D1E0B9}" = CCC Help Polish
"{0C8DFC9B-FB65-1444-3E12-9DF64270347A}" = CCC Help Korean
"{139B7164-4C7B-BF85-4CA6-0DD5C611179B}" = Catalyst Control Center Localization Turkish
"{14D68B6D-4C3E-6771-1C77-4384BB653B9E}" = Catalyst Control Center Localization Chinese Traditional
"{22E719FE-F76D-0BF3-229D-7A9337458CD0}" = CCC Help German
"{26604C7E-A313-4D12-867F-7C6E7820BE4C}" = JMicron JMB38X Flash Media Controller
"{26D421BE-752E-1070-0C26-2DE993ED00B0}" = CCC Help Portuguese
"{2A63E819-5359-62CF-FCDB-3707391A08A0}" = CCC Help Chinese Traditional
"{2F926AE7-9FB7-4B34-906F-9C29A6D146A7}" = SystemDiagnostics
"{31F2D65F-84A8-D3AD-E3AF-DF127860E39E}" = CCC Help Turkish
"{373C3C97-2FA9-4E18-85A2-255060C21031}" = Nero 8 Essentials
"{3921A67A-5AB1-4E48-9444-C71814CF3027}" = VCRedistSetup
"{3F026B88-D153-93DB-A99B-2A78AFEFF813}" = Catalyst Control Center Localization Polish
"{3F03121C-CA62-D0E1-7957-5C82A4CF3C69}" = Catalyst Control Center Localization Norwegian
"{45A34A3F-3597-AA37-E44B-9B95852055A9}" = CCC Help Swedish
"{4811A487-6830-E60D-CD37-816E46C8988D}" = Catalyst Control Center Localization Portuguese
"{49083280-8601-EF0D-EC78-6A8FD9C54172}" = CCC Help Thai
"{4A5DC837-AD1B-D80E-FDE5-4793DC47F695}" = CCC Help Finnish
"{4AAF1376-9CB5-B232-22EE-D0EE53ED9148}" = Catalyst Control Center Localization Danish
"{4EBE8518-B14F-B69E-082B-E6FB85F6B52E}" = CCC Help Italian
"{4F2E897D-39A4-73B7-6614-F1EC2B43A1B5}" = CCC Help Czech
"{5413DF9C-4FCC-39A1-FB67-6945428DA718}" = Catalyst Control Center Localization Russian
"{55035C7B-61D2-1DC1-EC53-CFD01C3F82F9}" = CCC Help Hungarian
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{58BAA8D0-404E-4585-9FD3-ED1BB72AC2EE}" = Adobe Flash Player 9 ActiveX
"{60DCEC40-8854-B0B5-7828-A6E14DBE71EC}" = Catalyst Control Center Graphics Previews Vista
"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{6DC0B476-B032-83DE-9637-3F6809A344C1}" = Skins
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{774715EC-6B2F-092E-0221-B464A80F565A}" = Catalyst Control Center Localization Italian
"{78B1919F-EFDD-5A23-7393-7887C53BE013}" = CCC Help Danish
"{7E1043B7-AA4D-A877-9A26-D1B3E78DF051}" = CCC Help Norwegian
"{81758E18-D5EA-4049-844A-E2DDDDDA9798}" = CCC Help English
"{81794E08-21DA-189A-1DD5-AEDBBE0BE37B}" = CCC Help Russian
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0015-0407-0000-0000000FF1CE}_PROPLUSR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_PROPLUSR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_PROPLUSR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_PROPLUSR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_PROPLUSR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_PROPLUSR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_PROPLUSR_{A0516415-ED61-419A-981D-93596DA74165}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_PROPLUSR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_PROPLUSR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_PROPLUSR_{322296D4-1EAE-4030-9FBC-D2787EB25FA2}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-0044-0407-0000-0000000FF1CE}_PROPLUSR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_PROPLUSR_{26454C26-D259-4543-AA60-3189E09C5F76}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2007
"{91120000-0011-0000-0000-0000000FF1CE}_PROPLUSR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{95104E32-1B84-0E33-14BE-BA115643629C}" = Catalyst Control Center Graphics Light
"{9687697B-1055-E1E5-2D31-061CC502AB31}" = ATI Catalyst Install Manager
"{97C82B44-D408-4F14-9252-47FC1636D23E}_is1" = IZArc 4.1.2
"{98383302-798D-2089-9143-D64E35D666BD}" = Catalyst Control Center Localization Greek
"{9860F761-0ADB-1149-1A0D-1CBBFD693A3D}" = Catalyst Control Center Localization Finnish
"{9A3BC157-B94F-4EFD-ABA9-1E56DEB00655}" = FSCLounge
"{9D26F264-EFA2-31BB-D49F-380FD60207FA}" = Catalyst Control Center Core Implementation
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{A777FF2A-942F-CBB0-C36B-F9B72E95B7D9}" = Catalyst Control Center Localization Czech
"{A7FB84F1-FA4F-4B50-9AEC-4F83AB1DFEBE}" = G Data AntiVirus 2011
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1031-7B44-A90000000001}" = Adobe Reader 9 - Deutsch
"{AFC454ED-A26F-4816-826B-C35129D82E1F}" = Fujitsu Siemens Computers Recovery
"{B1EEB795-48EE-AA3B-7CF9-5CE4B7883792}" = Catalyst Control Center Localization German
"{B3905755-64EC-422E-A4D9-644D6D8FDE5E}" = ccc-core-static
"{B3D068F7-34DD-2BB7-6F2F-D67274819ACC}" = Catalyst Control Center Localization Swedish
"{C698749A-7BB4-BE2A-9551-EC85C8A65E2F}" = CCC Help Greek
"{CA45B622-88F9-4836-A529-DBF14698498D}" = Catalyst Control Center - Branding
"{CD95D125-2992-4858-B3EF-5F6FB52FBAD6}" = Skype Toolbars
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CF06DB43-2F14-EA98-AB1B-124FD65A8AEE}" = Catalyst Control Center InstallProxy
"{D0846526-66DD-4DC9-A02C-98F9A2806812}" = Launch Manager V1.5.4
"{D21E879C-8400-BEE3-23AB-9399DEF9F7D1}" = Catalyst Control Center Localization Hungarian
"{DCA2E1BC-7FB4-217C-54C6-B99D4EA7FFCF}" = Catalyst Control Center Localization Dutch
"{E633D396-5188-4E9D-8F6B-BFB8BF3467E8}" = Skype™ 5.1
"{E7B4D6A2-D6B1-29A3-7720-C35599A8718B}" = Catalyst Control Center Localization Thai
"{EBFD0EFA-9AEF-D432-9330-717FE34FB717}" = Catalyst Control Center Localization French
"{ED3B736A-7C2E-35DB-0F33-E8C9CF101662}" = Catalyst Control Center Localization Chinese Standard
"{EECA2BE9-BB32-8E29-3293-536B600B04B4}" = Catalyst Control Center Localization Spanish
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F2E272DA-CB23-936D-268E-030DE425AD11}" = Catalyst Control Center Graphics Full New
"{F87C6FBE-FBD2-CC11-FF28-AC687D08EDF0}" = CCC Help Japanese
"{FD65BBF8-5EEB-BE96-44E8-5887B035E0F6}" = Catalyst Control Center Localization Japanese
"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Google Chrome" = Google Chrome
"Google Desktop" = Google Desktop
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.6.13)" = Mozilla Firefox (3.6.13)
"Picasa2" = Picasa 2
"PROPLUSR" = Microsoft Office Professional Plus 2007
"Spyware Terminator_is1" = Spyware Terminator
"SynTPDeinstKey" = Synaptics Pointing Device Driver
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 12.01.2008 14:39:52 | Computer Name = Brandon-PC | Source = WinMgmt | ID = 10
Description =
 
Error - 12.01.2008 14:41:55 | Computer Name = Brandon-PC | Source = VSS | ID = 8194
Description =
 
[ System Events ]
Error - 12.01.2008 15:03:14 | Computer Name = Brandon-PC | Source = Microsoft-Windows-Servicing | ID = 4385
Description =
 
Error - 12.01.2008 15:03:14 | Computer Name = Brandon-PC | Source = Microsoft-Windows-Servicing | ID = 4375
Description =
 
Error - 12.01.2008 15:03:14 | Computer Name = Brandon-PC | Source = Microsoft-Windows-Servicing | ID = 4385
Description =
 
Error - 12.01.2008 15:13:15 | Computer Name = Brandon-PC | Source = Microsoft-Windows-WLAN-AutoConfig | ID = 10000
Description =
 
Error - 12.01.2008 15:13:15 | Computer Name = Brandon-PC | Source = HTTP | ID = 15016
Description =
 
Error - 12.01.2008 15:28:20 | Computer Name = Brandon-PC | Source = W32Time | ID = 39452706
Description = Der Zeitdienst hat festgestellt, dass die Systemzeit um +93139235
Sekunden geändert werden muss. Die Systemzeit kann durch den Zeitdienst um maximal
 +54000 Sekunden geändert werden. Stellen Sie sicher, dass die Uhrzeit und Zeitzone
 korrekt sind und dass die Zeitquelle time.windows.com,0x9 (ntp.m|0x9|0.0.0.0:123->207.46.232.182:123)
 funktionsfähig ist.
 
Error - 12.01.2008 15:50:24 | Computer Name = Brandon-PC | Source = DCOM | ID = 10010
Description =
 
Error - 12.01.2008 15:57:30 | Computer Name = Brandon-PC | Source = Microsoft-Windows-WLAN-AutoConfig | ID = 10000
Description =
 
Error - 12.01.2008 15:58:05 | Computer Name = Brandon-PC | Source = W32Time | ID = 39452706
Description = Der Zeitdienst hat festgestellt, dass die Systemzeit um +93139234
Sekunden geändert werden muss. Die Systemzeit kann durch den Zeitdienst um maximal
 +54000 Sekunden geändert werden. Stellen Sie sicher, dass die Uhrzeit und Zeitzone
 korrekt sind und dass die Zeitquelle time.windows.com,0x9 (ntp.m|0x9|0.0.0.0:123->207.46.232.182:123)
 funktionsfähig ist.
 
Error - 26.12.2010 10:37:38 | Computer Name = Brandon-PC | Source = Microsoft-Windows-WLAN-AutoConfig | ID = 10000
Description =
 
 
< End of report >
--- --- ---



....... und nun???

markusg 09.01.2011 20:00
• Starte bitte die OTL.exe
• Kopiere nun das Folgende in die Textbox.

:OTL
O4 - HKU\S-1-5-21-4048956899-1286244931-2967521482-1000..\RunOnce: [eFjBp01804] C:\ProgramData\eFjBp01804\eFjBp01804.exe ()
[2011.01.09 16:46:39 | 000,000,000 | ---D | C] -- C:\ProgramData\WindowsSearch
[2011.01.09 16:38:50 | 000,000,000 | ---D | C] -- C:\Users\Brandon\AppData\Roaming
[2011.01.09 16:29:19 | 000,000,000 | ---D | C] -- C:\ProgramData\eFjBp01804
[2011.01.09 16:38:50 | 000,000,772 | ---- | M] () -- C:\Users\Brandon\Desktop\System Tool 2011.lnk
:Files
:Commands
[purity]
[EMPTYFLASH]
[emptytemp]
[Reboot]

• Schliesse bitte nun alle Programme.
• Klicke nun bitte auf den Fix Button.
• OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
• Nach dem Neustart findest Du ein Textdokument, dessen inhalt in deiner nächsten antwort hier reinkopieren.
öffne computer, c: dann _OTL
dort rechtsklick auf moved files
wähle zu moved files.rar oder zip hinzufügen.
lade das archiv in unserem upload channel hoch.
http://www.trojaner-board.de/54791-a...ner-board.html

supidupi 09.01.2011 20:07
Den Rechner dann wieder im angesicherten Modus hochfahren? sonst bekomme ich ja vielleicht keinen Zugang zum Internet.

markusg 09.01.2011 20:08
doch solltest du.
falls nicht, im abgesicherten :-)

supidupi 09.01.2011 20:19
All processes killed
========== OTL ==========
Registry value HKEY_USERS\S-1-5-21-4048956899-1286244931-2967521482-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\\eFjBp01804 deleted successfully.
C:\ProgramData\eFjBp01804\eFjBp01804.exe moved successfully.
C:\ProgramData\WindowsSearch\MiniDumps folder moved successfully.
C:\ProgramData\WindowsSearch folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Spyware Terminator\Reports folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Spyware Terminator\LanguageAct folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Spyware Terminator folder moved successfully.
C:\Users\Brandon\AppData\Roaming\skypePM folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Skype\shared_httpfe folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Skype\shared_html\skypehome\i\production folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Skype\shared_html\skypehome\i\languages folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Skype\shared_html\skypehome\i\images\fancybox folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Skype\shared_html\skypehome\i\images\buttons folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Skype\shared_html\skypehome\i\images\avatarview folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Skype\shared_html\skypehome\i\images folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Skype\shared_html\skypehome\i folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Skype\shared_html\skypehome folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Skype\shared_html\pcj\i\js\languages folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Skype\shared_html\pcj\i\js folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Skype\shared_html\pcj\i\images\promotions folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Skype\shared_html\pcj\i\images\buttons folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Skype\shared_html\pcj\i\images\backgrounds folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Skype\shared_html\pcj\i\images folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Skype\shared_html\pcj\i\css folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Skype\shared_html\pcj\i folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Skype\shared_html\pcj\assets\promotions folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Skype\shared_html\pcj\assets folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Skype\shared_html\pcj folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Skype\shared_html folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Skype\shared_dynco folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Skype\My Skype Received Files folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Skype\graardor2\voicemail folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Skype\graardor2\httpfe folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Skype\graardor2\chatsync\ff folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Skype\graardor2\chatsync\fe folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Skype\graardor2\chatsync\dc folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Skype\graardor2\chatsync\61 folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Skype\graardor2\chatsync\3e folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Skype\graardor2\chatsync folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Skype\graardor2 folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Skype folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Mozilla\Firefox\Profiles\wb3p44e5.default\minidumps folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Mozilla\Firefox\Profiles\wb3p44e5.default\extensions folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Mozilla\Firefox\Profiles\wb3p44e5.default\chrome folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Mozilla\Firefox\Profiles\wb3p44e5.default\bookmarkbackups folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Mozilla\Firefox\Profiles\wb3p44e5.default folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Mozilla\Firefox\Profiles folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Mozilla\Firefox\Crash Reports folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Mozilla\Firefox folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384} folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Mozilla\Extensions folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Mozilla folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Microsoft\Word\STARTUP folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Microsoft\Word folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Microsoft\Windows\Templates folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tool folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Fujitsu Siemens Computers folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink PowerDVD folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Microsoft\Windows\Start Menu\Programme folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Microsoft\Windows\Start Menu folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Microsoft\Windows\SendTo folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Microsoft\Windows\Recent folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Microsoft\Windows\Printer Shortcuts folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Microsoft\Windows\Network Shortcuts folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Microsoft\Windows\Cookies\Low folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Microsoft\Windows\Cookies folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Microsoft\Windows folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Microsoft\UProof folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Microsoft\Templates folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Microsoft\SystemCertificates\My folder moved successfully.
Folder move failed. C:\Users\Brandon\AppData\Roaming\Microsoft\SystemCertificates scheduled to be moved on reboot.
C:\Users\Brandon\AppData\Roaming\Microsoft\Protect\S-1-5-21-4048956899-1286244931-2967521482-1000 folder moved successfully.
Folder move failed. C:\Users\Brandon\AppData\Roaming\Microsoft\Protect scheduled to be moved on reboot.
C:\Users\Brandon\AppData\Roaming\Microsoft\Proof folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Microsoft\Outlook folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Microsoft\Office\Recent folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Microsoft\Office folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Microsoft\Internet Explorer folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Microsoft\Installer\{9A3BC157-B94F-4EFD-ABA9-1E56DEB00655} folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Microsoft\Installer folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Microsoft\Document Building Blocks\1031 folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Microsoft\Document Building Blocks folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-4048956899-1286244931-2967521482-1000 folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Microsoft\Crypto\RSA folder moved successfully.
Folder move failed. C:\Users\Brandon\AppData\Roaming\Microsoft\Crypto scheduled to be moved on reboot.
Folder move failed. C:\Users\Brandon\AppData\Roaming\Microsoft\Credentials scheduled to be moved on reboot.
C:\Users\Brandon\AppData\Roaming\Microsoft\AddIns folder moved successfully.
Folder move failed. C:\Users\Brandon\AppData\Roaming\Microsoft scheduled to be moved on reboot.
C:\Users\Brandon\AppData\Roaming\Media Center Programs folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.daredorm.com folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#s.ytimg.com folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#mpsnare.iesnare.com folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#members.livejasmin.com folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#img.livejasmin.com folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#img.6waves.com folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#freeporn.youngleafs.com folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#chatango.com folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#cdnbakmi.kaltura.com folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\macromedia.com folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\AF6AGCNW\www.daredorm.com\swf\flowplayer\flowplayer.commercial-3.1.1.swf folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\AF6AGCNW\www.daredorm.com\swf\flowplayer folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\AF6AGCNW\www.daredorm.com\swf folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\AF6AGCNW\www.daredorm.com folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\AF6AGCNW\skype.com\#user folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\AF6AGCNW\skype.com\#ui folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\AF6AGCNW\skype.com folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\AF6AGCNW\s.ytimg.com folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\AF6AGCNW\mpsnare.iesnare.com folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\AF6AGCNW\img.6waves.com\create-my-app\save_banana\game.swf folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\AF6AGCNW\img.6waves.com\create-my-app\save_banana folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\AF6AGCNW\img.6waves.com\create-my-app folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\AF6AGCNW\img.6waves.com folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\AF6AGCNW\freeporn.youngleafs.com\#kernelteam folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\AF6AGCNW\freeporn.youngleafs.com folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\AF6AGCNW\chatango.com folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\AF6AGCNW\cdnbakmi.kaltura.com\p\192572\sp\19257200\flash\kdp3\v3.4.10.1\kdp3.swf folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\AF6AGCNW\cdnbakmi.kaltura.com\p\192572\sp\19257200\flash\kdp3\v3.4.10.1 folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\AF6AGCNW\cdnbakmi.kaltura.com\p\192572\sp\19257200\flash\kdp3 folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\AF6AGCNW\cdnbakmi.kaltura.com\p\192572\sp\19257200\flash folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\AF6AGCNW\cdnbakmi.kaltura.com\p\192572\sp\19257200 folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\AF6AGCNW\cdnbakmi.kaltura.com\p\192572\sp folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\AF6AGCNW\cdnbakmi.kaltura.com\p\192572 folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\AF6AGCNW\cdnbakmi.kaltura.com\p folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\AF6AGCNW\cdnbakmi.kaltura.com folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\AF6AGCNW folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player\#SharedObjects folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Macromedia\Flash Player folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Macromedia folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Identities\{E339429E-95C8-4122-ABCE-3B45431A0279} folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Identities folder moved successfully.
C:\Users\Brandon\AppData\Roaming\ATI\ACE folder moved successfully.
C:\Users\Brandon\AppData\Roaming\ATI folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Adobe\Flash Player\AssetCache\36AXTJXZ folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Adobe\Flash Player\AssetCache folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Adobe\Flash Player folder moved successfully.
C:\Users\Brandon\AppData\Roaming\Adobe folder moved successfully.
Folder move failed. C:\Users\Brandon\AppData\Roaming scheduled to be moved on reboot.
Folder C:\ProgramData\eFjBp01804\ not found.
C:\Users\Brandon\Desktop\System Tool 2011.lnk moved successfully.
========== FILES ==========
========== COMMANDS ==========

[EMPTYFLASH]

User: All Users

User: Brandon

User: Default

User: Default User

User: Public

Total Flash Files Cleaned = 0,00 mb


[EMPTYTEMP]

User: All Users

User: Brandon
->Temp folder emptied: 64549594 bytes
->Temporary Internet Files folder emptied: 42348258 bytes
->FireFox cache emptied: 85994028 bytes
->Google Chrome cache emptied: 6353877 bytes

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Default User

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 118238874 bytes
RecycleBin emptied: 36331389 bytes

Total Files Cleaned = 337,00 mb


OTL by OldTimer - Version 3.2.20.1 log created on 01092011_201324

Files\Folders moved on Reboot...
Folder move failed. C:\Users\Brandon\AppData\Roaming\Microsoft\SystemCertificates scheduled to be moved on reboot.
Folder move failed. C:\Users\Brandon\AppData\Roaming\Microsoft\Protect scheduled to be moved on reboot.
Folder move failed. C:\Users\Brandon\AppData\Roaming\Microsoft\Crypto scheduled to be moved on reboot.
Folder move failed. C:\Users\Brandon\AppData\Roaming\Microsoft\Credentials scheduled to be moved on reboot.
Folder move failed. C:\Users\Brandon\AppData\Roaming\Microsoft\SystemCertificates scheduled to be moved on reboot.
Folder move failed. C:\Users\Brandon\AppData\Roaming\Microsoft\Protect scheduled to be moved on reboot.
Folder move failed. C:\Users\Brandon\AppData\Roaming\Microsoft\Crypto scheduled to be moved on reboot.
Folder move failed. C:\Users\Brandon\AppData\Roaming\Microsoft\Credentials scheduled to be moved on reboot.
Folder move failed. C:\Users\Brandon\AppData\Roaming\Microsoft scheduled to be moved on reboot.
Folder move failed. C:\Users\Brandon\AppData\Roaming\Microsoft\SystemCertificates scheduled to be moved on reboot.
Folder move failed. C:\Users\Brandon\AppData\Roaming\Microsoft\Protect scheduled to be moved on reboot.
Folder move failed. C:\Users\Brandon\AppData\Roaming\Microsoft\Crypto scheduled to be moved on reboot.
Folder move failed. C:\Users\Brandon\AppData\Roaming\Microsoft\Credentials scheduled to be moved on reboot.
Folder move failed. C:\Users\Brandon\AppData\Roaming\Microsoft scheduled to be moved on reboot.
Folder move failed. C:\Users\Brandon\AppData\Roaming scheduled to be moved on reboot.

Registry entries deleted on Reboot...



Den Rest muss ich mir noch einmal ansehen - was ich da jetzt machen muss...

markusg 09.01.2011 20:30
noch nichts. ich hab nen fehler gemacht.
noch nichts, ich hab nen fehler gemacht!
öffne mal mein computer. dort öffnest du mal _OTL, dort ist nen ordner mit heutigem datum und den öffnest du ebenfalls. dort findest du doch sicher:
C:\Users\Brandon\AppData\Roaming
diesen ordner einmal anklicken und mache dann einen rechtsklick, wähle kopieren.
der ordner muss dann hier eingefügt werden
C:\Users\Brandon\AppData\
also navigiere dort hin, rechtsklick und einfügen.

supidupi 09.01.2011 20:43
???

Ich soll den Roaming Ordner aus AppData

in AppData einfügen?

Das ist doch das gleiche Verzeichnis - oder? Es gibt keinen weiteren AppData Ordner.
Oder soll ich ihn in Brandon einfügen - neben AppData ?

markusg 09.01.2011 20:46
wenn du den ordner moved files öffnest, dann den ordner mit heutigem datum findest du dort
C:\Users\Brandon\AppData\Roaming
und den musst du wieder an seinen ursprungsort einfügen
C:\Users\Brandon\AppData\
wenn der ordner
C:\Users\Brandon\AppData\
noch vorhanden ist. musst du ihn in moved files öffnen, und den inhalt wieder im original ordner einfügen.

supidupi 09.01.2011 20:56
Ich steh auf dem Schlauch.

Also, ich öffne den Datums-Ordner von heute in moved files

Da gibt es 2 Ordner

C_ProgramData
C_Users

In

C_Users gibt es den Ordner

Brandon - darin

AppData - und darin

Roaming

Und den soll ich jetzt genau Wohin kopieren?

markusg 09.01.2011 21:08
C:\Users\Brandon\AppData\Roaming
dort hin.
wenn es den ordner
Roaming
dort bereits gibt. öffnest du ihn jeweils in moved files und im original verzeichniss
C:\Users\Brandon\AppData\
und kopierst den inhalt des Roaming
von moved files in den original Roaming
ordner.

supidupi 09.01.2011 21:21
Also in dem regulären Ordner (nicht dem _OTL.....)

c:\User\Brandon\

gibt es nur folgende Ordner

Bilder
Desktop
Dokumente
Download
Favoriten
Gespeicherte Spiele
Kontakt
Links
Musik
Suchvorgänge
Videos


Und wenn ich das mit meinem PC vergleiche, da gibt es dort auch keinen AppData Ordner.

markusg 09.01.2011 21:29
blende versteckte datein + ordner ein.
Anzeigen versteckter Dateien
weiterhin geschützte systemdateien, warnmeldung mit ja bestätigen, und inhalte von systemordnern oder ähnlich. dann solltest du ihn sehen.

supidupi 09.01.2011 21:53
Vielen Dank - es hat geklappt. Wobei es offenbar ein paar Dateien gab, die nicht kopiert werden konnten, weil irgendwelche Programme geöffnet waren. Aber es war nix auf. Hmmm, na ja.

Er ist normal hochgefahren, alles scheint zu klappen.

Vielen, vielen Dank für die Mühe und die Geduld.


Alle Zeitangaben in WEZ +1. Es ist jetzt 16:26 Uhr.
Seite 1 von 3 1 23
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19